Verdächtige E-Mail mit Zip-Datei geöffnet

GMER 2.1.19155 - hxxp://www.gmer.net
Rootkit scan 2013-03-07 15:04:56
Windows 6.2.9200  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-1 WDC_WD1600BEVT-22ZCT0 rev.11.01A11 149,05GB
Running: gmer_2.1.19155.exe; Driver: C:\Users\NETTIU~1\AppData\Local\Temp\fgliipod.sys


---- Kernel code sections - GMER 2.1 ----

.text           ntoskrnl.exe!ZwReplacePartitionUnit + 2AC1                                                                                                81D9BA39 1 Byte  [06]
.text           ntoskrnl.exe!KiDispatchInterrupt + 66A                                                                                                    81DA043A 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- Devices - GMER 2.1 ----

Device          \Driver\BTHUSB \Device\00000044                                                                                                           bthport.sys
Device          \Driver\BTHUSB \Device\00000046                                                                                                           bthport.sys

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                  fltmgr.sys
AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                  fltmgr.sys

---- Threads - GMER 2.1 ----

Thread          System [4:208]                                                                                                                            82560DE6
---- Processes - GMER 2.1 ----

Library         C:\Users\Netti und Sascha\Downloads\gmer_2.1.19155.exe (*** hidden *** ) @ C:\Users\Netti und Sascha\Downloads\gmer_2.1.19155.exe [1292]  0x00400000                                                                                                                                           

---- Registry - GMER 2.1 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed                                                         1177568582
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002243ed37ef                                                               

---- EOF - GMER 2.1 ----
         

07.03.2013 16:33:49
mbar-log-2013-03-07 (16-33-49).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled: 
Objects scanned: 25131
Time elapsed: 12 minute(s), 42 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Sector_0_312570297_user.mbam (Forged physical sector) -> Delete on reboot.

(end)