Keine Updates von Antiviren Programmen und Windows / Problem mit Arbeitsplatz

FuX_07 · 22.01.2009, 18:55

Hallo,
ich verwende Windows XP und habe seit heute diverse Probleme mit meinem PC:
- Antiviren Programme (Avira Antivir, Spybot Search & Destroy) können nicht zu ihrem Updateserver connecten
- Auch die Windows-Updateseite ist nicht erreichbar, wenn ich die entsprechende Addresse eingebe oder auch über den Link im Startmenü darauf zugreifen möchte, lande ich jedesmal auf google.de
- Im Arbeitsplatz kann ich die Laufwerke nicht durch einen Doppelklick öffnen. Im Kontextmenü ist der Menüpunkt "Autoplay" aktiv und sobald ich darauf Doppelklicke wird eine Aktion ausgeführt (Windowssanduhr) und Antivir meldet mir einen Virus "TR/Vundo.Gen" in "C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Temp.tmp1.tmp"

Anbei mein HijackThis Log:

Code:

ATTFilter

 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:15:57, on 22.01.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\mst software\mst Defrag\mstDfrgS.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programme\SigmaTel\C-Major Audio\WDM\stsystra.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Java\jre6\bin\jusched.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Notebook Hardware Control\nhc.exe
C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\DAEMON Tools Lite\daemon.exe
C:\Programme\Launchy\Launchy.exe
C:\Programme\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE
C:\Programme\Mozilla Firefox\firefox.exe
E:\Downloads\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://windowsupdate.microsoft.com/
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NotebookHardwareControl] "C:\Programme\Notebook Hardware Control\nhc.exe" -quiet
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ALDI Foto Service] "C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\FotoSuite.exe" /autorun
O4 - HKLM\..\Run: [ALDI_SUED_FotoSuite_Download] "C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\FotoSuite.exe" /autorun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Programme\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Launchy.lnk = C:\Programme\Launchy\Launchy.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programme\PPLive\PPLive.exe
O9 - Extra 'Tools' menuitem: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - C:\Programme\PPLive\PPLive.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - h**p://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1214223067953
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - h**p://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1219827070000
O17 - HKLM\System\CCS\Services\Tcpip\..\{553B11AA-E708-48EE-826A-29984AF74935}: NameServer = 85.255.114.18,85.255.112.148
O17 - HKLM\System\CCS\Services\Tcpip\..\{9753DFC0-E029-4DF0-A3E3-3F3707BC4ABE}: NameServer = 85.255.114.18,85.255.112.148
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.114.18,85.255.112.148
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.18,85.255.112.148
O20 - AppInit_DLLs:  
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: mst Defrag Service (mstDfrgS) - mst software GmbH, Germany - C:\Programme\mst software\mst Defrag\mstDfrgS.exe
O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programme\WinPcap\rpcapd.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 8066 bytes

FuX_07 · 22.01.2009, 19:03

Aufgrund eines anderen Threads hier im Forum habe ich mir nun auch noch GMER geladen und poste hier dessen Log:

Code:

ATTFilter

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-01-22 19:02:24
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwConnectPort [0xB747F040]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwCreateFile [0xB747B930]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwCreateKey [0xB7486A80]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwCreatePort [0xB747F510]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwCreateProcess [0xB7485870]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwCreateProcessEx [0xB7485AA0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwCreateSection [0xB7488FD0]
SSDT            BAF3F6D4                                                                                               ZwCreateThread
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwCreateWaitablePort [0xB747F600]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwDeleteFile [0xB747BF20]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwDeleteKey [0xB74876E0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwDeleteValueKey [0xB7487440]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwDuplicateObject [0xB7485580]
SSDT            spyo.sys                                                                                               ZwEnumerateKey [0xBA6C6CA2]
SSDT            spyo.sys                                                                                               ZwEnumerateValueKey [0xBA6C7030]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwLoadKey [0xB74878B0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwOpenFile [0xB747BD70]
SSDT            spyo.sys                                                                                               ZwOpenKey [0xBA6A80C0]
SSDT            BAF3F6C0                                                                                               ZwOpenProcess
SSDT            BAF3F6C5                                                                                               ZwOpenThread
SSDT            spyo.sys                                                                                               ZwQueryKey [0xBA6C7108]
SSDT            spyo.sys                                                                                               ZwQueryValueKey [0xBA6C6F88]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwRenameKey [0xB7488250]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwReplaceKey [0xB7487CB0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwRequestWaitReplyPort [0xB747EC00]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwRestoreKey [0xB7488080]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwSecureConnectPort [0xB747F220]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwSetInformationFile [0xB747C120]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                            ZwSetValueKey [0xB7487140]
SSDT            BAF3F6CF                                                                                               ZwTerminateProcess
SSDT            BAF3F6CA                                                                                               ZwWriteVirtualMemory

INT 0x62        ?                                                                                                      89DE2BF8
INT 0x74        ?                                                                                                      89E52BF8
INT 0x82        ?                                                                                                      89DE2BF8
INT 0x84        ?                                                                                                      89E52BF8
INT 0xA4        ?                                                                                                      89E52BF8

---- Kernel code sections - GMER 1.0.14 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2C7C                                                                   80504508 12 Bytes  [ 10, F5, 47, B7, 70, 58, 48, ... ]
?               spyo.sys                                                                                               Das System kann die angegebene Datei nicht finden. !
?               srescan.sys                                                                                            Das System kann die angegebene Datei nicht finden. !
.text           USBPORT.SYS!DllUnload                                                                                  B995C8AC 5 Bytes  JMP 89E521D8 
.text           ahkm5pa6.SYS                                                                                           B98A7386 35 Bytes  [ 00, 00, 00, 00, 00, 00, 20, ... ]
.text           ahkm5pa6.SYS                                                                                           B98A73AA 24 Bytes  [ 00, 00, 00, 00, 00, 00, 00, ... ]
.text           ahkm5pa6.SYS                                                                                           B98A73C4 3 Bytes  [ 00, 70, 02 ]
.text           ahkm5pa6.SYS                                                                                           B98A73C9 1 Byte  [ 2E ]
.text           ahkm5pa6.SYS                                                                                           B98A73CB 9 Bytes  [ 00, 00, 5A, 02, 00, 00, 00, ... ]
.text           ...                                                                                                    

---- User code sections - GMER 1.0.14 ----

.text           C:\WINDOWS\system32\SearchIndexer.exe[1788] kernel32.dll!WriteFile                                     7C810E17 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- Kernel IAT/EAT - GMER 1.0.14 ----

IAT             atapi.sys[HAL.dll!READ_PORT_UCHAR]                                                                     [BA6A9040] spyo.sys
IAT             atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT]                                                             [BA6A913C] spyo.sys
IAT             atapi.sys[HAL.dll!READ_PORT_USHORT]                                                                    [BA6A90BE] spyo.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT]                                                            [BA6A97FC] spyo.sys
IAT             atapi.sys[HAL.dll!WRITE_PORT_UCHAR]                                                                    [BA6A96D2] spyo.sys
IAT             \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR]                                     [BA6B9048] spyo.sys
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!KfAcquireSpinLock]                                   C0840CEC
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!READ_PORT_UCHAR]                                     053C0D74
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!KeGetCurrentIrql]                                    57B80974
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!KfRaiseIrql]                                         8B000000
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!KfLowerIrql]                                         56C35DE5
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!HalGetInterruptVector]                               8D08758B
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!HalTranslateBusAddress]                              8D51FC4D
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!KeStallExecutionProcessor]                           8D52FD55
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!KfReleaseSpinLock]                                   8D51FE4D
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!READ_PORT_BUFFER_USHORT]                             8D52FF55
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!READ_PORT_USHORT]                                    8D51F84D
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT]                            5052F455
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[HAL.dll!WRITE_PORT_UCHAR]                                    EACAE856
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[WMILIB.SYS!WmiSystemControl]                                 0FC08520
IAT             \SystemRoot\System32\Drivers\ahkm5pa6.SYS[WMILIB.SYS!WmiCompleteRequest]                               0001B185
IAT             \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol]                               [B7483CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter]                                    [B74841C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter]                                   [B7484320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol]                             [B7483E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol]                               [B7483E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol]                                 [B7483CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter]                                      [B74841C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter]                                     [B7484320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol]                                [B7483CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol]                              [B7483E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter]                                    [B7484320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter]                                     [B74841C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter]                                      [B7484320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter]                                       [B74841C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol]                                  [B7483CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol]                               [B7483E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol]                                 [B7483CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter]                                      [B74841C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter]                                     [B7484320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisCloseAdapter]                                    [B7484320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisOpenAdapter]                                     [B74841C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisDeregisterProtocol]                              [B7483E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisRegisterProtocol]                                [B7483CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol]                                [B7483CA0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol]                              [B7483E10] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter]                                    [B7484320] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter]                                     [B74841C0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

---- Devices - GMER 1.0.14 ----

siehe nächster post...

FuX_07 · 22.01.2009, 19:04

Fortsetzung...

Code:

ATTFilter

---- Devices - GMER 1.0.14 ----

Device          \FileSystem\Ntfs \Ntfs                                                                                 89E511F8
Device          \Driver\Tcpip \Device\Ip                                                                               vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

Device          \Driver\usbuhci \Device\USBPDO-0                                                                       89C0A1F8
Device          \Driver\dmio \Device\DmControl\DmIoDaemon                                                              89E531F8
Device          \Driver\dmio \Device\DmControl\DmConfig                                                                89E531F8
Device          \Driver\dmio \Device\DmControl\DmPnP                                                                   89E531F8
Device          \Driver\dmio \Device\DmControl\DmInfo                                                                  89E531F8
Device          \Driver\usbuhci \Device\USBPDO-1                                                                       89C0A1F8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{553B11AA-E708-48EE-826A-29984AF74935}                               89A76500
Device          \Driver\usbuhci \Device\USBPDO-2                                                                       89C0A1F8
Device          \Driver\PCI_PNP8954 \Device\00000053                                                                   spyo.sys
Device          \Driver\usbuhci \Device\USBPDO-3                                                                       89C0A1F8
Device          \Driver\NetBT \Device\NetBT_Tcpip_{9753DFC0-E029-4DF0-A3E3-3F3707BC4ABE}                               89A76500
Device          \Driver\usbehci \Device\USBPDO-4                                                                       89BF31F8
Device          \Driver\Tcpip \Device\Tcp                                                                              vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device          \Driver\Ftdisk \Device\HarddiskVolume1                                                                 89DE31F8
Device          \Driver\Ftdisk \Device\HarddiskVolume2                                                                 89DE31F8
Device          \Driver\Cdrom \Device\CdRom0                                                                           89BCE500
Device          \Driver\Ftdisk \Device\HarddiskVolume3                                                                 89DE31F8
Device          \Driver\Cdrom \Device\CdRom1                                                                           89BCE500
Device          \Driver\NetBT \Device\NetBt_Wins_Export                                                                89A76500
Device          \Driver\NetBT \Device\NetbiosSmb                                                                       89A76500
Device          \Driver\Tcpip \Device\Udp                                                                              vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device          \Driver\Tcpip \Device\RawIp                                                                            vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device          \Driver\usbuhci \Device\USBFDO-0                                                                       89C0A1F8
Device          \Driver\usbuhci \Device\USBFDO-1                                                                       89C0A1F8
Device          \FileSystem\MRxSmb \Device\LanmanDatagramReceiver                                                      89992500
Device          \Driver\Tcpip \Device\IPMULTICAST                                                                      vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
Device          \Driver\usbuhci \Device\USBFDO-2                                                                       89C0A1F8
Device          \FileSystem\MRxSmb \Device\LanmanRedirector                                                            89992500
Device          \Driver\usbuhci \Device\USBFDO-3                                                                       89C0A1F8
Device          \Driver\usbehci \Device\USBFDO-4                                                                       89BF31F8
Device          \Driver\Ftdisk \Device\FtControl                                                                       89DE31F8
Device          \Driver\sptd \Device\445553954                                                                         spyo.sys
Device          \Driver\ahkm5pa6 \Device\Scsi\ahkm5pa61                                                                89AED1F8
Device          \Driver\ahkm5pa6 \Device\Scsi\ahkm5pa61Port2Path0Target0Lun0                                           89AED1F8
Device          \FileSystem\Cdfs \Cdfs                                                                                 8997A500
---- Processes - GMER 1.0.14 ----

Library         C:\WINDOWS\system32\dll.dll (*** hidden *** ) @ C:\WINDOWS\system32\spoolsv.exe [3012]                 0x10000000                                                                                        

---- Services - GMER 1.0.14 ----

Service         system32\drivers\gaopdxrptoujhq.sys (*** hidden *** )                                                  [SYSTEM] gaopdxserv.sys                                                                            <-- ROOTKIT !!!

---- Registry - GMER 1.0.14 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys@start                                            1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys@type                                             1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys@imagepath                                        \systemroot\system32\drivers\gaopdxrptoujhq.sys
Reg             HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys@group                                            file system
Reg             HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys\modules                                          
Reg             HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys\modules@gaopdxserv                               \\?\globalroot\systemroot\system32\drivers\gaopdxrptoujhq.sys
Reg             HKLM\SYSTEM\CurrentControlSet\Services\gaopdxserv.sys\modules@gaopdxl                                  \\?\globalroot\systemroot\system32\gaopdxawunlmcu.dll
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1                                                     771343423
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2                                                     285507792
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0                                                     1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                       
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                    C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                    0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                 0xB4 0x4D 0x19 0x01 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001              
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0           0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh        0x6A 0x61 0x29 0xBF ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40        
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh  0x46 0x6C 0x74 0xE1 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys@start                                                1
Reg             HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys@type                                                 1
Reg             HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys@imagepath                                            \systemroot\system32\drivers\gaopdxrptoujhq.sys
Reg             HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys@group                                                file system
Reg             HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys\modules                                              
Reg             HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys\modules@gaopdxserv                                   \\?\globalroot\systemroot\system32\drivers\gaopdxrptoujhq.sys
Reg             HKLM\SYSTEM\ControlSet003\Services\gaopdxserv.sys\modules@gaopdxl                                      \\?\globalroot\systemroot\system32\gaopdxawunlmcu.dll
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                           
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                        C:\Programme\DAEMON Tools Lite\
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                        0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                     0xB4 0x4D 0x19 0x01 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                  
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0               0x20 0x01 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh            0x6A 0x61 0x29 0xBF ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40            
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh      0x46 0x6C 0x74 0xE1 ...

---- EOF - GMER 1.0.14 ----

Keine Updates von Antiviren Programmen und Windows / Problem mit Arbeitsplatz

Log-Analyse und Auswertung: Keine Updates von Antiviren Programmen und Windows / Problem mit Arbeitsplatz