| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Rootkit TDSS entfernenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
26.09.2009, 22:13
| #5 |
 |  Rootkit TDSS entfernen Hier das GMEG logfile: Code:
ATTFilter GMER 1.0.15.15087 - http://www.gmer.net
Rootkit scan 2009-09-26 23:09:37
Windows 5.1.2600 Service Pack 3
Running: 2v08heo8.exe; Driver: C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\kgtdqpow.sys
---- System - GMER 1.0.15 ----
SSDT 8AA3A4A0 ZwConnectPort
SSDT sptd.sys ZwCreateKey [0xB7EBE0D0]
SSDT \??\C:\Programme\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwDeleteValueKey [0xA9966350]
SSDT sptd.sys ZwEnumerateKey [0xB7EC3FB2]
SSDT sptd.sys ZwEnumerateValueKey [0xB7EC4340]
SSDT sptd.sys ZwOpenKey [0xB7EBE0B0]
SSDT sptd.sys ZwQueryKey [0xB7EC4418]
SSDT 8ABF3E88 ZwQueryValueKey
SSDT 8AA430E8 ZwResumeThread
SSDT \??\C:\Programme\Symantec\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation) ZwSetValueKey [0xA9966580]
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 2EFC 80504798 4 Bytes CALL E4DAEBCD
? C:\WINDOWS\system32\drivers\sptd.sys Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
.text USBPORT.SYS!DllUnload B4E8D8AC 5 Bytes JMP 8AD40770
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B7EBEAD4] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B7EBEC1A] sptd.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B7EBEB9C] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B7EBF748] sptd.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B7EBF61E] sptd.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B7ED429A] sptd.sys
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8AE081E8
AttachedDevice \FileSystem\Ntfs \Ntfs SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
Device \FileSystem\Fastfat \FatCdrom 8A8F5440
AttachedDevice \Driver\Tcpip \Device\Ip SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
Device \Driver\usbohci \Device\USBPDO-0 8AC7F5D8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 8AE0A1E8
Device \Driver\dmio \Device\DmControl\DmConfig 8AE0A1E8
Device \Driver\dmio \Device\DmControl\DmPnP 8AE0A1E8
Device \Driver\dmio \Device\DmControl\DmInfo 8AE0A1E8
Device \Driver\usbehci \Device\USBPDO-1 8ACB11E8
Device \Driver\NetBT \Device\NetBT_Tcpip_{189E787C-DBBF-41D8-8023-F386B04AC9DA} 8AA45790
AttachedDevice \Driver\Tcpip \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
Device \Driver\Ftdisk \Device\HarddiskVolume1 8AE7D1E8
Device \Driver\Cdrom \Device\CdRom0 8ACBE790
Device \Driver\Ftdisk \Device\HarddiskVolume2 8AE7D1E8
Device \Driver\Ftdisk \Device\HarddiskVolume3 8AE7D1E8
Device \Driver\Ftdisk \Device\HarddiskVolume4 8AE7D1E8
Device \Driver\NetBT \Device\NetBt_Wins_Export 8AA45790
Device \Driver\NetBT \Device\NetbiosSmb 8AA45790
AttachedDevice \Driver\Tcpip \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\Tcpip \Device\RawIp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
Device \Driver\usbohci \Device\USBFDO-0 8AC7F5D8
Device \Driver\usbehci \Device\USBFDO-1 8ACB11E8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8A8B9790
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8A8B9790
Device \Driver\Ftdisk \Device\FtControl 8AE7D1E8
Device \Driver\nvgts \Device\Scsi\nvgts1Port2Path0Target0Lun0 8AE091E8
Device \Driver\nvgts \Device\Scsi\nvgts1 8AE091E8
Device \Driver\nvgts \Device\Scsi\nvgts2 8AE091E8
Device \FileSystem\Fastfat \Fat 8A8F5440
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)
Device \FileSystem\Cdfs \Cdfs 8AC00500
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x32 0xDC 0xFC 0x09 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\DAEMON Tools Pro\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x47 0xA9 0xB0 0x59 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x8D 0x6F 0x6D 0x7F ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x89 0x24 0x28 0xF3 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12 0xBF 0xE8 0xFB 0x28 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x32 0xDC 0xFC 0x09 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5EAD28C50BE647342945EB3391ABE428\Usage@Phone 993657008
---- EOF - GMER 1.0.15 ----
|
| Themen zu Rootkit TDSS entfernen |
| .dll, abgesicherten modus, adobe, atapi.sys, c:\windows\temp, cdrom, controlset002, dateien, e-mails, entfernen, hal.dll, i8042prt.sys, immer wieder, logfile, löschen, microsoft, ordner, programme, prozess, registry, rootkit, schadcode, sophos, spam-mails, sptd.sys, symantec, system, system32, tdss, temp, udp, usbport.sys, versteckte dateien, windows, windows\temp, write, zufällig, zwcreatekey, zwopenkey |
Baum-Darstellung