Guten Tag,

ich habe einen Laptop mit Windows 7 und als Sicherheitssoftware die Norton Suite, die keine Warnung gegeben hat.
Ein Scan mit Malwarebytes war ohne Befund, aber ein gmer-scan gab eine Warnung aus und rootkit-buster fand zwei verdächtige Einträge (siehe Protokoll).

Bin ich infiziert, was wäre zu tun ?

Gruß und Dank im voraus

Oligitim

+----------------------------------------------------
| Trend Micro RootkitBuster
| Module version: 5.0.0.1061
| Computer Name: xxxxxxxxxxxx
| OS version: 6.1-7601
| User Name: xxxxxxxxxxxxxxxxx
+-----------------------------------------------


--== Dump Hidden MBR, Hidden Files and Alternate Data Streams on C:\ ==--
No hidden files found.

--== Dump Hidden Registry Value on HKLM ==--
[HIDDEN_REGISTRY][Hidden Reg Key]:
KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002556c9a405
SubKey : 002556c9a405
FullLength: 89
[HIDDEN_REGISTRY][Hidden Reg Value]:
KeyPath : HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc\Parameters\PortKeywords\Teredo
Root : 738b0ac
SubKey : Teredo
ValueName : Collection
Data : D4 FC 1 0 D8 D 1 0
ValueType : 3
AccessType: 0
FullLength: 90
DataSize : 8
2 hidden registry entries found.


--== Dump Hidden Process ==--
No hidden processes found.

--== Dump Hidden Driver ==--
No hidden drivers found.

--== Service Win32 API Hook List ==--
[HOOKED_SERVICE_API]:
Service API : ZwAlertResumeThread
Image Path :
OriginalHandler : 0x832e1c99
CurrentHandler : 0x8773b680
ServiceNumber : 0xd
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwAlertThread
Image Path :
OriginalHandler : 0x83234be0
CurrentHandler : 0x8773b760
ServiceNumber : 0xe
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwAllocateVirtualMemory
Image Path :
OriginalHandler : 0x8322dbec
CurrentHandler : 0x8773a128
ServiceNumber : 0x13
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwAlpcConnectPort
Image Path :
OriginalHandler : 0x8327944e
CurrentHandler : 0x8768c288
ServiceNumber : 0x16
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwAssignProcessToJobObject
Image Path :
OriginalHandler : 0x83202fee
CurrentHandler : 0x87820e48
ServiceNumber : 0x2b
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwCreateMutant
Image Path :
OriginalHandler : 0x832142b2
CurrentHandler : 0x8773b3d0
ServiceNumber : 0x4a
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwCreateSymbolicLinkObject
Image Path :
OriginalHandler : 0x83205911
CurrentHandler : 0x87820b68
ServiceNumber : 0x56
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwCreateThread
Image Path :
OriginalHandler : 0x832dfeca
CurrentHandler : 0x8773a630
ServiceNumber : 0x57
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwCreateThreadEx
Image Path :
OriginalHandler : 0x8327436b
CurrentHandler : 0x87820c58
ServiceNumber : 0x58
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwDebugActiveProcess
Image Path :
OriginalHandler : 0x832b1d9a
CurrentHandler : 0x87820f28
ServiceNumber : 0x60
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwDuplicateObject
Image Path :
OriginalHandler : 0x8323567a
CurrentHandler : 0x8773a2f8
ServiceNumber : 0x6f
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwFreeVirtualMemory
Image Path :
OriginalHandler : 0x830bbaec
CurrentHandler : 0x8773be90
ServiceNumber : 0x83
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwImpersonateAnonymousToken
Image Path :
OriginalHandler : 0x831f98e0
CurrentHandler : 0x8773b4c0
ServiceNumber : 0x91
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwImpersonateThread
Image Path :
OriginalHandler : 0x8327d84c
CurrentHandler : 0x8773b5a0
ServiceNumber : 0x93
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwLoadDriver
Image Path :
OriginalHandler : 0x831c9c20
CurrentHandler : 0x87688ba0
ServiceNumber : 0x9b
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwMapViewOfSection
Image Path :
OriginalHandler : 0x8324a532
CurrentHandler : 0x8773bd90
ServiceNumber : 0xa8
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwOpenEvent
Image Path :
OriginalHandler : 0x83213cae
CurrentHandler : 0x8773b2f0
ServiceNumber : 0xb1
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwOpenProcess
Image Path :
OriginalHandler : 0x83215af8
CurrentHandler : 0x8773a4d8
ServiceNumber : 0xbe
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwOpenProcessToken
Image Path :
OriginalHandler : 0x8326823f
CurrentHandler : 0x8773a218
ServiceNumber : 0xbf
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwOpenSection
Image Path :
OriginalHandler : 0x8326d8bb
CurrentHandler : 0x8773b130
ServiceNumber : 0xc2
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwOpenThread
Image Path :
OriginalHandler : 0x83261fc3
CurrentHandler : 0x8773a3e8
ServiceNumber : 0xc6
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwProtectVirtualMemory
Image Path :
OriginalHandler : 0x832465a1
CurrentHandler : 0x87820d58
ServiceNumber : 0xd7
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwResumeThread
Image Path :
OriginalHandler : 0x83274592
CurrentHandler : 0x8773b840
ServiceNumber : 0x130
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwSetContextThread
Image Path :
OriginalHandler : 0x832e1745
CurrentHandler : 0x8773bae0
ServiceNumber : 0x13c
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwSetInformationProcess
Image Path :
OriginalHandler : 0x8323c78d
CurrentHandler : 0x8773bbc0
ServiceNumber : 0x14d
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwSetSystemInformation
Image Path :
OriginalHandler : 0x8325229a
CurrentHandler : 0x8773b028
ServiceNumber : 0x15e
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwSuspendProcess
Image Path :
OriginalHandler : 0x832e1bd3
CurrentHandler : 0x8773b210
ServiceNumber : 0x16e
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwSuspendThread
Image Path :
OriginalHandler : 0x83299085
CurrentHandler : 0x8773b920
ServiceNumber : 0x16f
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwTerminateProcess
Image Path :
OriginalHandler : 0x8325ebfb
CurrentHandler : 0x8773a710
ServiceNumber : 0x172
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwTerminateThread
Image Path :
OriginalHandler : 0x8327c584
CurrentHandler : 0x8773ba00
ServiceNumber : 0x173
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwUnmapViewOfSection
Image Path :
OriginalHandler : 0x8326887a
CurrentHandler : 0x8773bcb0
ServiceNumber : 0x181
ModuleName :
SDTType : 0x0
[HOOKED_SERVICE_API]:
Service API : ZwWriteVirtualMemory
Image Path :
OriginalHandler : 0x83263958
CurrentHandler : 0x8773bf80
ServiceNumber : 0x18f
ModuleName :
SDTType : 0x0
No hidden operating system service hooks found.

--== Dump Hidden Port ==--
No hidden ports found.

--== Dump Kernel Code Patching ==--
No kernel code patching detected.

--== Dump Hidden Services ==--
No hidden services found.

Hallo,

bitte das GMER Log nachreichen