| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Spionageattacke auf Rechner ?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
07.02.2013, 20:06
| #1 |
 |  Spionageattacke auf Rechner ? Ich denke dieses Mal bin ich wohl am wenigsten Schuld allerdings ist mir aufgefallen dass in letzter Zeit der Rechner meines Cousin ziemlich oft hängt bzw. sehr langsam reagiert. Wir haben uns heute beide mal gedacht dem Problem nach zu gehen... Ich benutze seinen PC ziemlich oft in den letzten 2-3 Wochen weil ich in Salzburg bei ihm übernachte... Ich habe meine eigenen Benutzerkonto und er seinen... jetzt fanden wir plötzlich folgende Datei bei mir UND ihm...? war eine TXT datei.... Bitte um Rat ? Wir fanden sie zufällig im Downloadverzeichnis.... außerdem hat ab und an nachdem wir sie öffneten mein Antivirus und Antimaleware Alarm geschlagen..... :??? Code:
ATTFilter [Build info]
Application: XXX
BuildTime: 2009-04-29-1826
BuildUser: codebuilder
BuildHost: -BUILD108
BuildConfig: Release
BuldVersion: 0.0.0.11195
Commandline: C:\Users\Elvedin\XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX4467XXXXX7z8hfsd
[System info]
Computer name: ELVEDIN-PC
Computer DNS name: Elvedin-PC
User name: Elvedin
EA_PLATFORM: Windows on X86
OS name: Windows Vista
OS version number: 6.1.7601
OS service pack: Service Pack 1
Debugger present: no
CPU count: 2
Processor type: x86
Processor level: 20
Processor revision: 512
Memory load: 53%
Total physical memory: 3818 Mb
Available physical memory: 1791 Mb
Total page file memory: 7635 Mb
Available page file memory: 4693 Mb
Total virtual memory: 2047 Mb
Free virtual memory: 1946 Mb
[Application info]
Language: C++
Compiler: Microsoft Visual C++ compiler, version 1400
App version: 0.0.0.11195
[Exception info]
date: 2013-02-07
time: 14.19.57
type: ACCESS_VIOLATION reading address 0x00000003
address: 0x00a1eb13 "C:\Users\Elvedin\Downloads\XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX4467XXXXX7z8hfsd
:0x0001:0x0061db13
[Call stack]
Callstack not available
[Stack data]
0018ec30 | 13 eb a1 00<10>23 16 03 bc fe 18 00 f0 22 16 03 | .....#.......".. |
0018ec40 | 00 00 00 00 50 0e 17 03 de 0e 17 03 e0 0e 17 03 | ....P........... |
0018ec50 | 88 43 d8 00 44 73 65 00 90 06 17 03 a8 06 17 03 | .C..Dse......... |
0018ec60 | c0 06 17 03 88 43 d8 00 00 f2 18 00 00 00 00 00 | .....C.......... |
0018ec70 | 02 00 00 00 30 0e 17 03 60 0c 17 03 d8 0c 17 03 | ....0...`....... |
0018ec80 | 20 0d 17 03 08 49 d8 00 da 9a 4e 00 00 00 00 00 | ....I....N..... |
0018ec90 | 00 00 00 00 90 f4 16 03 00 00 00 00 a4 fa 16 03 | ................ |
0018eca0 | c8 64 d1 00 00 00 00 00 74 2b ec 00 74 2b ec 00 | .d......t+..t+.. |
0018ecb0 | 76 2b ec 00 88 43 d8 00 00 00 00 00 00 00 00 00 | v+...C.......... |
0018ecc0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ecd0 | e4 ec 18 00 e4 ec 18 00 64 ed 18 00 f0 bd ce 00 | ........d....... |
0018ece0 | e4 ec 18 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ecf0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed10 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed40 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed50 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed60 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed70 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed80 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ed90 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018eda0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018edb0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018edc0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018edd0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ede0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018edf0 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ee00 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ee10 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ee20 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
0018ee30 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
[Instruction data]
00a1ea93 => DasmX86Dll.dll not found.
[Registers]
eip: 00a1eb13
eax: 00000003
ebx: 00ec2b76
ecx: 00e4991c
edx: ffffffff
esi: 00ec2b74
edi: 00d84388
ebp: 00000000
efl: 00010216
esp: 0018ec34
[Modules]
base 0x77330000 size 0x00180000 entry 0x00000000 "ntdll.dll" "C:\Windows\SysWOW64\ntdll.dll"
base 0x759a0000 size 0x00110000 entry 0x759b32b3 "kernel32.dll" "C:\Windows\syswow64\kernel32.dll"
base 0x75f30000 size 0x00047000 entry 0x75f374b1 "KERNELBASE.dll" "C:\Windows\syswow64\KERNELBASE.dll"
base 0x6ee80000 size 0x001c3000 entry 0x6ee81a45 "d3d9.dll" "C:\Windows\system32\d3d9.dll"
base 0x758f0000 size 0x000ac000 entry 0x758fa472 "msvcrt.dll" "C:\Windows\syswow64\msvcrt.dll"
base 0x76090000 size 0x00019000 entry 0x76094975 "sechost.dll" "C:\Windows\SysWOW64\sechost.dll"
base 0x74b00000 size 0x000f0000 entry 0x74b10569 "RPCRT4.dll" "C:\Windows\syswow64\RPCRT4.dll"
base 0x74a10000 size 0x00060000 entry 0x74a2a3b3 "SspiCli.dll" "C:\Windows\syswow64\SspiCli.dll"
base 0x74a00000 size 0x0000c000 entry 0x74a010e1 "CRYPTBASE.dll" "C:\Windows\syswow64\CRYPTBASE.dll"
base 0x75bd0000 size 0x00100000 entry 0x75beb6ed "USER32.dll" "C:\Windows\syswow64\USER32.dll"
base 0x76650000 size 0x00090000 entry 0x76666343 "GDI32.dll" "C:\Windows\syswow64\GDI32.dll"
base 0x758e0000 size 0x0000a000 entry 0x758e36a0 "LPK.dll" "C:\Windows\syswow64\LPK.dll"
base 0x766e0000 size 0x0009d000 entry 0x76713fd7 "USP10.dll" "C:\Windows\syswow64\USP10.dll"
base 0x765b0000 size 0x000a0000 entry 0x765c49e5 "ADVAPI32.dll" "C:\Windows\syswow64\ADVAPI32.dll"
base 0x72ff0000 size 0x00009000 entry 0x72ff1220 "VERSION.dll" "C:\Windows\system32\VERSION.dll"
base 0x6ee70000 size 0x00006000 entry 0x6ee711f0 "d3d8thk.dll" "C:\Windows\system32\d3d8thk.dll"
base 0x73120000 size 0x00013000 entry 0x73121d3f "dwmapi.dll" "C:\Windows\system32\dwmapi.dll"
base 0x01490000 size 0x00267000 entry 0x016aaf6c "d3dx9_31.dll" "C:\Windows\system32\d3dx9_31.dll"
base 0x6f060000 size 0x000e7000 entry 0x6f061771 "DDRAW.dll" "C:\Windows\system32\DDRAW.dll"
base 0x6f050000 size 0x00006000 entry 0x6f051250 "DCIMAN32.dll" "C:\Windows\system32\DCIMAN32.dll"
base 0x75d30000 size 0x0019d000 entry 0x75d317e7 "SETUPAPI.dll" "C:\Windows\syswow64\SETUPAPI.dll"
base 0x760c0000 size 0x00027000 entry 0x760c58b9 "CFGMGR32.dll" "C:\Windows\syswow64\CFGMGR32.dll"
base 0x74a70000 size 0x0008f000 entry 0x74a73fb1 "OLEAUT32.dll" "C:\Windows\syswow64\OLEAUT32.dll"
base 0x76450000 size 0x0015c000 entry 0x7649ba3d "ole32.dll" "C:\Windows\syswow64\ole32.dll"
base 0x75f10000 size 0x00012000 entry 0x75f11441 "DEVOBJ.dll" "C:\Windows\syswow64\DEVOBJ.dll"
base 0x74c00000 size 0x00c4a000 entry 0x74c81621 "SHELL32.dll" "C:\Windows\syswow64\SHELL32.dll"
base 0x763f0000 size 0x00057000 entry 0x76409ba6 "SHLWAPI.dll" "C:\Windows\syswow64\SHLWAPI.dll"
base 0x72640000 size 0x0009b000 entry 0x7264232b "MSVCR80.dll" "C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\MSVCR80.dll"
base 0x76780000 size 0x00060000 entry 0x7679158f "IMM32.dll" "C:\Windows\syswow64\IMM32.dll"
base 0x769a0000 size 0x000cc000 entry 0x769a168b "MSCTF.dll" "C:\Windows\syswow64\MSCTF.dll"
base 0x70bf0000 size 0x000eb000 entry 0x70bf13ce "dbghelp.dll" "C:\Windows\system32\dbghelp.dll"
base 0x77300000 size 0x00005000 entry 0x77301438 "PSAPI.DLL" "C:\Windows\syswow64\PSAPI.DLL"
base 0x73240000 size 0x00011000 entry 0x73241300 "NETAPI32.dll" "C:\Windows\system32\NETAPI32.dll"
base 0x73230000 size 0x00009000 entry 0x732315a6 "netutils.dll" "C:\Windows\system32\netutils.dll"
base 0x73210000 size 0x00019000 entry 0x73211319 "srvcli.dll" "C:\Windows\system32\srvcli.dll"
base 0x73200000 size 0x0000f000 entry 0x732012a1 "wkscli.dll" "C:\Windows\system32\wkscli.dll"
base 0x75ed0000 size 0x00035000 entry 0x75ed145d "WS2_32.dll" "C:\Windows\syswow64\WS2_32.dll"
base 0x74bf0000 size 0x00006000 entry 0x74bf1782 "NSI.dll" "C:\Windows\syswow64\NSI.dll"
base 0x695d0000 size 0x00072000 entry 0x695d1576 "DSOUND.dll" "C:\Windows\system32\DSOUND.dll"
base 0x732e0000 size 0x00032000 entry 0x732e37f1 "WINMM.dll" "C:\Windows\system32\WINMM.dll"
base 0x6f180000 size 0x00025000 entry 0x6f182b71 "POWRPROF.dll" "C:\Windows\system32\POWRPROF.dll"
base 0x00250000 size 0x00016000 entry 0x0025801f "xinput1_3.dll" "C:\Windows\system32\xinput1_3.dll"
base 0x714a0000 size 0x00022000 entry 0x714ab13c "glu32.dll" "C:\Windows\system32\glu32.dll"
base 0x65590000 size 0x000c8000 entry 0x6562b0e4 "OPENGL32.dll" "C:\Windows\system32\OPENGL32.dll"
[Register memory]
ebx 00ec2b70 | <00>00 00 00 00 00 00 00 00 00 | .......... |
00ec2b80 | 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
00ec2b90 | 00 00 00 00 00 00 | ...... |
ecx 00e49910 | <ff>ff ff ff | .... |
00e49920 | 1c 00 00 00 fe ff ff ff 18 32 d0 00 a8 33 d0 00 | .........2...3.. |
00e49930 | 90 33 d0 00 80 33 d0 00 68 33 d0 00 | .3...3..h3.. |
Memory pointer appears to point to invalid memory.
esi 00ec2b70 | <00>00 00 00 00 00 00 00 00 00 00 00 | ............ |
00ec2b80 | 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 | ................ |
00ec2b90 | 00 00 00 00 | .... |
edi 00d84380 | <57>6f 72 6c 64 2f 57 6f | World/Wo |
00d84390 | 72 6c 64 55 74 69 6c 73 00 00 00 00 24 00 45 00 | rldUtils....$.E. |
00d843a0 | 58 00 45 00 00 00 00 00 | X.E..... |
[Extra]
Geändert von ElvedinZ (07.02.2013 um 20:15 Uhr) |
| Themen zu Spionageattacke auf Rechner ? |
| benutzerkonto, c:\windows, code, data, datei, dns, file, final, folge, folgende, hängt, java, langsam, microsoft, msvcr80.dll, not, ntdll.dll, ordner, plötzlich, problem, rechner, sehr langsam, service, shell, spionage, spionage trojaner überwachung bespitzeln, system, system32, trojaner, usp10.dll, visual c++, windows, xcrpt |
Baum-Darstellung