| |
| |||||||
Log-Analyse und Auswertung: tojaner.gbot und andere NervtöterWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
17.01.2012, 20:16
| #1 |
 |  tojaner.gbot und andere Nervtöter Hm, anhänge wollten wohl nicht ... Dann eben so: aswMBR hat nun auch geklappt und das Log gibts auch  GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-01-17 19:58:04
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS543232L9A300 rev.FB4OC40C
Running: 06djx253.exe; Driver: C:\Users\CHRIST~1\AppData\Local\Temp\kglyiuod.sys
---- System - GMER 1.0.15 ----
SSDT 90F28E9E ZwCreateSection
SSDT 90F28EA3 ZwSetContextThread
SSDT 90F28E3F ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKey + 13D1 82279369 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 822B2D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 822B9EAC 4 Bytes [9E, 8E, F2, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 822BA24C 4 Bytes [A3, 8E, F2, 90]
.text ntkrnlpa.exe!KeRemoveQueueEx + 166F 822BA324 4 Bytes [3F, 8E, F2, 90]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73A02437] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [739E5600] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [739E56BE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73A024B2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [739F8514] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [739F4CC8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [739F506F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [739F5144] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [739F6671] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [739F826B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [739F87BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [739F901B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [739FE1BE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1844] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [739F4BFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
Device \Driver\ACPI_HAL \Device\00000055 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
---- Threads - GMER 1.0.15 ----
Thread System [4:3072] A08BFF2E
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x21 0x5B 0xD7 0x52 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x17 0x10 0x6E 0x63 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x5C 0xB2 0x75 0xAA ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x21 0x5B 0xD7 0x52 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x17 0x10 0x6E 0x63 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x5C 0xB2 0x75 0xAA ...
---- EOF - GMER 1.0.15 ----
Code:
ATTFilter aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-17 20:14:27
-----------------------------
20:14:27.388 OS Version: Windows 6.1.7601 Service Pack 1
20:14:27.388 Number of processors: 2 586 0x1706
20:14:27.388 ComputerName: CHRISTIAN-PC UserName: Christian
20:14:59.870 Initialize success
20:15:08.450 AVAST engine defs: 12011700
20:16:18.213 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
20:16:18.213 Disk 0 Vendor: Hitachi_HTS543232L9A300 FB4OC40C Size: 305245MB BusType: 11
20:16:18.229 Disk 0 MBR read successfully
20:16:18.244 Disk 0 MBR scan
20:16:18.260 Disk 0 Windows 7 default MBR code
20:16:18.275 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 96419 MB offset 18434048
20:16:18.307 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 199824 MB offset 215900160
20:16:18.322 Disk 0 scanning sectors +625140400
20:16:18.556 Disk 0 scanning C:\Windows\system32\drivers
20:16:47.728 Service scanning
20:16:56.262 Modules scanning
20:17:29.305 Disk 0 trace - called modules:
20:17:29.383 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll PCIIDEX.SYS msahci.sys
20:17:29.898 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x855da030]
20:17:29.929 3 CLASSPNP.SYS[8a98759e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x854fc030]
20:17:31.287 AVAST engine scan C:\Windows
20:17:42.799 AVAST engine scan C:\Windows\system32
20:21:47.350 AVAST engine scan C:\Windows\system32\drivers
20:22:05.197 AVAST engine scan C:\Users\Christian
20:26:01.481 Disk 0 MBR has been saved successfully to "C:\Users\Christian\Desktop\MBR.dat"
20:26:01.481 The log file has been saved successfully to "C:\Users\Christian\Desktop\aswMBR.txt"
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-17 20:27:00
-----------------------------
20:27:00.481 OS Version: Windows 6.1.7601 Service Pack 1
20:27:00.481 Number of processors: 2 586 0x1706
20:27:00.497 ComputerName: CHRISTIAN-PC UserName: Christian
20:27:02.057 Initialize success
20:27:06.784 AVAST engine defs: 12011700
20:27:10.949 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
20:27:10.949 Disk 0 Vendor: Hitachi_HTS543232L9A300 FB4OC40C Size: 305245MB BusType: 11
20:27:10.980 Disk 0 MBR read successfully
20:27:10.980 Disk 0 MBR scan
20:27:10.996 Disk 0 Windows 7 default MBR code
20:27:11.011 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 96419 MB offset 18434048
20:27:11.027 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 199824 MB offset 215900160
20:27:11.042 Disk 0 scanning sectors +625140400
20:27:11.105 Disk 0 scanning C:\Windows\system32\drivers
20:27:33.397 Service scanning
20:27:35.144 Modules scanning
20:27:52.897 Disk 0 trace - called modules:
20:27:52.944 ntkrnlpa.exe CLASSPNP.SYS disk.sys ataport.SYS halmacpi.dll PCIIDEX.SYS msahci.sys
20:27:53.439 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x855da030]
20:27:53.455 3 CLASSPNP.SYS[8a98759e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x854fc030]
20:27:54.760 AVAST engine scan C:\Windows
20:28:03.209 AVAST engine scan C:\Windows\system32
20:31:29.860 AVAST engine scan C:\Windows\system32\drivers
20:31:48.257 AVAST engine scan C:\Users\Christian
21:06:08.051 AVAST engine scan C:\ProgramData
21:07:28.284 Scan finished successfully
21:08:54.503 Disk 0 MBR has been saved successfully to "C:\Users\Christian\Desktop\MBR.dat"
21:08:54.532 The log file has been saved successfully to "C:\Users\Christian\Desktop\aswMBR.txt"
Geändert von puntigamer (17.01.2012 um 21:10 Uhr) |
|
| Themen zu tojaner.gbot und andere Nervtöter |
| angezeigt, applaus, dezember, ebenfalls, eingefangen, eingefroren, explorer, festgestellt, funktionieren, gelaufen, gmer, guten, langsam, malware, modus, posten, rechner, registry, relativ, system, systemwiederherstellung, trojaner, verseucht, woche, wochen, zugang |
Hybrid-Darstellung
