| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Rootkit.Pakes-AA nicht vom GMER gefundenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
14.02.2010, 18:20
| #1 |
| |  Rootkit.Pakes-AA nicht vom GMER gefunden Hallo, ich habe seit ca. 3 Tagen ein Problem mit einem Rootkit. AVG gibt mir regelmäßig die Meldung, dass die Datei C:/windows/system32/drivers/ndis.sys mit dem Trojaner Rootkit-Pakes-AA infiziert ist. Ich kann die Datei aber nicht löschen oder heilen. Ich habe AVG und Dr. Web durchlaufen lassen, die haben zerst einiges gefunden und repariert, aber die letzten zwei Male, hat AVG nichts mehr angezeigt (abgesehen von der Meldung). Ich habe GMER runter geladen und zweimal durchlaufen lassen. Aber das findet wohl nichts. Zumindest ist unter Services nach dem Durchlauf nichts in rot geschrieben. Auffälligkeiten zeigt der Computer nur eine: Ständig kommt der Ton, der normalerweise gemacht wird, wenn ich etwas mit Doppelklick anklicke, aber es wird nichts aktiviert. Hier das Ergebnis des 2. Durchlaufs von GMER: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-02-14 18:13:16 Windows 5.1.2600 Service Pack 3 Running: 64myxyk4.exe; Driver: C:\DOKUME~1\JULIAB~1\LOKALE~1\Temp\kfaoiaog.sys ---- System - GMER 1.0.15 ---- Code 8256D580 pIofCallDriver ---- Kernel code sections - GMER 1.0.15 ---- .reloc C:\WINDOWS\system32\drivers\NDIS.sys section is executable [0x8248A280, 0x32B2A, 0xE0000060] init C:\WINDOWS\system32\drivers\tiumflt.sys entry point in "init" section [0xF8A85E00] init C:\WINDOWS\system32\drivers\tiumfwl.sys entry point in "init" section [0xF89BFF00] .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF7F11340, 0x106FDF, 0xF8000020] .text C:\WINDOWS\System32\nv4_disp.dll section is writeable [0xBF9D6300, 0x238E10, 0xF8000020] ---- User code sections - GMER 1.0.15 ---- ? C:\WINDOWS\System32\svchost.exe[264] image checksum mismatch; number of sections mismatch; time/date stamp mismatch; unknown module: gdiplus.dllunknown module: OLEAUT32.dllunknown module: urlmon.dll .text C:\WINDOWS\System32\svchost.exe[264] USER32.dll!SetForegroundWindow 7E3742ED 8 Bytes [B8, 01, 00, 00, 00, C2, 04, ...] {MOV EAX, 0x1; RET 0x4} ? C:\WINDOWS\System32\svchost.exe[272] image checksum mismatch; number of sections mismatch; time/date stamp mismatch; unknown module: gdiplus.dllunknown module: OLEAUT32.dllunknown module: urlmon.dll .text C:\WINDOWS\System32\svchost.exe[272] USER32.dll!SetForegroundWindow 7E3742ED 8 Bytes [B8, 01, 00, 00, 00, C2, 04, ...] {MOV EAX, 0x1; RET 0x4} ? C:\WINDOWS\System32\svchost.exe[1472] image checksum mismatch; number of sections mismatch; time/date stamp mismatch; ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 0008C280 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 83EC8B55 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 75001C7D IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] 0C7D831E IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 6A1E7501 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 03E86800 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] 016A0000 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] FF0471FF IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 43A2B015 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 18458B00 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 33002083 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 18C25DC0 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] 0C7D8100 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] 7BE85106 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 8B000110 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 20831845 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] 40C03300 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] 006ADBEB IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] 436B77B8 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 54DCE800 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] 8B00FC65 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] C0852446 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] 088B0A74 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 0851FF50 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] 00246683 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] FFFC4D83 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 8514768B IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] 560674F6 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 0207C0E8 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] 5547E800 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] 04C20002 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] F18B5600 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] FFB4E856 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 44F6FFFF IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 74010824 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] [7DE85607] C:\WINDOWS\system32\mshtml.dll (Microsoft (R) HTML Viewer/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 5900020B IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] C25EC68B IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 408B0004 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] 74C08514 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] 8EE85006 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] C3000207 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 0824448B IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] 33002083 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 0018C280 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 0024C280 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 1024448B IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] B8002083 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] 80004001 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 8B0010C2 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 83082444 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] 02B80020 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] C2800040 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] C0330008 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] 0008C240 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] C240C033 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 448B0014 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 40C70824 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 00020004 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] C2C03300 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] C0330008 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 330018C2 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 24448B00 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] 0020830C IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] [004001B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] 000CC280 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] 51EC8B55 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 00FC6583 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] FC458D56 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 11EDE850 IAT C:\WINDOWS\System32\svchost.exe[264] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] 758B0000 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 0008C280 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 83EC8B55 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 75001C7D IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] 0C7D831E IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 6A1E7501 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 03E86800 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] 016A0000 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] FF0471FF IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 43A2B015 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 18458B00 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 33002083 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 18C25DC0 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] 0C7D8100 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] 7BE85106 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 8B000110 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 20831845 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] 40C03300 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] 006ADBEB IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] 436B77B8 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 54DCE800 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] 8B00FC65 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] C0852446 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] 088B0A74 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 0851FF50 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] 00246683 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] FFFC4D83 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 8514768B IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] 560674F6 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 0207C0E8 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] 5547E800 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] 04C20002 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] F18B5600 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] FFB4E856 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 44F6FFFF IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 74010824 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] [7DE85607] C:\WINDOWS\system32\mshtml.dll (Microsoft (R) HTML Viewer/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 5900020B IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] C25EC68B IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 408B0004 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] 74C08514 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] 8EE85006 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] C3000207 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 0824448B IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] 33002083 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 0018C280 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] [004005B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 0024C280 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 1024448B IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] B8002083 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] 80004001 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 8B0010C2 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 83082444 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] 02B80020 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] C2800040 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] C0330008 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] 0008C240 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] C240C033 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 448B0014 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 40C70824 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 00020004 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] C2C03300 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] C0330008 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 330018C2 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 24448B00 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] 0020830C IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] [004001B8] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] 000CC280 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] 51EC8B55 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 00FC6583 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] FC458D56 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 11EDE850 IAT C:\WINDOWS\System32\svchost.exe[272] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] 758B0000 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegQueryValueExW] 9B8401C7 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorDacl] 46E90043 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetEntriesInAclW] 560001AA IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorGroup] 06C7F18B IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetSecurityDescriptorOwner] [00439B84] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!InitializeSecurityDescriptor] 01AA38E8 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!GetTokenInformation] 2444F600 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenProcessToken] 07740108 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!OpenThreadToken] AC0FE856 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!SetServiceStatus] 8B590001 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegisterServiceCtrlHandlerW] 04C25EC6 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegCloseKey] 8B55C300 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!RegOpenKeyExW] 1475FFEC IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ADVAPI32.dll!StartServiceCtrlDispatcherW] FF1075FF IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!WideCharToMultiByte] 10C48308 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrlenW] 8B55C35D IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalFree] 1475FFEC IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcess] FF1075FF IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThread] 75FF0C75 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcAddress] B108E808 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryExW] 458B0001 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LCMapStringW] F0A4E800 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!FreeLibrary] F18B0001 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcpyW] E8F07589 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExpandEnvironmentStringsW] 0001A906 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpiW] 00FC6583 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!ExitProcess] 8D0875FF IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCommandLineW] 06C70C4E IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InitializeCriticalSection] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetProcessHeap] 001D67E8 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetErrorMode] E8C68B00 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!SetUnhandledExceptionFilter] 0001F156 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!RegisterWaitForSingleObject] 560004C2 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!InterlockedCompareExchange] 006AF18B IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LoadLibraryA] 4E8D016A IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!QueryPerformanceCounter] 9006C70C IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetTickCount] E800439B IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentThreadId] 000022DD IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetCurrentProcessId] E95ECE8B IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!GetSystemTimeAsFileTime] 0001A999 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!TerminateProcess] E8F18B56 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!UnhandledExceptionFilter] FFFFFFDB IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!LocalAlloc] 082444F6 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!lstrcmpW] 56077401 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [KERNEL32.dll!DelayLoadFailureHook] 01AB68E8 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtQuerySecurityObject] 0004C25E IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlFreeHeap] 9B9C01C7 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtOpenKey] BCE90043 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscat] 56FFFFFF IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcscpy] 06C7F18B IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlAllocateHeap] [00439B9C] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCompareUnicodeString] FFFFAEE8 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitUnicodeString] 2444F6FF IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlInitializeSid] 07740108 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlLengthRequiredSid] AB3BE856 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthoritySid] 8B590001 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!NtClose] 04C25EC6 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlSubAuthorityCountSid] B8046A00 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetDaclSecurityDescriptor] [00433E58] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlQueryInformationAcl] 01F009E8 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlGetAce] 89F18B00 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlImageNtHeader] 7D8BF075 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!wcslen] DEE85708 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlUnhandledExceptionFilter] 830001A8 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [ntdll.dll!RtlCopySid] 8300FC65 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIfEx] 06C70C4E IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtWaitServerListen] [00439B90] C:\WINDOWS\System32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtSetServerStackSize] 001CC7E8 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUnregisterIf] E8C68B00 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerListen] 0001F0B6 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerUseProtseqEpW] 830004C2 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcServerRegisterIf] 60830020 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!I_RpcMapWin32Status] 0A8B0004 IAT C:\WINDOWS\System32\svchost.exe[1472] @ C:\WINDOWS\System32\svchost.exe [RPCRT4.dll!RpcMgmtStopServerListening] 04728B56 ---- Devices - GMER 1.0.15 ---- Device \Driver\NDIS \Device\Ndis [82491984] NDIS.sys[.reloc] AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company) AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) ---- Files - GMER 1.0.15 ---- File C:\WINDOWS\system32\drivers\ndis.sys (size mismatch) 212480/182656 bytes executable File C:\WINDOWS\system32\dllcache\ndis.sys (size mismatch) 212480/182656 bytes executable File C:\WINDOWS\$NtServicePackUninstall$\ndis.sys (size mismatch) 182912/182656 bytes executable ---- EOF - GMER 1.0.15 ---- Wäre wirklich super, wenn mir jemand helfen könnte oder sagen könnte, welche Auswirkungen der Trojaner hat. Ob ich vielleicht nicht mehr Homebanking vom Laptop aus machen sollte, usw. Vielen Dank. |
| Themen zu Rootkit.Pakes-AA nicht vom GMER gefunden |
| avg, bytes, computer, datei, dllcache, ergebnis, filter, generic, generic host process, gmer, gmer logfile, homebanking, image, infiziert, klicke, laptop, löschen, nicht mehr, ntdll.dll, problem, rootkit, scan, services, super, svchost.exe, temp, trojaner, udp, web, win32 |
Baum-Darstellung