mehrere infektionen, kaum symptome

GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-01-22 01:26:16
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 WDC_WD1600JB-55GVC0 rev.08.02D08
Running: lb2xnefp.exe; Driver: C:\DOKUME~1\***\LOKALE~1\Temp\kgtdqpog.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwAdjustPrivilegesToken [0xB321CA72]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwClose [0xB321D01E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwConnectPort [0xB321EA82]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwCreateFile [0xB321E438]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwCreateKey [0xB321C1E8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwCreateSymbolicLinkObject [0xB32203E4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwCreateThread [0xB321CE1A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwDeleteKey [0xB321C62A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwDeleteValueKey [0xB321C82A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwDeviceIoControlFile [0xB321E744]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwDuplicateObject [0xB32208F0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwEnumerateKey [0xB321C940]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwEnumerateValueKey [0xB321C9A8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwFsControlFile [0xB321E5FA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwLoadDriver [0xB321FEA8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwOpenFile [0xB321E294]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwOpenKey [0xB321C34A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwOpenProcess [0xB321CC40]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwOpenSection [0xB322040E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwOpenThread [0xB321CB96]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwQueryKey [0xB321CA10]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwQueryMultipleValueKey [0xB321C714]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwQueryValueKey [0xB321C4F2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwQueueApcThread [0xB3220110]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwReplaceKey [0xB321BE6A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwRequestWaitReplyPort [0xB321F30C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwRestoreKey [0xB321BFCC]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwResumeThread [0xB32207C0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwSaveKey [0xB321BC68]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwSecureConnectPort [0xB321E924]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwSetContextThread [0xB321CF18]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwSetSecurityObject [0xB321FFA2]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwSetSystemInformation [0xB3220438]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwSetValueKey [0xB321C3A0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwSuspendProcess [0xB322051C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwSuspendThread [0xB3220648]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwSystemDebugControl [0xB321FDD4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwTerminateProcess [0xB321CCEA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  ZwWriteVirtualMemory [0xB321CD5C]

Code            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  FsRtlCheckLockForReadAccess
Code            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)                  IoIsOperationSynchronous

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!FsRtlCheckLockForReadAccess                                                             804E9FA0 5 Bytes  JMP B32331E8 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
.text           ntkrnlpa.exe!IoIsOperationSynchronous                                                                804EE87E 5 Bytes  JMP B32335A2 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_wnet_x86/Kaspersky Lab)
.text           ntkrnlpa.exe!ZwCallbackReturn + 23E0                                                                 80501C18 4 Bytes  JMP 0E10B321 
.text           ntkrnlpa.exe!ZwCallbackReturn + 2408                                                                 80501C40 4 Bytes  CALL 8B033E06 
.text           ntkrnlpa.exe!ZwCallbackReturn + 26AC                                                                 80501EE4 4 Bytes  JMP 4C4CD20A 
.text           ntkrnlpa.exe!ZwCallbackReturn + 2758                                                                 80501F90 12 Bytes  [1C, 05, 22, B3, 48, 06, 22, ...]
.text           ntkrnlpa.exe!ZwCallbackReturn + 2768                                                                 80501FA0 4 Bytes  JMP B2B321CC 
.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                             section is writeable [0xB5FD9380, 0x566445, 0xE8000020]
.text           C:\WINDOWS\system32\DRIVERS\atksgt.sys                                                               section is writeable [0xB2845300, 0x22020, 0xE8000020]
.text           C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                                               section is writeable [0xB8368300, 0x1B7E, 0xE8000020]
init            C:\WINDOWS\System32\atkosdmini.dll                                                                   entry point in "init" section [0xBD04A480]

---- User code sections - GMER 1.0.15 ----

?               C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe[804] C:\WINDOWS\system32\kernel32.dll   time/date stamp mismatch; 
.text           C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe[804] USER32.dll!AlignRects + FFFA5598   7E362A78 4 Bytes  [70, 11, 41, 6D] {JO 0x13; INC ECX; INSD }
?               C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe[1960] C:\WINDOWS\system32\kernel32.dll  time/date stamp mismatch; 
.text           C:\Programme\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe[1960] USER32.dll!AlignRects + FFFA5598  7E362A78 4 Bytes  [70, 11, 41, 6D] {JO 0x13; INC ECX; INSD }

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT             \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject]                              [B78F1820] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
IAT             \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject]                              [B78F1820] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                             kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                            kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                            kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                          kl1.sys (Kaspersky Unified Driver/Kaspersky Lab)

---- EOF - GMER 1.0.15 ----