AntiVir hat DR/PSW.Cain.284.3 Dropper TR/Rootkit.Gen und TR/Crypt.XPACK.Gen2 gefunden! Zitat:
Zitat von
cosinus Ok. Bitte nun Logs mit
GMER und
OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur
OSAM aus - die Online-Abfrage durch
OSAM bitte überspringen.
Bei
OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.
GMER hat beim ersten Mal einwandfrei ohne Absturz funktioniert.
Hier das Logfile von GMER:
Code:
Alles auswählen Aufklappen ATTFilter
GMER 1.0.15.15627 - hxxp://www.gmer.net
Rootkit scan 2011-05-20 19:54:53
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-17 WDC_WD1200JD-00HBB0 rev.08.02D08
Running: 7rj48ke2.exe; Driver: C:\DOKUME~1\Peter\LOKALE~1\Temp\fxtdypog.sys
---- System - GMER 1.0.15 ----
SSDT F6EF1136 ZwCreateKey
SSDT F6EF112C ZwCreateThread
SSDT F6EF113B ZwDeleteKey
SSDT F6EF1145 ZwDeleteValueKey
SSDT F6EF114A ZwLoadKey
SSDT F6EF1118 ZwOpenProcess
SSDT F6EF111D ZwOpenThread
SSDT F6EF1154 ZwReplaceKey
SSDT F6EF114F ZwRestoreKey
SSDT F6EF1140 ZwSetValueKey
INT 0x06 \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) EB96916D
INT 0x0E \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) EB968FC2
INT 0x62 ? FAF45044
INT 0x63 ? FABC19DC
INT 0x73 ? FAC138BC
INT 0x82 ? FAF11954
INT 0x83 ? FAF1ABEC
INT 0x92 ? FABB3BEC
INT 0xA3 ? FAC1C044
INT 0xA4 ? FAC90044
INT 0xB1 ? FAFB5BEC
INT 0xB2 ? FABB1BEC
INT 0xB4 ? FAC148BC
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\drivers\hardlock.sys section is writeable [0xEB5ED400, 0x7960C, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xEB68F420] C:\WINDOWS\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xEB68F420]
.protectÿÿÿÿhardlockunknown last code section [0xEB68F200, 0x5049, 0xE0000020] C:\WINDOWS\system32\drivers\hardlock.sys unknown last code section [0xEB68F200, 0x5049, 0xE0000020]
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
Und hier das Logfile von
OSAM :
Code:
Alles auswählen Aufklappen ATTFilter
Report of OSAM : Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 20:15:00 on 20.05.2011
OS: Windows XP Professional Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures
Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries
[Common]
-----( %SystemRoot%\Tasks )-----
"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Google Software Updater.job" - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"Orb Index when idle.job" - "Orb Networks" - C:\Programme\Winamp Remote\bin\OrbLauncher.exe
-----( HKLM\SOFTWARE\Classes\exefile\shell\open\command )-----
"{Default}" - ? - "%1" %* (Hidden registry entry, rootkit activity | System default value)
[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"Desktop Search" - ? - C:\Programme\Windows Desktop Search\ControlPanel.cpl (File found, but it contains no detailed information)
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
"SMAX4CP" - "Analog Devices, Inc." - C:\Programme\Analog Devices\SoundMAX\SMax4.cpl
[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"AVM Eject" (avmeject) - "AVM Berlin" - C:\WINDOWS\System32\drivers\avmeject.sys
"BrPar" (BrPar) - "Brother Industries Ltd." - C:\WINDOWS\System32\drivers\BrPar.sys
"catchme" (catchme) - ? - C:\DOKUME~1\Peter\LOKALE~1\Temp\catchme.sys (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys (File not found)
"cpuz134" (cpuz134) - ? - C:\DOKUME~1\Peter\LOKALE~1\Temp\cpuz134\cpuz134_x32.sys (File not found)
"Haspnt" (Haspnt) - "Aladdin Knowledge Systems" - C:\WINDOWS\system32\drivers\Haspnt.sys
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys (File not found)
"Intel(R) PRO/1000 Network Connection Driver" (E1000) - ? - C:\WINDOWS\System32\DRIVERS\e1000325.sys (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys (File not found)
"mwgeobey" (mwgeobey) - ? - C:\WINDOWS\System32\drivers\xwrv.sys (File not found)
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys (File found, but it contains no detailed information)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys (File not found)
[Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Desktop\Components )-----
"(0) Die derzeitige Homepage" - ? - About 
20.05.2011, 19:22
Baum-Darstellung