System32\Drivers\spsx.sys - INT 0x62 bis INT 0xA4 ? Teil 1/2
Hallo zusammen! Ich bin neu hier im Board.
Mein Notebook (Acer Aspire 7520G mit AMD Turion Tl-58, 1.9GHz und 2GB RAM, Windows Vista Premium SP1) verhält sich wesentlich langsamer als sonst: die Prozessorauslastung geht gerne mal auf 100% für einen längeren Zeitraum, obwohl nur der Browser und noch ein Task läuft und alles stockt. Seltsamerweise tritt das nicht immer auf. Nun habe ich einen Scan mit Gmer durchgeführt, der mir unbekannte, mir eigenartig erscheinende Einträge aufzeigt.
Könnte es sich um ein Rootkit handeln?
Gemäss Anleitung habe ich hoffentlich alles regelkonform befolgt :).
Google konnte mir nichts zu den Einträgen finden. Nur auf einer wohl russischen Site :(
Ccleaner habe ich ausgeführt.-->Alle Fehler behoben.
Malwarebyte's Antimalware ebenso. -->Nichts gefunden.
Hijackthis-Scan, und Uninstall-List sowie den Gmer-Scan. Anbei die Logfiles.
Hinweis: Mein Post ist aufgrund der Groesse aufgeteilt.
Vielen Dank für Eure Hilfe.
Gruss
Frank
Zuerst mal der Gmer-Log. Code:
GMER 1.0.14.14536 - h**p://www.gmer.net
Rootkit scan 2009-03-01 19:26:18
Windows 6.0.6001 Service Pack 1
---- System - GMER 1.0.14 ----
INT 0x62 ? 83C55BF8
INT 0x72 ? 83C55BF8
INT 0x73 ? 85FB1BF8
INT 0x82 ? 83C55BF8
INT 0x82 ? 83C55BF8
INT 0x82 ? 85FB1BF8
INT 0x82 ? 83C55BF8
INT 0x94 ? 85FB1BF8
INT 0xA4 ? 85FB1BF8
---- Kernel code sections - GMER 1.0.14 ----
? System32\Drivers\spsx.sys Das System kann die angegebene Datei nicht finden. !
.text USBPORT.SYS!DllUnload 881E746F 5 Bytes JMP 85FB11D8
.text axinkglm.SYS 8C8C5000 22 Bytes [ 26, 12, E1, 81, 10, 11, E1, ... ]
.text axinkglm.SYS 8C8C5017 126 Bytes [ 00, 32, 97, B1, 87, 3D, 95, ... ]
.text axinkglm.SYS 8C8C5096 18 Bytes JMP 759F951C
.text axinkglm.SYS 8C8C50A9 35 Bytes JMP 7583F12F
.text axinkglm.SYS 8C8C50CE 10 Bytes [ 00, 00, 00, 00, 00, 00, 6A, ... ]
.text ...
.text win32k.sys!EngPaint + 2029 96E57309 5 Bytes JMP 9ED51750
.text win32k.sys!XLATEOBJ_iXlate + B13 96E6AB6F 5 Bytes JMP 9ED517F0
.text win32k.sys!EngCombineRgn + 3161 96E6F869 5 Bytes JMP 9ED516B0
.text win32k.sys!EngGradientFill + 7E1F 96EC1D9B 5 Bytes JMP 9ED51610
.text win32k.sys!EngMulDiv + 2E13 96EC5342 5 Bytes JMP 9ED51570
.text win32k.sys!EngMulDiv + B101 96ECD630 5 Bytes JMP 9ED51430
.text win32k.sys!EngStretchBlt + 2F9E 96EECA96 5 Bytes JMP 9ED514D0
---- Kernel IAT/EAT - GMER 1.0.14 ----
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [87A106D2] \SystemRoot\System32\Drivers\spsx.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [87A10040] \SystemRoot\System32\Drivers\spsx.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [87A107FC] \SystemRoot\System32\Drivers\spsx.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [87A100BE] \SystemRoot\System32\Drivers\spsx.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [87A1013C] \SystemRoot\System32\Drivers\spsx.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [87A20048] \SystemRoot\System32\Drivers\spsx.sys
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortNotification] CC000CC2
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortWritePortUchar] 83EC8B55
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortWritePortUlong] 575320EC
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortGetPhysicalAddress] 458DFF33
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortConvertPhysicalAddressToUlong] [8D5750FC] \SystemRoot\system32\DRIVERS\snp2uvc.sys
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortGetScatterGatherList] 5750F845
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortReadPortUchar] 8957046A
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortStallExecution] 75E8FC7D
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortGetParentBusType] BB0001E8
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortRequestCallback] 000000EA
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortWritePortBufferUshort] 850FC33B
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortGetUnCachedExtension] 0000012B
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortCompleteRequest] 0FFC7D39
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortMoveMemory] 00012284
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortCompleteAllActiveRequests] 458D5600
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortReleaseRequestSenseIrb] 106A50F4
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortBuildRequestSenseIrb] 38335668
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortReadPortUshort] FC75FF36
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortReadPortBufferUshort] D1E85757
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortInitialize] 8B0001E7
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortGetDeviceBase] 1BDEF7F0
IAT \SystemRoot\System32\Drivers\axinkglm.SYS[ataport.SYS!AtaPortDeviceStateChange] 23D6F7F6
---- User IAT/EAT - GMER 1.0.14 ----
IAT C:\Windows\system32\services.exe[704] @ C:\Windows\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 001B0002
IAT C:\Windows\system32\services.exe[704] @ C:\Windows\system32\services.exe [KERNEL32.dll!CreateProcessW] 001B0000
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [747D7BA4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [748198C5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [747DD3C8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [747CF527] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [747D7599] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [747CE43D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [7480B33D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [747DD68A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [747D012E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [747D0095] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [747C71F3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7485D802] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [747F75E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [747CDAE1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [747C668F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [747C66BA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3544] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [747D1E45] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18065_none_9e7abe2ec9c13222\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.14 ----
Device \FileSystem\Ntfs \Ntfs 84E1B1F8
Device \FileSystem\fastfat \FatCdrom 8799C1F8
Device \Driver\volmgr \Device\VolMgrControl 83C571F8
Device \Driver\usbohci \Device\USBPDO-0 85D33498
Device \Driver\usbehci \Device\USBPDO-1 85D2B1F8
Device \Driver\usbohci \Device\USBPDO-2 85D33498
Device \Driver\PCI_PNP1452 \Device\00000053 spsx.sys
Device \Driver\usbehci \Device\USBPDO-3 85D2B1F8
AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
Device \Driver\volmgr \Device\HarddiskVolume1 83C571F8
Device \Driver\volmgr \Device\HarddiskVolume2 83C571F8
Device \Driver\cdrom \Device\CdRom0 85D371F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 84E1A1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-4 84E1A1F8
Device \Driver\atapi \Device\Ide\IdePort0 84E1A1F8
Device \Driver\atapi \Device\Ide\IdePort1 84E1A1F8
Device \Driver\atapi \Device\Ide\IdePort2 84E1A1F8
Device \Driver\atapi \Device\Ide\IdePort3 84E1A1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-5 84E1A1F8
Device \Driver\volmgr \Device\HarddiskVolume3 83C571F8
Device \Driver\cdrom \Device\CdRom1 85D371F8
Device \Driver\volmgr \Device\HarddiskVolume4 83C571F8
Device \Driver\netbt \Device\NetBt_Wins_Export 877E7500
Device \Driver\netbt \Device\NetBT_Tcpip_{89E2B1AF-0BF3-4E88-B224-AAAF2DC937B8} 877E7500
Device \Driver\Smb \Device\NetbiosSmb 877D2500
Device \Driver\iScsiPrt \Device\RaidPort0 85E641F8
AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
Device \Driver\sptd \Device\3522053464 spsx.sys
Device \Driver\usbohci \Device\USBFDO-0 85D33498
Device \Driver\usbehci \Device\USBFDO-1 85D2B1F8
Device \Driver\usbohci \Device\USBFDO-2 85D33498
Device \Driver\usbehci \Device\USBFDO-3 85D2B1F8
Device \Driver\netbt \Device\NetBT_Tcpip_{D8EB5E8A-6223-4CD9-B0E5-3DD8670AB0CE} 877E7500
Device \Driver\axinkglm \Device\Scsi\axinkglm1 85E5E500
Device \Driver\axinkglm \Device\Scsi\axinkglm1Port5Path0Target0Lun0 85E5E500
Device \FileSystem\fastfat \Fat 8799C1F8
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
Device \FileSystem\cdfs \Cdfs 840E61F8
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x78 0xFC 0x6F 0xAF ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x59 0xE2 0x49 0x78 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xAD 0xA6 0xF5 0x6A ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x78 0xFC 0x6F 0xAF ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x59 0xE2 0x49 0x78 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xAD 0xA6 0xF5 0x6A ...
---- EOF - GMER 1.0.14 ----
| 