| |
| |||||||
Log-Analyse und Auswertung: google leitet falsch weiterWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
10.02.2009, 17:16
| #1 |
 |  google leitet falsch weiter GMER 1.0.14.14536 - http://www.gmer.net Rootkit scan 2009-02-10 17:08:57 Windows 5.1.2600 Service Pack 3 ---- System - GMER 1.0.14 ---- SSDT spdr.sys ZwCreateKey [0xBA6A80E0] SSDT AC0C36F4 ZwCreateThread SSDT spdr.sys ZwEnumerateKey [0xBA6C6CA2] SSDT spdr.sys ZwEnumerateValueKey [0xBA6C7030] SSDT spdr.sys ZwOpenKey [0xBA6A80C0] SSDT AC0C36E0 ZwOpenProcess SSDT AC0C36E5 ZwOpenThread SSDT spdr.sys ZwQueryKey [0xBA6C7108] SSDT spdr.sys ZwQueryValueKey [0xBA6C6F88] SSDT spdr.sys ZwSetValueKey [0xBA6C719A] SSDT AC0C36EF ZwTerminateProcess SSDT AC0C36EA ZwWriteVirtualMemory INT 0x62 ? 8A35CBF8 INT 0x63 ? 8A35FBF8 INT 0x73 ? 8A35FBF8 INT 0xB4 ? 8A35FBF8 ---- Kernel code sections - GMER 1.0.14 ---- ? spdr.sys Das System kann die angegebene Datei nicht finden. ! .text USBPORT.SYS!DllUnload B8FB68AC 5 Bytes JMP 8A1071D8 .text a4n64eqr.SYS ABC10386 35 Bytes [ 00, 00, 00, 00, 00, 00, 20, ... ] .text a4n64eqr.SYS ABC103AA 24 Bytes [ 00, 00, 00, 00, 00, 00, 00, ... ] .text a4n64eqr.SYS ABC103C4 3 Bytes [ 00, 70, 02 ] .text a4n64eqr.SYS ABC103C9 1 Byte [ 2E ] .text a4n64eqr.SYS ABC103CB 9 Bytes [ 00, 00, 5C, 02, 00, 00, 00, ... ] .text ... ---- Kernel IAT/EAT - GMER 1.0.14 ---- IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [BA6A9040] spdr.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [BA6A913C] spdr.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [BA6A90BE] spdr.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [BA6A97FC] spdr.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [BA6A96D2] spdr.sys IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [BA6B9048] spdr.sys IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!KfAcquireSpinLock] 4B8BDF8B IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!READ_PORT_UCHAR] 8D3F0304 IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!KeGetCurrentIrql] CB033043 IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!KfRaiseIrql] 0673C13B IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!KfLowerIrql] C13B0003 IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!HalGetInterruptVector] 8366FA72 IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!HalTranslateBusAddress] 75000E7B IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!KeStallExecutionProcessor] 0B7D80E3 IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!KfReleaseSpinLock] 307B8D00 IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 00AA840F IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!READ_PORT_USHORT] 83660000 IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 6A000E7A IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[HAL.dll!WRITE_PORT_UCHAR] C6647400 IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[WMILIB.SYS!WmiSystemControl] 4F8B0200 IAT \SystemRoot\System32\Drivers\a4n64eqr.SYS[WMILIB.SYS!WmiCompleteRequest] 968D5140 ---- User IAT/EAT - GMER 1.0.14 ---- IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\Explorer.EXE [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINXP\Explorer.EXE[1820] @ C:\WINXP\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CF07774] C:\WINXP\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation) ---- Devices - GMER 1.0.14 ---- Device \FileSystem\Ntfs \Ntfs 8A3CB1F8 Device \Driver\usbohci \Device\USBPDO-0 8A1061F8 Device \Driver\dmio \Device\DmControl\DmIoDaemon 8A3CD1F8 Device \Driver\dmio \Device\DmControl\DmConfig 8A3CD1F8 Device \Driver\dmio \Device\DmControl\DmPnP 8A3CD1F8 Device \Driver\dmio \Device\DmControl\DmInfo 8A3CD1F8 Device \Driver\usbehci \Device\USBPDO-1 8A0F71F8 Device \Driver\Ftdisk \Device\HarddiskVolume1 8A35D1F8 Device \Driver\Ftdisk \Device\HarddiskVolume2 8A35D1F8 Device \Driver\Cdrom \Device\CdRom0 8A0E21F8 Device \Driver\Cdrom \Device\CdRom1 8A0E21F8 Device \Driver\NetBT \Device\NetBt_Wins_Export 89AE41F8 Device \Driver\NetBT \Device\NetbiosSmb 89AE41F8 Device \Driver\PCI_PNP2444 \Device\0000004f spdr.sys Device \Driver\usbohci \Device\USBFDO-0 8A1061F8 Device \Driver\sptd \Device\2650937444 spdr.sys Device \Driver\NetBT \Device\NetBT_Tcpip_{9AB0D04D-1C37-48BE-9F3F-3DC53A3492DD} 89AE41F8 Device \Driver\usbehci \Device\USBFDO-1 8A0F71F8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 88DE21F8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 88DE21F8 Device \Driver\Ftdisk \Device\FtControl 8A35D1F8 Device \Driver\nvgts \Device\Scsi\nvgts1Port2Path1Target1Lun0 8A3CC1F8 Device \Driver\nvgts \Device\Scsi\nvgts1 8A3CC1F8 Device \Driver\nvgts \Device\Scsi\nvgts2 8A3CC1F8 Device \Driver\nvgts \Device\Scsi\nvgts3 8A3CC1F8 Device \Driver\a4n64eqr \Device\Scsi\a4n64eqr1 89F4C368 Device \Driver\a4n64eqr \Device\Scsi\a4n64eqr1Port5Path0Target0Lun0 89F4C368 Device \FileSystem\Cdfs \Cdfs 88DE1500 ---- Registry - GMER 1.0.14 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x88 0xFF 0x10 0x0F ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x52 0x88 0x7F 0x06 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xF7 0xD8 0x55 0x3F ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programme\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x88 0xFF 0x10 0x0F ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x52 0x88 0x7F 0x06 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xF7 0xD8 0x55 0x3F ... ---- EOF - GMER 1.0.14 ---- |
| Themen zu google leitet falsch weiter |
| atapi.sys, bytes, cdrom, code, controlset002, crypt, datei, explorer.exe, falsch, gmer, google, hal.dll, i8042prt.sys, irql, kernel, leitet, programme, redirector, registry, scan, secur, service, services, shell, shell32.dll, system, system32, tools, usbport.sys, winxp, zwcreatekey, zwopenkey |
Baum-Darstellung