Es gibt keine Beschwerden Mehr:uglyhammer:
Hoffe das es alles wahr und ich nichts mehr machen muss:party:

GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-04-09 21:43:22
Windows 6.0.6001 Service Pack 1


---- System - GMER 1.0.15 ----

SSDT 9F364D94 ZwCreateThread
SSDT 9F364D80 ZwOpenProcess
SSDT 9F364D85 ZwOpenThread
SSDT 9F364D8F ZwTerminateProcess
SSDT 9F364D8A ZwWriteVirtualMemory

INT 0x72 ? 849DBBF8
INT 0x82 ? 86A81F00
INT 0x92 ? 86A81F00
INT 0xA2 ? 86A81F00

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!KeSetTimerEx + 454 82B049F8 4 Bytes [94, 4D, 36, 9F]
.text ntkrnlpa.exe!KeSetTimerEx + 624 82B04BC8 4 Bytes [80, 4D, 36, 9F] {OR BYTE [EBP+0x36], 0x9f}
.text ntkrnlpa.exe!KeSetTimerEx + 640 82B04BE4 4 Bytes [85, 4D, 36, 9F] {TEST [EBP+0x36], ECX; LAHF }
.text ntkrnlpa.exe!KeSetTimerEx + 854 82B04DF8 4 Bytes [8F, 4D, 36, 9F]
.text ntkrnlpa.exe!KeSetTimerEx + 8B4 82B04E58 4 Bytes [8A, 4D, 36, 9F] {MOV CL, [EBP+0x36]; LAHF }
? System32\Drivers\spwl.sys Das System kann den angegebenen Pfad nicht finden. !
.text USBPORT.SYS!DllUnload 8D6364CB 5 Bytes JMP 86A814E0
.text a2ziypoo.SYS 8D7B4000 22 Bytes [26, 02, A2, 82, 10, 01, A2, ...]
.text a2ziypoo.SYS 8D7B4017 181 Bytes [00, 32, 87, 71, 80, 3D, 85, ...]
.text a2ziypoo.SYS 8D7B40CE 10 Bytes [00, 00, 00, 00, 00, 00, 6A, ...]
.text a2ziypoo.SYS 8D7B40DA 12 Bytes [00, 00, 02, 00, 00, 00, 25, ...]
.text a2ziypoo.SYS 8D7B40E7 714 Bytes [00, F0, 0E, 00, 00, 00, 00, ...]
.text ...

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\Explorer.EXE[3528] SHELL32.dll!InitNetworkAddressControl + 2939 75F00064 4 Bytes [00, 26, 2C, 00] {ADD [ESI], AH; SUB AL, 0x0}

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8060F6D2] \SystemRoot\System32\Drivers\spwl.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8060F040] \SystemRoot\System32\Drivers\spwl.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8060F7FC] \SystemRoot\System32\Drivers\spwl.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [8060F0BE] \SystemRoot\System32\Drivers\spwl.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8060F13C] \SystemRoot\System32\Drivers\spwl.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [8061F048] \SystemRoot\System32\Drivers\spwl.sys
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortNotification] CC000CC2
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortWritePortUchar] 83EC8B55
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortWritePortUlong] 575320EC
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 458DFF33
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] 8D5750FC
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortGetScatterGatherList] 5750F845
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortReadPortUchar] 8957046A
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortStallExecution] 75E8FC7D
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortGetParentBusType] BB0001E8
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortRequestCallback] 000000EA
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 850FC33B
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortGetUnCachedExtension] 0000012B
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortCompleteRequest] 0FFC7D39
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortMoveMemory] 00012284
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 458D5600
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 106A50F4
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 38335668
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortReadPortUshort] FC75FF36
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortReadPortBufferUshort] D1E85757
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortInitialize] 8B0001E7
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortGetDeviceBase] 1BDEF7F0
IAT \SystemRoot\System32\Drivers\a2ziypoo.SYS[ataport.SYS!AtaPortDeviceStateChange] 23D6F7F6

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73527BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [735698C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7352D3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7351F527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73527599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7351E43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [7355B33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7352D68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7352012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73520095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [735171F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [735AD802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [735475E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7351DAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [7351668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [735166BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73521E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [002C27E0] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Egis Inc. PSD DragDrop Protection/Egis Inc.)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [002C1D90] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Egis Inc. PSD DragDrop Protection/Egis Inc.)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [002C2B30] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Egis Inc. PSD DragDrop Protection/Egis Inc.)
IAT C:\Windows\Explorer.EXE[3528] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [002C11D0] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll (Egis Inc. PSD DragDrop Protection/Egis Inc.)

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 857A11F8

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

Device \Driver\volmgr \Device\VolMgrControl 849DE1F8
Device \Driver\usbohci \Device\USBPDO-0 86B73500
Device \Driver\usbehci \Device\USBPDO-1 86BDB1F8
Device \Driver\usbohci \Device\USBPDO-2 86B73500
Device \Driver\usbehci \Device\USBPDO-3 86BDB1F8
Device \Driver\volmgr \Device\HarddiskVolume1 849DE1F8
Device \Driver\volmgr \Device\HarddiskVolume2 849DE1F8
Device \Driver\cdrom \Device\CdRom0 86BDC1F8
Device \Driver\volmgr \Device\HarddiskVolume3 849DE1F8
Device \Driver\cdrom \Device\CdRom1 86BDC1F8
Device \Driver\sptd \Device\3172247667 spwl.sys
Device \Driver\netbt \Device\NetBt_Wins_Export 88C571F8
Device \Driver\Smb \Device\NetbiosSmb 88C331F8
Device \Driver\PCI_PNP3658 \Device\0000005a spwl.sys
Device \Driver\netbt \Device\NetBT_Tcpip_{82131D18-0A32-4582-8C62-3809AAB7DDBA} 88C571F8
Device \Driver\nvstor32 \Device\RaidPort0 857A01F8
Device \Driver\iScsiPrt \Device\RaidPort1 86BCC1F8
Device \Driver\nvstor32 \Device\0000006c 857A01F8
Device \Driver\usbohci \Device\USBFDO-0 86B73500
Device \Driver\nvstor32 \Device\0000006d 857A01F8
Device \Driver\usbehci \Device\USBFDO-1 86BDB1F8
Device \Driver\usbohci \Device\USBFDO-2 86B73500
Device \Driver\usbehci \Device\USBFDO-3 86BDB1F8
Device \Driver\netbt \Device\NetBT_Tcpip_{B7FC0445-C87B-40E7-ABFD-7C8B01794D63} 88C571F8
Device \Driver\a2ziypoo \Device\Scsi\a2ziypoo1Port2Path0Target0Lun0 86BAB1F8
Device \Driver\a2ziypoo \Device\Scsi\a2ziypoo1 86BAB1F8
Device \FileSystem\cdfs \Cdfs 86C861F8

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 2020
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x5A 0xD1 0xE1 0x74 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x70 0x36 0xE9 0x59 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xCE 0x3D 0x88 0x3B ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x5A 0xD1 0xE1 0x74 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x70 0x36 0xE9 0x59 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xCE 0x3D 0x88 0x3B ...
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-887381856-98200966-1577512417-1000@RefCount 10

---- Files - GMER 1.0.15 ----

File C:\Users\Daniel\AppData\Local\Opera\Opera\profile\vps\0008\adoc.bx-j 0 bytes
File C:\Users\Daniel\AppData\Local\Opera\Opera\profile\vps\0008\md.dat-j 0 bytes
File C:\Users\Daniel\AppData\Local\Opera\Opera\profile\vps\0008\url.ax-j 0 bytes
File C:\Users\Daniel\AppData\Local\Opera\Opera\profile\vps\0008\w.ax-j 0 bytes
File C:\Users\Daniel\AppData\Local\Opera\Opera\profile\vps\0008\wb.vx-j 0 bytes
File C:\Windows\System32\LogFiles\Scm\SCM.EVM (size mismatch) 327680/294912 bytes
File C:\Windows\System32\LogFiles\WUDF\WUDFTrace.etl (size mismatch) 8192/4096 bytes
File C:\Windows\System32\WDI\LogFiles\WdiContextLog.etl.003 (size mismatch) 475136/393216 bytes
File C:\Windows\System32\wfp\wfpdiag.etl (size mismatch) 65536/0 bytes
File C:\Windows\winsxs\pending.xml 35913 bytes

---- EOF - GMER 1.0.15 ----

Hi,

Du hast Daemon-Tools drauf und setzt eine GUI-Lib ein (anderes aussehen für Window)?

Das hier gefällt mir nicht, ist aber wohl schon weg:
System32\Drivers\spwl.sys
(Schau mal ob Du den Treiber findest)...

Sonst sieht es gut aus...

Combofix deinstallieren über
Start->Ausführen Combofix /u


chris & schöne Ostern...

Also ich Finde den Treiber net:aplaus:.
Muss ich immer noch denn Malwarebyte bericht zeigen?
Mfg ddanieldd

Ähm, hi Leute, ich bin neu hier und hab eigentlich auch das Problem, dass bei mir kein einziges Update (AntiVir, Windows, etc) funktioniert. Ich will eure Problemsuche hier nicht stören indem ich einfach meinen HJT-Log poste und für Verwirrung sorge. Soll ich ein neues Thema eröffnen obwohl ich das gleiche Problem habe?
Danke schonmal, bye

P.S. Und bitte verzeiht mir, wenn ich das ein oder andere nicht gleich verstehe, bin nicht gerade ein Profi wenns um Problembehebung geht, mein PC hat bisher ganz gut funktioniert und ich musste mich mit dem technischen Kram nicht auseinandersetzen :schmoll:

Mach einfach alles was ich auch gemacht habe.Dann gehen auch die UPdates ok.
Rest folg von Chris:heilig:

Danke Daniel :daumenhoc
Wusste nicht, ob ich auch einfach das selbe tun kann, wie gesagt, kenn mich ja nicht so gut aus, aber danke, werd ich mal machen!

EDIT: OMG! Hab daweil nur ComboFix eingesetzt, aber Updates funktionieren wieder!! Danke danke danke ;)