Weiß wer was das ist?

groovie · 16.09.2010, 16:08

hallo,
hab ein GMER log und da wird offenbar auf irgendwelche prozesse und reg-einträge verwiesen zu denen ich aber keine passenden dateien finde. die suche nach uac oder uacb findet nix. auch das manuelle durchsehen der win sys32 hilft nicht. versteckt sich da was ?
GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15281 - hxxp://www.gmer.net
Rootkit scan 2010-09-15 10:45:51
Windows 5.1.2600 Service Pack 3
Running: v6h3e98c.exe; Driver: c:\Temp\fgrdapog.sys
 
 
---- System - GMER 1.0.15 ----
 
SSDT B87FEEA6 ZwCreateKey
SSDT B87FEE9C ZwCreateThread
SSDT B87FEEAB ZwDeleteKey
SSDT B87FEEB5 ZwDeleteValueKey
SSDT B87FEEBA ZwLoadKey
SSDT B87FEE88 ZwOpenProcess
SSDT B87FEE8D ZwOpenThread
SSDT B87FEEC4 ZwReplaceKey
SSDT B87FEEBF ZwRestoreKey
SSDT B87FEEB0 ZwSetValueKey
SSDT B87FEE97 ZwTerminateProcess
 
---- Kernel code sections - GMER 1.0.15 ----
 
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB6B26380, 0x550AF5, 0xE8000020]
 
---- Devices - GMER 1.0.15 ----
 
AttachedDevice \Driver\Tcpip \Device\Tcp Lbd.sys (Boot Driver/Lavasoft AB)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 
---- Registry - GMER 1.0.15 ----
 
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@start 4
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACbyqrcjwlwc.sys
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@UACd 
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@UACc 
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacbbr 
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@start 4
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACbyqrcjwlwc.sys
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACd 
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@UACc 
Reg HKLM\SYSTEM\ControlSet003\Services\UACd.sys\modules@uacbbr 
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System 
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSAFEERASE03.00.00.01MSWINDOWS 00F673F10B7ACF37851E5EFE3072B6ECAA507106A97ECC1C5AD5CD35A9CBAD91D087B2F7766037E33FF38AC3112963E2F8D4912CE655B25B315384D09B05A8A14A1D670E5FC2D2F8B2C4D18ED353E8BDD4FDD91D054DEEEA971AFD4F6D8C79E9E7E2AEFD8DE7F02C5BB9DA8E13C2EB285D11180A0EE6228D6CACD186B82FDADE6A3989E14D89814AFB2FAFFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933A6171C11EC38DE3D5D575E7D6A3B9808D8CA08320BCB67FBC833E9F82DB03BB90C7398668DDC0E96754270F40AC63A396BE429DB5832CA85A309D29BE689DF75A9AB21180CD0E2F9350F0B400421096955BE324CC83A28056A2C2507A91C608E6BCD6526423A07E4FED94AB6373976BA668DA9974A3B98D530015406B6404FE4CA8F6533E5132DE1D2CB5BF1ECC971803F098770DCD26433DC71C606651476C0142A14864598B8E07F0CDD3286519CF3586B38B097DF8DC0AC6756199FF753CB67DB578ABC4EC4352DCCE45CF8934E31FB749D55A107C6032ED55074E3911493BBE50B4E41781D97543F7AF7CB1710B8C9E80CFDB9AF78E1C631767244CA9F0C578EFE05D9A3C521C29898309B2822EEB210CC7030083D2D2DF10091E6CF0D0B589EF485209C72D19B1730D597D4F61D00351E956
 
---- EOF - GMER 1.0.15 ----

--- --- ---

Weiß wer was das ist?

Plagegeister aller Art und deren Bekämpfung: Weiß wer was das ist?

Weiß wer was das ist?

Ähnliche Themen: Weiß wer was das ist?