| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: AntiVir fand Trojaner SPR/Destart.AWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
31.01.2011, 12:23
| #1 |
 |  AntiVir fand Trojaner SPR/Destart.A Numero uno: GMER Logfile: Code:
ATTFilter GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-01-31 12:21:30
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\00000064 Hitachi_HDP725050GLA360 rev.GM4OA52A
Running: td0x5y2q.exe; Driver: C:\DOKUME~1\Besitzer\LOKALE~1\Temp\pgldqpoc.sys
---- System - GMER 1.0.15 ----
SSDT AFCFBF9E ZwCreateKey
SSDT AFCFBF94 ZwCreateThread
SSDT AFCFBFA3 ZwDeleteKey
SSDT AFCFBFAD ZwDeleteValueKey
SSDT spjn.sys ZwEnumerateKey [0xBA6CDDA4]
SSDT spjn.sys ZwEnumerateValueKey [0xBA6CE132]
SSDT AFCFBFB2 ZwLoadKey
SSDT spjn.sys ZwOpenKey [0xBA6B50C0]
SSDT AFCFBF80 ZwOpenProcess
SSDT AFCFBF85 ZwOpenThread
SSDT spjn.sys ZwQueryKey [0xBA6CE20A]
SSDT spjn.sys ZwQueryValueKey [0xBA6CE08A]
SSDT AFCFBFBC ZwReplaceKey
SSDT AFCFBFB7 ZwRestoreKey
SSDT AFCFBFA8 ZwSetValueKey
INT 0x62 ? 89E56BF8
INT 0x63 ? 898ABF00
INT 0x73 ? 89E56BF8
INT 0x82 ? 89E56BF8
INT 0x83 ? 89E56BF8
INT 0xB4 ? 898ABF00
Code \??\C:\DOKUME~1\Besitzer\LOKALE~1\Temp\catchme.sys pIofCallDriver
---- Kernel code sections - GMER 1.0.15 ----
? spjn.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload A8D7262C 5 Bytes JMP 898AB4E0
.text amoxp2xx.SYS A88A6386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...]
.text amoxp2xx.SYS A88A63AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...]
.text amoxp2xx.SYS A88A63C4 3 Bytes [00, 80, 02]
.text amoxp2xx.SYS A88A63C9 1 Byte [30]
.text amoxp2xx.SYS A88A63C9 11 Bytes [30, 00, 00, 00, 5E, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESI; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL}
.text ...
? C:\WINDOWS\system32\Drivers\PROCEXP113.SYS Das System kann die angegebene Datei nicht finden. !
? C:\DOKUME~1\Besitzer\LOKALE~1\Temp\catchme.sys Das System kann die angegebene Datei nicht finden. !
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\SearchIndexer.exe[3456] kernel32.dll!WriteFile 7C810D97 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [BA6B6042] spjn.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [BA6B613E] spjn.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [BA6B60C0] spjn.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [BA6B6800] spjn.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [BA6B66D6] spjn.sys
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!KfAcquireSpinLock] 0C8D1C46
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!READ_PORT_UCHAR] B48B8932
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!KeGetCurrentIrql] 89000001
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!KfRaiseIrql] 0001C083
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!KfLowerIrql] 24468B00
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!HalGetInterruptVector] 89820C8D
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!HalTranslateBusAddress] D18BF84D
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!KeStallExecutionProcessor] 860F1639
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!KfReleaseSpinLock] 000000BD
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 020CB389
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!READ_PORT_USHORT] 83660000
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 7400067E
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[HAL.dll!WRITE_PORT_UCHAR] 89D60320
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[WMILIB.SYS!WmiSystemControl] 8D168B00
IAT \SystemRoot\System32\Drivers\amoxp2xx.SYS[WMILIB.SYS!WmiCompleteRequest] F0003284
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 89E551F8
Device \FileSystem\Fastfat \FatCdrom 88EB11F8
Device \Driver\PCI_PNP3866 \Device\00000042 spjn.sys
Device \Driver\usbohci \Device\USBPDO-0 89A1A500
Device \Driver\usbehci \Device\USBPDO-1 89A17500
Device \Driver\sptd \Device\3703398866 spjn.sys
Device \Driver\Ftdisk \Device\HarddiskVolume1 89E571F8
Device \Driver\Cdrom \Device\CdRom0 89838500
Device \Driver\Ftdisk \Device\HarddiskVolume2 89E571F8
Device \Driver\Cdrom \Device\CdRom1 89838500
Device \Driver\Ftdisk \Device\HarddiskVolume3 89E571F8
Device \Driver\Ftdisk \Device\HarddiskVolume4 89E571F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 890791F8
Device \Driver\NetBT \Device\NetbiosSmb 890791F8
Device \Driver\usbohci \Device\USBFDO-0 89A1A500
Device \Driver\usbehci \Device\USBFDO-1 89A17500
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8905B1F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8905B1F8
Device \Driver\Ftdisk \Device\FtControl 89E571F8
Device \Driver\amoxp2xx \Device\Scsi\amoxp2xx1Port3Path0Target0Lun0 898E9500
Device \Driver\amoxp2xx \Device\Scsi\amoxp2xx1 898E9500
Device \FileSystem\Fastfat \Fat 88EB11F8
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
Device \FileSystem\Cdfs \Cdfs 88EE51F8
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xAF 0xD4 0x6A 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x5F 0xEA 0x53 0x23 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xCB 0xB2 0x2C 0xFA ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Programme\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xAF 0xD4 0x6A 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x5F 0xEA 0x53 0x23 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xCB 0xB2 0x2C 0xFA ...
---- EOF - GMER 1.0.15 ----
|
|
| Themen zu AntiVir fand Trojaner SPR/Destart.A |
| adobe, anfang, antivir, antivir guard, besitzer, bho, bonjour, browser, desktop, einstellungen, eudora, excel, explorer, firefox.exe, google, hijack, hijackthis, hkus\s-1-5-18, monitor, nt.dll, nvidia, plug-in, programme, registry, senden, software, spr/destart.a, system, trojaner, versteckte objekte, verweise, virus, virus gefunden, windows, windows xp |
Hybrid-Darstellung
