 | |
| Hunter442 | 21.12.2010 16:57 |
So, nachdem ich beim 1. Versuch ein Bluescreen hatte und in letzter Zeit wenig Zeit, hier nun doch ein erfolgreicher Log! ;)
GMER Logfile: Code:
GMER 1.0.15.15530 - GMER - Rootkit Detector and Remover
Rootkit scan 2010-12-21 16:52:49
Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-c ST340014A rev.8.10
Running: 69rfrpt5.exe; Driver: C:\DOKUME~1\Verkauf\LOKALE~1\Temp\uftyypoc.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwClose [0xEF697CF0]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateKey [0xEF697BAC]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteKey [0xEF698160]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDeleteValueKey [0xEF69808A]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwDuplicateObject [0xEF697782]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenKey [0xEF697C86]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenProcess [0xEF6976C2]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwOpenThread [0xEF697726]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwQueryValueKey [0xEF697DA6]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xEF69822E]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRestoreKey [0xEF697D66]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwSetValueKey [0xEF697EE6]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xEF6A4BAE]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateSection [0xEF6A49D2]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwLoadDriver [0xEF6A4B0C]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) NtCreateSection
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject
---- Kernel code sections - GMER 1.0.15 ----
PAGE ntoskrnl.exe!ObInsertObject 80564F23 5 Bytes JMP EF6A1FFA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!NtCreateSection 8056519B 7 Bytes JMP EF6A49D6 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ZwCreateProcessEx 80582FAA 7 Bytes JMP EF6A4BB2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ObMakeTemporaryObject 805A164B 5 Bytes JMP EF6A05D4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE ntoskrnl.exe!ZwLoadDriver 805A3AF2 7 Bytes JMP EF6A4B10 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\hkcmd.exe[128] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202F795E
.text C:\WINDOWS\system32\hkcmd.exe[128] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202F5BDA
.text C:\WINDOWS\system32\hkcmd.exe[128] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202F73C6
.text C:\Programme\OpenOffice.org 3\program\soffice.exe[260] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\Programme\OpenOffice.org 3\program\soffice.exe[260] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\Programme\OpenOffice.org 3\program\soffice.exe[260] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2006795E
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20065BDA
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200673C6
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20067634
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20067717
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] WS2_32.dll!send 71A1428A 5 Bytes JMP 20067606
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200677EB
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200676DD
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20067757
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2006793F
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20067892
.text C:\Programme\OpenOffice.org 3\program\soffice.bin[280] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2006779E
.text C:\WINDOWS\system32\spoolsv.exe[332] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\WINDOWS\system32\spoolsv.exe[332] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\WINDOWS\system32\spoolsv.exe[332] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\WINDOWS\System32\alg.exe[636] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\WINDOWS\System32\alg.exe[636] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\WINDOWS\System32\alg.exe[636] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\WINDOWS\System32\alg.exe[636] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20017634
.text C:\WINDOWS\System32\alg.exe[636] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20017717
.text C:\WINDOWS\System32\alg.exe[636] WS2_32.dll!send 71A1428A 5 Bytes JMP 20017606
.text C:\WINDOWS\System32\alg.exe[636] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200177EB
.text C:\WINDOWS\System32\alg.exe[636] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200176DD
.text C:\WINDOWS\System32\alg.exe[636] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20017757
.text C:\WINDOWS\System32\alg.exe[636] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2001793F
.text C:\WINDOWS\System32\alg.exe[636] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20017892
.text C:\WINDOWS\System32\alg.exe[636] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2001779E
.text C:\WINDOWS\system32\csrss.exe[640] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2002795E
.text C:\WINDOWS\system32\csrss.exe[640] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20025BDA
.text C:\WINDOWS\system32\csrss.exe[640] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200273C6
.text C:\WINDOWS\system32\winlogon.exe[664] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2002795E
.text C:\WINDOWS\system32\winlogon.exe[664] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20025BDA
.text C:\WINDOWS\system32\winlogon.exe[664] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200273C6
.text C:\WINDOWS\system32\winlogon.exe[664] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20027634
.text C:\WINDOWS\system32\winlogon.exe[664] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20027717
.text C:\WINDOWS\system32\winlogon.exe[664] WS2_32.dll!send 71A1428A 5 Bytes JMP 20027606
.text C:\WINDOWS\system32\winlogon.exe[664] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200277EB
.text C:\WINDOWS\system32\winlogon.exe[664] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200276DD
.text C:\WINDOWS\system32\winlogon.exe[664] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20027757
.text C:\WINDOWS\system32\winlogon.exe[664] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2002793F
.text C:\WINDOWS\system32\winlogon.exe[664] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20027892
.text C:\WINDOWS\system32\winlogon.exe[664] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2002779E
.text C:\WINDOWS\system32\services.exe[720] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2002795E
.text C:\WINDOWS\system32\services.exe[720] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20025BDA
.text C:\WINDOWS\system32\services.exe[720] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200273C6
.text C:\WINDOWS\system32\services.exe[720] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20027634
.text C:\WINDOWS\system32\services.exe[720] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20027717
.text C:\WINDOWS\system32\services.exe[720] WS2_32.dll!send 71A1428A 5 Bytes JMP 20027606
.text C:\WINDOWS\system32\services.exe[720] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200277EB
.text C:\WINDOWS\system32\services.exe[720] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200276DD
.text C:\WINDOWS\system32\services.exe[720] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20027757
.text C:\WINDOWS\system32\services.exe[720] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2002793F
.text C:\WINDOWS\system32\services.exe[720] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20027892
.text C:\WINDOWS\system32\services.exe[720] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2002779E
.text C:\WINDOWS\system32\lsass.exe[732] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2002795E
.text C:\WINDOWS\system32\lsass.exe[732] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20025BDA
.text C:\WINDOWS\system32\lsass.exe[732] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200273C6
.text C:\WINDOWS\system32\lsass.exe[732] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20027634
.text C:\WINDOWS\system32\lsass.exe[732] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20027717
.text C:\WINDOWS\system32\lsass.exe[732] WS2_32.dll!send 71A1428A 5 Bytes JMP 20027606
.text C:\WINDOWS\system32\lsass.exe[732] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200277EB
.text C:\WINDOWS\system32\lsass.exe[732] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200276DD
.text C:\WINDOWS\system32\lsass.exe[732] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20027757
.text C:\WINDOWS\system32\lsass.exe[732] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2002793F
.text C:\WINDOWS\system32\lsass.exe[732] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20027892
.text C:\WINDOWS\system32\lsass.exe[732] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2002779E
.text C:\WINDOWS\system32\igfxtray.exe[800] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202F795E
.text C:\WINDOWS\system32\igfxtray.exe[800] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202F5BDA
.text C:\WINDOWS\system32\igfxtray.exe[800] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202F73C6
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[856] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202F795E
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[856] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202F5BDA
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe[856] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202F73C6
.text C:\WINDOWS\system32\svchost.exe[900] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202E795E
.text C:\WINDOWS\system32\svchost.exe[900] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202E5BDA
.text C:\WINDOWS\system32\svchost.exe[900] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202E73C6
.text C:\WINDOWS\system32\svchost.exe[900] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 202E7634
.text C:\WINDOWS\system32\svchost.exe[900] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 202E7717
.text C:\WINDOWS\system32\svchost.exe[900] WS2_32.dll!send 71A1428A 5 Bytes JMP 202E7606
.text C:\WINDOWS\system32\svchost.exe[900] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 202E77EB
.text C:\WINDOWS\system32\svchost.exe[900] WS2_32.dll!recv 71A1615A 5 Bytes JMP 202E76DD
.text C:\WINDOWS\system32\svchost.exe[900] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 202E7757
.text C:\WINDOWS\system32\svchost.exe[900] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 202E793F
.text C:\WINDOWS\system32\svchost.exe[900] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 202E7892
.text C:\WINDOWS\system32\svchost.exe[900] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 202E779E
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202E795E
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202E5BDA
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202E73C6
.text C:\WINDOWS\system32\svchost.exe[972] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 202E7634
.text C:\WINDOWS\system32\svchost.exe[972] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 202E7717
.text C:\WINDOWS\system32\svchost.exe[972] WS2_32.dll!send 71A1428A 5 Bytes JMP 202E7606
.text C:\WINDOWS\system32\svchost.exe[972] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 202E77EB
.text C:\WINDOWS\system32\svchost.exe[972] WS2_32.dll!recv 71A1615A 5 Bytes JMP 202E76DD
.text C:\WINDOWS\system32\svchost.exe[972] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 202E7757
.text C:\WINDOWS\system32\svchost.exe[972] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 202E793F
.text C:\WINDOWS\system32\svchost.exe[972] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 202E7892
.text C:\WINDOWS\system32\svchost.exe[972] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 202E779E
.text C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe[1020] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202F795E
.text C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe[1020] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202F5BDA
.text C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe[1020] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202F73C6
.text C:\Programme\iTunes\iTunesHelper.exe[1048] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202F795E
.text C:\Programme\iTunes\iTunesHelper.exe[1048] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202F5BDA
.text C:\Programme\iTunes\iTunesHelper.exe[1048] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202F73C6
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202F795E
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202F5BDA
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202F73C6
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 202F7634
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 202F7717
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] WS2_32.dll!send 71A1428A 5 Bytes JMP 202F7606
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 202F77EB
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] WS2_32.dll!recv 71A1615A 5 Bytes JMP 202F76DD
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 202F7757
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 202F793F
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 202F7892
.text C:\Programme\Alwil Software\Avast5\avastUI.exe[1072] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 202F779E
.text C:\WINDOWS\System32\svchost.exe[1084] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202E795E
.text C:\WINDOWS\System32\svchost.exe[1084] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202E5BDA
.text C:\WINDOWS\System32\svchost.exe[1084] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202E73C6
.text C:\WINDOWS\System32\svchost.exe[1084] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 202E7634
.text C:\WINDOWS\System32\svchost.exe[1084] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 202E7717
.text C:\WINDOWS\System32\svchost.exe[1084] WS2_32.dll!send 71A1428A 5 Bytes JMP 202E7606
.text C:\WINDOWS\System32\svchost.exe[1084] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 202E77EB
.text C:\WINDOWS\System32\svchost.exe[1084] WS2_32.dll!recv 71A1615A 5 Bytes JMP 202E76DD
.text C:\WINDOWS\System32\svchost.exe[1084] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 202E7757
.text C:\WINDOWS\System32\svchost.exe[1084] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 202E793F
.text C:\WINDOWS\System32\svchost.exe[1084] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 202E7892
.text C:\WINDOWS\System32\svchost.exe[1084] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 202E779E
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2002795E
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20025BDA
.text C:\WINDOWS\system32\svchost.exe[1148] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200273C6
.text C:\WINDOWS\system32\svchost.exe[1148] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20027634
.text C:\WINDOWS\system32\svchost.exe[1148] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20027717
.text C:\WINDOWS\system32\svchost.exe[1148] WS2_32.dll!send 71A1428A 5 Bytes JMP 20027606
.text C:\WINDOWS\system32\svchost.exe[1148] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200277EB
.text C:\WINDOWS\system32\svchost.exe[1148] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200276DD
.text C:\WINDOWS\system32\svchost.exe[1148] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20027757
.text C:\WINDOWS\system32\svchost.exe[1148] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2002793F
.text C:\WINDOWS\system32\svchost.exe[1148] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20027892
.text C:\WINDOWS\system32\svchost.exe[1148] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2002779E
.text C:\Dokumente und Einstellungen\Verkauf\Eigene Dateien\Downloads\69rfrpt5.exe[1168] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202F795E
.text C:\Dokumente und Einstellungen\Verkauf\Eigene Dateien\Downloads\69rfrpt5.exe[1168] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202F5BDA
.text C:\Dokumente und Einstellungen\Verkauf\Eigene Dateien\Downloads\69rfrpt5.exe[1168] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202F73C6
.text C:\WINDOWS\system32\svchost.exe[1276] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202E795E
.text C:\WINDOWS\system32\svchost.exe[1276] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202E5BDA
.text C:\WINDOWS\system32\svchost.exe[1276] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202E73C6
.text C:\WINDOWS\system32\svchost.exe[1276] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 202E7634
.text C:\WINDOWS\system32\svchost.exe[1276] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 202E7717
.text C:\WINDOWS\system32\svchost.exe[1276] WS2_32.dll!send 71A1428A 5 Bytes JMP 202E7606
.text C:\WINDOWS\system32\svchost.exe[1276] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 202E77EB
.text C:\WINDOWS\system32\svchost.exe[1276] WS2_32.dll!recv 71A1615A 5 Bytes JMP 202E76DD
.text C:\WINDOWS\system32\svchost.exe[1276] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 202E7757
.text C:\WINDOWS\system32\svchost.exe[1276] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 202E793F
.text C:\WINDOWS\system32\svchost.exe[1276] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 202E7892
.text C:\WINDOWS\system32\svchost.exe[1276] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 202E779E
.text C:\Programme\Alwil Software\Avast5\AvastSvc.exe[1416] kernel32.dll!SetUnhandledExceptionFilter 7C8447ED 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }
.text C:\WINDOWS\Explorer.EXE[1596] Explorer.EXE 01002742 2 Bytes [34, 15] {XOR AL, 0x15}
.text C:\WINDOWS\Explorer.EXE[1596] Explorer.EXE 01002756 14 Bytes [8B, FF, 55, 8B, EC, 56, 57, ...]
.text C:\WINDOWS\Explorer.EXE[1596] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202E795E
.text C:\WINDOWS\Explorer.EXE[1596] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202E5BDA
.text C:\WINDOWS\Explorer.EXE[1596] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202E73C6
.text C:\WINDOWS\Explorer.EXE[1596] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 009C7207
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2003795E
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20035BDA
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200373C6
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ws2_32.dll!sendto 71A12C69 5 Bytes JMP 20037634
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ws2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20037717
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ws2_32.dll!send 71A1428A 5 Bytes JMP 20037606
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ws2_32.dll!WSARecv 71A14318 5 Bytes JMP 200377EB
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ws2_32.dll!recv 71A1615A 5 Bytes JMP 200376DD
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ws2_32.dll!WSASend 71A16233 5 Bytes JMP 20037757
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ws2_32.dll!closesocket 71A19639 5 Bytes JMP 2003793F
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ws2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20037892
.text C:\Programme\Internet Explorer\iexplore.exe[1716] ws2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2003779E
.text C:\Programme\Internet Explorer\iexplore.exe[1736] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\Programme\Internet Explorer\iexplore.exe[1736] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\Programme\Internet Explorer\iexplore.exe[1736] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\WINDOWS\system32\svchost.exe[2096] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\WINDOWS\system32\svchost.exe[2096] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\WINDOWS\system32\svchost.exe[2096] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20017634
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20017717
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] WS2_32.dll!send 71A1428A 5 Bytes JMP 20017606
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200177EB
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200176DD
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20017757
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2001793F
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20017892
.text C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2136] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2001779E
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20017634
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20017717
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] WS2_32.dll!send 71A1428A 5 Bytes JMP 20017606
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200177EB
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200176DD
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20017757
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2001793F
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20017892
.text C:\Programme\Bonjour\mDNSResponder.exe[2172] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2001779E
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe[2380] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe[2380] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe[2380] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20017634
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20017717
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] WS2_32.dll!send 71A1428A 5 Bytes JMP 20017606
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200177EB
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200176DD
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20017757
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2001793F
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20017892
.text C:\Programme\Java\jre6\bin\jqs.exe[2392] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2001779E
.text C:\WINDOWS\system32\HPZipm12.exe[2656] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\WINDOWS\system32\HPZipm12.exe[2656] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\WINDOWS\system32\HPZipm12.exe[2656] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\WINDOWS\system32\HPZipm12.exe[2656] WS2_32.dll!sendto 71A12C69 5 Bytes JMP 20017634
.text C:\WINDOWS\system32\HPZipm12.exe[2656] WS2_32.dll!recvfrom 71A12D0F 5 Bytes JMP 20017717
.text C:\WINDOWS\system32\HPZipm12.exe[2656] WS2_32.dll!send 71A1428A 5 Bytes JMP 20017606
.text C:\WINDOWS\system32\HPZipm12.exe[2656] WS2_32.dll!WSARecv 71A14318 5 Bytes JMP 200177EB
.text C:\WINDOWS\system32\HPZipm12.exe[2656] WS2_32.dll!recv 71A1615A 5 Bytes JMP 200176DD
.text C:\WINDOWS\system32\HPZipm12.exe[2656] WS2_32.dll!WSASend 71A16233 5 Bytes JMP 20017757
.text C:\WINDOWS\system32\HPZipm12.exe[2656] WS2_32.dll!closesocket 71A19639 5 Bytes JMP 2001793F
.text C:\WINDOWS\system32\HPZipm12.exe[2656] WS2_32.dll!WSARecvFrom 71A1F652 5 Bytes JMP 20017892
.text C:\WINDOWS\system32\HPZipm12.exe[2656] WS2_32.dll!WSASendTo 71A20A95 5 Bytes JMP 2001779E
.text C:\WINDOWS\system32\svchost.exe[2716] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\WINDOWS\system32\svchost.exe[2716] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\WINDOWS\system32\svchost.exe[2716] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\Programme\iPod\bin\iPodService.exe[3508] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001795E
.text C:\Programme\iPod\bin\iPodService.exe[3508] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20015BDA
.text C:\Programme\iPod\bin\iPodService.exe[3508] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 200173C6
.text C:\WINDOWS\system32\wuauclt.exe[3576] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 202F795E
.text C:\WINDOWS\system32\wuauclt.exe[3576] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 202F5BDA
.text C:\WINDOWS\system32\wuauclt.exe[3576] ntdll.dll!LdrLoadDll 7C925CD3 5 Bytes JMP 202F73C6
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\WINDOWS\system32\services.exe[720] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00370002
IAT C:\WINDOWS\system32\services.exe[720] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00370000
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)
AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
---- Files - GMER 1.0.15 ----
File C:\Dokumente und Einstellungen\Verkauf\Startmenü\Programme\Autostart\hootmfeu.exe 66574 bytes executable
File C:\Programme\EWxafeLE\hootmfeu.exe 66574 bytes executable
---- EOF - GMER 1.0.15 ----
--- --- ---
Mist -.-... Virenscaner angelassen... |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 10:31 Uhr. | |
Copyright ©2000-2025, Trojaner-Board
Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.