Virus öffnet selbständig Tabs in Firefox

GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-08-24 19:13:43
Windows 5.1.2600 Service Pack 3
Running: 3p9zkh2u.exe; Driver: C:\DOKUME~1\doris\LOKALE~1\Temp\kglcqpod.sys


---- System - GMER 1.0.15 ----

SSDT            F7B14056                                                                                                             ZwCreateKey
SSDT            F7B1404C                                                                                                             ZwCreateThread
SSDT            F7B1405B                                                                                                             ZwDeleteKey
SSDT            F7B14065                                                                                                             ZwDeleteValueKey
SSDT            F7B1406A                                                                                                             ZwLoadKey
SSDT            F7B14038                                                                                                             ZwOpenProcess
SSDT            F7B1403D                                                                                                             ZwOpenThread
SSDT            F7B14074                                                                                                             ZwReplaceKey
SSDT            F7B1406F                                                                                                             ZwRestoreKey
SSDT            F7B14060                                                                                                             ZwSetValueKey
SSDT            F7B14047                                                                                                             ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\system32\DRIVERS\atksgt.sys                                                                               section is writeable [0xEB56B300, 0x3ACC8, 0xE8000020]
.text           C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                                                               section is writeable [0xEDAB8300, 0x1B7E, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\System32\svchost.exe[1096] ntdll.dll!NtProtectVirtualMemory                                               7C91D6EE 5 Bytes  JMP 006E000A 
.text           C:\WINDOWS\System32\svchost.exe[1096] ntdll.dll!NtWriteVirtualMemory                                                 7C91DFAE 5 Bytes  JMP 006F000A 
.text           C:\WINDOWS\System32\svchost.exe[1096] ntdll.dll!KiUserExceptionDispatcher                                            7C91E47C 5 Bytes  JMP 006D000C 
.text           C:\WINDOWS\System32\svchost.exe[1096] USER32.dll!GetCursorPos                                                        7E37974E 5 Bytes  JMP 0179000A 
.text           C:\WINDOWS\System32\svchost.exe[1096] ole32.dll!CoCreateInstance                                                     774D057E 5 Bytes  JMP 00DE000A 
.text           C:\WINDOWS\Explorer.EXE[1912] ntdll.dll!NtProtectVirtualMemory                                                       7C91D6EE 5 Bytes  JMP 00B8000A 
.text           C:\WINDOWS\Explorer.EXE[1912] ntdll.dll!NtWriteVirtualMemory                                                         7C91DFAE 5 Bytes  JMP 00BE000A 
.text           C:\WINDOWS\Explorer.EXE[1912] ntdll.dll!KiUserExceptionDispatcher                                                    7C91E47C 5 Bytes  JMP 00B7000C 

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                              SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                              SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                             fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0x48 0x1F 0x72 0x5A ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0xB2 0x85 0x09 0xA0 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xD3 0xC1 0xEC 0x73 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x0D 0x2D 0xD8 0xBC ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0xB2 0x85 0x09 0xA0 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xD3 0xC1 0xEC 0x73 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x0D 0x2D 0xD8 0xBC ...
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg             HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x48 0x1F 0x72 0x5A ...
Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg             HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0x48 0x1F 0x72 0x5A ...

---- EOF - GMER 1.0.15 ----