Hallo Trojanerjäger,
ich habe exakt das gleiche Problem wie JayJayS hier hatte:
http://www.trojaner-board.de/70996-s...tml#post458505
Ein netter Mitforist hat mir geraten einen neuen Thread aufzumachen.
Mein Problem besteht seit heute vormittag, wobei Spybot mich nicht gewarnt hat, ich aber Systeminstabilitäten verzeichne. Und es scheinen Dateien beschädigt zu sein, denn ich werde aufgefordert CHKDSK laufen zu lassen, das funktioniert aber auch nicht so richtig. Mein altes Outlook macht auch Mucken. Erstmal habe ich alle meine Daten in Eigene Dateien auf eine andere (USB-)Platte gerettet, diese dann abgetrennt.
Dann stiess ich auf obigen Thread und las ihn und habe bis gezeigten Schritte von Anfang bis Post 14 gemacht und entsprechende GMER.txt und Avenger.txt Dateien aufgehoben, die wohl Zeigen können wo wir stehen.
Jetzt traue mich wegen der Warnungen zu Combofix ohne Anleitung nicht weiter. Also bitte ich um Hilfe!
Wie gehe ich vor?
Vielen Dank für Eure Hilfe!!
Gruss,
Winfried
Zitat:
GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-08-22 17:02:17
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.14 ----
Code 862DFC10 ZwEnumerateKey
Code 862DFDF8 ZwFlushInstructionCache
Code 862DAAF6 IofCallDriver
Code 862DA1DE IofCompleteRequest
---- Kernel code sections - GMER 1.0.14 ----
.text ntkrnlpa.exe!IofCallDriver 804EF1A6 5 Bytes JMP 862DAAFB
.text ntkrnlpa.exe!IofCompleteRequest 804EF236 5 Bytes JMP 862DA1E3
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 805B6812 5 Bytes JMP 862DFDFC
PAGE ntkrnlpa.exe!ZwEnumerateKey 80623FF0 5 Bytes JMP 862DFC14
---- User code sections - GMER 1.0.14 ----
.text C:\Programme\Internet Explorer\iexplore.exe[3928] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 4115F4B9 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[3928] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 412D1F8F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[3928] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 412D1F10 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[3928] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 412D1F54 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[3928] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 412D1E9C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[3928] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 412D1ED6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[3928] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 412D1FCA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[3928] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 411817EA C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[3928] ole32.dll!OleLoadFromStream 774F9C85 5 Bytes JMP 412D218C C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Programme\Internet Explorer\iexplore.exe[3928] WS2_32.dll!closesocket 71A13E2B 5 Bytes JMP 100129A0 \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll
.text C:\Programme\Internet Explorer\iexplore.exe[3928] WS2_32.dll!connect 71A14A07 5 Bytes JMP 100127E0 \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll
.text C:\Programme\Internet Explorer\iexplore.exe[3928] WS2_32.dll!send 71A14C27 5 Bytes JMP 100127C0 \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll
.text C:\Programme\Internet Explorer\iexplore.exe[3928] WS2_32.dll!recv 71A1676F 5 Bytes JMP 100127A0 \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll
---- Devices - GMER 1.0.14 ----
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
---- Processes - GMER 1.0.14 ----
Library \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [324] 0x10000000
Library \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1044] 0x02D40000
Library \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1136] 0x10000000
Library \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [1240] 0x10000000
Library \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1344] 0x10000000
Library \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1452] 0x10000000
Library \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [2268] 0x10000000
Library \\?\globalroot\systemroot\system32\UACsvulrtvogr.dll (*** hidden *** ) @ C:\Programme\Internet Explorer\iexplore.exe [3928] 0x10000000
---- EOF - GMER 1.0.14 ----
|
Zitat:
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Driver "UACd.sys" deleted successfully.
Error: registry key "HKLM\SYSTEM\ControlSet003\Services\UACd.sys" not found!
Deletion of registry key "HKLM\SYSTEM\ControlSet003\Services\UACd.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\drivers\UACgmhjovph.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\UACgmhjovph.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACneiknnkb.dll" not found!
Deletion of file "C:\WINDOWS\system32\UACneiknnkb.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACydsdcmrm.dat" not found!
Deletion of file "C:\WINDOWS\system32\UACydsdcmrm.dat" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACegeifhxy.dll" not found!
Deletion of file "C:\WINDOWS\system32\UACegeifhxy.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACypgrfjml.dll" not found!
Deletion of file "C:\WINDOWS\system32\UACypgrfjml.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACvhsbyagl.dll" not found!
Deletion of file "C:\WINDOWS\system32\UACvhsbyagl.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UAChlmegkqc.db" not found!
Deletion of file "C:\WINDOWS\system32\UAChlmegkqc.db" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACdlstridw.dll" not found!
Deletion of file "C:\WINDOWS\system32\UACdlstridw.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACmehptlax.dll" not found!
Deletion of file "C:\WINDOWS\system32\UACmehptlax.dll" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACdphargvm.log" not found!
Deletion of file "C:\WINDOWS\system32\UACdphargvm.log" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACtxybmgve.log" not found!
Deletion of file "C:\WINDOWS\system32\UACtxybmgve.log" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Error: file "C:\WINDOWS\system32\UACbnbhjqoi.log" not found!
Deletion of file "C:\WINDOWS\system32\UACbnbhjqoi.log" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist
Completed script processing.
*******************
Finished! Terminate.
|
Zitat:
GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2009-08-22 17:14:43
Windows 5.1.2600 Service Pack 3
---- System - GMER 1.0.14 ----
Code 86370608 ZwEnumerateKey
Code 862CC190 ZwFlushInstructionCache
Code 863EDE56 IofCallDriver
Code 863EC4C6 IofCompleteRequest
---- Kernel code sections - GMER 1.0.14 ----
.text ntkrnlpa.exe!IofCallDriver 804EF1A6 5 Bytes JMP 863EDE5B
.text ntkrnlpa.exe!IofCompleteRequest 804EF236 5 Bytes JMP 863EC4CB
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 805B6812 5 Bytes JMP 862CC194
PAGE ntkrnlpa.exe!ZwEnumerateKey 80623FF0 5 Bytes JMP 8637060C
? system32\drivers\njdxtta.sys Das System kann den angegebenen Pfad nicht finden. !
---- Devices - GMER 1.0.14 ----
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
---- Processes - GMER 1.0.14 ----
Library \\?\globalroot\systemroot\system32\UACwecfgwyvvw.dll (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1048] 0x02D80000
---- EOF - GMER 1.0.14 ----
|
22.08.2009, 17:43
Baum-Darstellung