| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Tool.Obfuscator und AlureonWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
07.09.2009, 20:09
| #2 |
| |  Tool.Obfuscator und Alureon also ich habs jetzt einfach mal ausprobiert und hab GMER nochmal neu geladen und laufen lassen, mit folgendem ergebnis:
__________________GMER 1.0.15.15077 [7ubenv7y.exe] - http://www.gmer.net Rootkit scan 2009-09-07 21:04:17 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.15 ---- SSDT BAF1A2D6 ZwCreateKey SSDT BAF1A2CC ZwCreateThread SSDT BAF1A2DB ZwDeleteKey SSDT BAF1A2E5 ZwDeleteValueKey SSDT BAF1A2EA ZwLoadKey SSDT BAF1A2B8 ZwOpenProcess SSDT BAF1A2BD ZwOpenThread SSDT BAF1A2F4 ZwReplaceKey SSDT BAF1A2EF ZwRestoreKey SSDT BAF1A2E0 ZwSetValueKey SSDT BAF1A2C7 ZwTerminateProcess ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwCallbackReturn + 2D1C 80503BF8 4 Bytes JMP 4CBAF1A2 ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!InternetCloseHandle 441EDA89 5 Bytes JMP 1350A748 .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!HttpOpenRequestA 441F4341 5 Bytes JMP 13508FA4 .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!InternetConnectA 441F499A 5 Bytes JMP 13508E4C .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!InternetReadFile 441FABBC 5 Bytes JMP 1350A548 .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!InternetQueryDataAvailable 441FADFD 5 Bytes JMP 1350A368 .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!InternetOpenA 441FC869 5 Bytes JMP 13508DFC .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!HttpSendRequestA 441FCD40 5 Bytes JMP 13509968 .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!HttpSendRequestW 4421100D 5 Bytes JMP 13509D6C .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!InternetReadFileExW 44213296 5 Bytes JMP 1350A6F8 .text C:\WINDOWS\Explorer.EXE[2516] WININET.dll!InternetReadFileExA 442132CE 5 Bytes JMP 1350A6A8 ---- Disk sectors - GMER 1.0.15 ---- Disk \Device\Harddisk0\DR0 sector 01: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 02: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 03: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 04: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 05: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 06: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 07: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 08: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 09: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 10: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 11: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 12: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 13: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 14: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 15: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 16: copy of MBR Disk \Device\Harddisk0\DR0 sector 17: copy of MBR Disk \Device\Harddisk0\DR0 sector 18: copy of MBR Disk \Device\Harddisk0\DR0 sector 19: copy of MBR Disk \Device\Harddisk0\DR0 sector 20: copy of MBR Disk \Device\Harddisk0\DR0 sector 21: copy of MBR Disk \Device\Harddisk0\DR0 sector 22: copy of MBR Disk \Device\Harddisk0\DR0 sector 23: copy of MBR Disk \Device\Harddisk0\DR0 sector 24: copy of MBR Disk \Device\Harddisk0\DR0 sector 25: copy of MBR Disk \Device\Harddisk0\DR0 sector 26: copy of MBR Disk \Device\Harddisk0\DR0 sector 27: copy of MBR Disk \Device\Harddisk0\DR0 sector 28: copy of MBR Disk \Device\Harddisk0\DR0 sector 29: copy of MBR Disk \Device\Harddisk0\DR0 sector 30: copy of MBR Disk \Device\Harddisk0\DR0 sector 31: copy of MBR Disk \Device\Harddisk0\DR0 sector 32: copy of MBR Disk \Device\Harddisk0\DR0 sector 33: copy of MBR Disk \Device\Harddisk0\DR0 sector 34: copy of MBR Disk \Device\Harddisk0\DR0 sector 35: copy of MBR Disk \Device\Harddisk0\DR0 sector 36: copy of MBR Disk \Device\Harddisk0\DR0 sector 37: copy of MBR Disk \Device\Harddisk0\DR0 sector 38: copy of MBR Disk \Device\Harddisk0\DR0 sector 39: copy of MBR Disk \Device\Harddisk0\DR0 sector 40: copy of MBR Disk \Device\Harddisk0\DR0 sector 41: copy of MBR Disk \Device\Harddisk0\DR0 sector 42: copy of MBR Disk \Device\Harddisk0\DR0 sector 43: copy of MBR Disk \Device\Harddisk0\DR0 sector 44: copy of MBR Disk \Device\Harddisk0\DR0 sector 45: copy of MBR Disk \Device\Harddisk0\DR0 sector 46: copy of MBR Disk \Device\Harddisk0\DR0 sector 47: copy of MBR Disk \Device\Harddisk0\DR0 sector 48: copy of MBR Disk \Device\Harddisk0\DR0 sector 49: copy of MBR Disk \Device\Harddisk0\DR0 sector 50: copy of MBR Disk \Device\Harddisk0\DR0 sector 51: copy of MBR Disk \Device\Harddisk0\DR0 sector 52: copy of MBR Disk \Device\Harddisk0\DR0 sector 53: copy of MBR Disk \Device\Harddisk0\DR0 sector 54: copy of MBR Disk \Device\Harddisk0\DR0 sector 55: copy of MBR Disk \Device\Harddisk0\DR0 sector 56: copy of MBR Disk \Device\Harddisk0\DR0 sector 57: copy of MBR Disk \Device\Harddisk0\DR0 sector 58: copy of MBR Disk \Device\Harddisk0\DR0 sector 59: copy of MBR Disk \Device\Harddisk0\DR0 sector 60: copy of MBR Disk \Device\Harddisk0\DR0 sector 61: copy of MBR Disk \Device\Harddisk0\DR0 sector 62: copy of MBR Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR ---- EOF - GMER 1.0.15 ---- also keine warnung mehr vor irgendwelchen schadsachen... kann ich mir da jetzt halbwegs sicher sein oder sieht da ein fachmann mehr? |
| Themen zu Tool.Obfuscator und Alureon |
| bot, dateien, ebanking, ebay, festgestellt, frage, gmer, hängen, hängt, icons, karte, klicke, live, namen, netzwerkstecker, nicht mehr, problem, programm, prozess, rechner, registry, rootkit, scan, starten, suche, suse, versteckte |
Baum-Darstellung