| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: TR/Dldr.Java.Agent.CFWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
29.06.2010, 12:34
| #12 |
 |  TR/Dldr.Java.Agent.CF Hier mal das Erste: GMER Logfile: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-06-29 13:32:30
Windows 5.1.2600 Service Pack 3
Running: i2ift4g7.exe; Driver: C:\DOKUME~1\Matthias\LOKALE~1\Temp\uxtdypow.sys
---- System - GMER 1.0.15 ----
SSDT F7CE7D46 ZwCreateKey
SSDT F7CE7D3C ZwCreateThread
SSDT F7CE7D4B ZwDeleteKey
SSDT F7CE7D55 ZwDeleteValueKey
SSDT spbe.sys ZwEnumerateKey [0xF7401DA4]
SSDT spbe.sys ZwEnumerateValueKey [0xF7402132]
SSDT F7CE7D5A ZwLoadKey
SSDT spbe.sys ZwOpenKey [0xF73E90C0]
SSDT F7CE7D28 ZwOpenProcess
SSDT F7CE7D2D ZwOpenThread
SSDT spbe.sys ZwQueryKey [0xF740220A]
SSDT spbe.sys ZwQueryValueKey [0xF740208A]
SSDT F7CE7D64 ZwReplaceKey
SSDT F7CE7D5F ZwRestoreKey
SSDT F7CE7D50 ZwSetValueKey
SSDT F7CE7D37 ZwTerminateProcess
INT 0x62 ? 867DABF8
INT 0x63 ? 86205F00
INT 0x73 ? 867DABF8
INT 0x82 ? 867DABF8
INT 0x83 ? 867DABF8
INT 0xB4 ? 86205F00
---- Kernel code sections - GMER 1.0.15 ----
? spbe.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload EB73E8AC 5 Bytes JMP 862054E0
.text adiapmxm.SYS EB086386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text adiapmxm.SYS EB0863AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text adiapmxm.SYS EB0863C4 3 Bytes [00, 80, 02]
.text adiapmxm.SYS EB0863C9 1 Byte [30]
.text adiapmxm.SYS EB0863C9 11 Bytes [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text ...
.text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xEC337300, 0x3B6D8, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xF20A5300, 0x1BEE, 0xE8000020]
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F73EA042] spbe.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F73EA13E] spbe.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F73EA0C0] spbe.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F73EA800] spbe.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F73EA6D6] spbe.sys
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!KfAcquireSpinLock] 18C4830E
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!READ_PORT_UCHAR] 1C959E88
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!KeGetCurrentIrql] 9E880000
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!KfRaiseIrql] 00001CB1
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!KfLowerIrql] 0E798366
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!HalGetInterruptVector] 74AAB000
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!HalTranslateBusAddress] 8986C636
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!KeStallExecutionProcessor] 1A00001C
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!KfReleaseSpinLock] 1C8B86C6
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] C6020000
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!READ_PORT_USHORT] 001C9686
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 86C60200
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[HAL.dll!WRITE_PORT_UCHAR] 00001CB2
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[WMILIB.SYS!WmiSystemControl] 8800001C
IAT \SystemRoot\System32\Drivers\adiapmxm.SYS[WMILIB.SYS!WmiCompleteRequest] 001CB99E
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F73F9B90] spbe.sys
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 8676A1F8
Device \Driver\usbohci \Device\USBPDO-0 8622F500
Device \Driver\usbehci \Device\USBPDO-1 86212500
Device \Driver\PCI_PNP7592 \Device\00000054 spbe.sys
Device \Driver\PCI_PNP7592 \Device\00000054 spbe.sys
Device \Driver\Ftdisk \Device\HarddiskVolume1 867DB1F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 867DB1F8
Device \Driver\Cdrom \Device\CdRom0 86275500
Device \Driver\Cdrom \Device\CdRom1 86275500
Device \Driver\nvatabus \Device\00000077 867DA1F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 85C041F8
Device \Driver\nvatabus \Device\00000078 867DA1F8
Device \Driver\NetBT \Device\NetbiosSmb 85C041F8
Device \Driver\sptd \Device\3450338842 spbe.sys
Device \Driver\usbohci \Device\USBFDO-0 8622F500
Device \Driver\nvatabus \Device\NvAta0 867DA1F8
Device \Driver\usbehci \Device\USBFDO-1 86212500
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 85BEB1F8
Device \Driver\nvatabus \Device\NvAta1 867DA1F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 85BEB1F8
Device \Driver\nvatabus \Device\NvAta2 867DA1F8
Device \Driver\Ftdisk \Device\FtControl 867DB1F8
Device \Driver\adiapmxm \Device\Scsi\adiapmxm1 8635D500
Device \Driver\adiapmxm \Device\Scsi\adiapmxm1Port3Path0Target0Lun0 8635D500
Device \FileSystem\Cdfs \Cdfs 85BB91F8
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x8F 0xF0 0x44 0xC5 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x2D 0x4D 0xAF 0x25 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xA3 0xBB 0x1D 0x33 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xC3 0x39 0x46 0x69 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x95 0x75 0xC4 0x6E ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xE9 0x30 0x52 0xCF ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x59 0xEF 0xEF 0xF0 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x2D 0x4D 0xAF 0x25 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xA3 0xBB 0x1D 0x33 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xC3 0x39 0x46 0x69 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x95 0x75 0xC4 0x6E ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xE9 0x30 0x52 0xCF ...
---- EOF - GMER 1.0.15 ----
--- --- --- das Andere folgt bald edit Link zu OSAM funktioniert nicht |
| Themen zu TR/Dldr.Java.Agent.CF |
| .dll, 0 bytes, antivir, avg, avira, black, csrss.exe, datei, delay.exe, desktop, einstellungen, explorer.exe, free, google, jucheck.exe, jusched.exe, lsass.exe, modul, namen, nt.dll, problem, programme, prozesse, registry, services.exe, spoolsv.exe, suchlauf, svchost.exe, trojaner, versteckte objekte, verweise, virus gefunden, warnung, windows, winlogon.exe |
Baum-Darstellung