Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner DR/fake alert sj (https://www.trojaner-board.de/77786-trojaner-dr-fake-alert-sj.html)

burne 24.09.2009 13:50
Trojaner DR/fake alert sj
 
Hallo zusammen..

Antivir hat einen Trojaner namens DR/Fake Alert.SJ gefunden, was soll ich jetzt tun?? Bitte um eure professionelle Hilfe..

Vielen Dank

burne 24.09.2009 14:57
Malwarebytes' Anti-Malware 1.41
Datenbank Version: 2854
Windows 5.1.2600 Service Pack 3

24.09.2009 15:55:48
mbam-log-2009-09-24 (15-55-45).txt

Scan-Methode: Vollständiger Scan (C:\|F:\|)
Durchsuchte Objekte: 321976
Laufzeit: 50 minute(s), 11 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\AntivirusDoktorNE (Rogue.AntivirusDoktor) -> No action taken.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\System Volume Information\_restore{9BE1304A-CB87-4670-B381-3C2C5DA692A8}\RP170\A0066821.exe (Rogue.AntivirusDoktor) -> No action taken.

Donthackme 25.09.2009 13:16
Zitat:
Zitat von burne (Beitrag 468026)
Hallo zusammen..

Antivir hat einen Trojaner namens DR/Fake Alert.SJ gefunden, was soll ich jetzt tun?? Bitte um eure professionelle Hilfe..

Vielen Dank

Achtung!:pfui: Du hast einen Rootkit auf deinem System:

S3 gAGP440p;gAGP440p; \??\C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\gAGP440p.sys


Diese Datei bitte bei Virus Total hier:
http://www.virustotal.com/de/
checken:
C:\WINDOWS\system32\drivers\aeww5shi.sys



Bitte dein System mit Antirootkit Scannern durchsuchen.

Einige Scans auf Dateien, Prozesse und Registryeinträge, die vor den meisten anderen Scannern versteckt werden (durch ein Rootkit). Während dieser Scans sollten:

* alle anderen Scanner gegen Viren, Spyware, usw deaktiviert sein
* keine Verbindung zu einem Netzwerk/Internet bestehen (WLAN nicht vergessen)
* nichts am Rechner getan werden

Sophos scannen lassen

* Lade dir den Rootkitescanner hier
Sophos Anti-Rootkit - Download - CHIP Online
herunter. Du bekommst eine Installationsdatei sarsfx.exe.
* Starte diese, akzeptiere die Lizenz und lass das Programm installieren, und starte den Scan mit "Start scan". Der Scan dauert einige Zeit, wenn er fertig ist poppt ein Fenster auf mit einer Zusammenfassung, klicke dort "Ok". Beende den Sophos Rootkitscanner, evtl. Fünde hier in den Thread notieren.


Panda Anti-Rootkit scannen lassen

* Lade das Panda Anti-Rootkit hier
Panda Antirootkit - Freeware - Download.CHIP.eu
herunter und installiere es.
* Schliesse alle Anwendungen, schliesse den Webbrowser, klicke alle Fensterchen aus.
* Beende alle Wächterprogramme und On-Demand-Scanner.
* Mache bitte nichts am Rechner.
* Starte das Programm mit einem Doppelklick auf die Datei PAVARK.exe
* Nach der Zustimmung zum Lizensabkommen startest du den Scan.
* Bitte das Programm nicht unterbrechen.

* Bitte evtl. Fünde erstmals nicht löschen, sondern hier im Thread angeben.

Sollten diese beiden ihn nicht finden und unschädlich machen, müssen wir härteres Geschütz auffahren.

burne 25.09.2009 14:53
vielen dank schon mal..

die datei gibt es nur leider nicht im driver Ordner.. was nun??

Donthackme 25.09.2009 16:50
Zitat:
die datei gibt es nur leider nicht im driver Ordner.. was nun?
Dann handelt es sich hier um einen "Hidden Driver" also evtl. ebenfalls ein Rootkit.
Bitte unbedingt die vorgegebenen Rootkit Scans durchführen und Funde hier posten.

burne 25.09.2009 18:24
so habe jetzt mal mit sophos durchsucht hat mir folgendes ausgespuckt:

Area: Local hard drives
Description: Unknown hidden file
Location: C:\WINDOWS\system32\drivers\sptd.sys
Removable: Yes (but clean up not recommended for this file)
Notes: (no more detail available)

burne 25.09.2009 18:34
Panda Anti- Rootkit:

Items scanned: 5273

NO ROOTKITS HAVE BEEN FOUND :confused:

Donthackme 25.09.2009 18:44
Die Ergebnisse von Panda?

Und ich habe mehr Arbeit für dich:)

Bitte diese Dateien bei Virus Total hochladen und Ergebnis mitteilen:

C:\WINDOWS\system32\javaws.exe
C:\WINDOWS\system32\javaw.exe
C:\WINDOWS\system32\java.exe

VirusTotal - Kostenloser online Viren- und Malwarescanner

Mache einen Scan mit dem Antirootkit Scanner "Rootrepeal"

Rootkitscan mit RootRepeal

* Lade dir den Scanner hier runter:
RootRepeal - RootRepeal - Rootkit Detector
, scrolle runter und downloade RootRepeal.zip.
* Trenne deinen Computer vom Internet
* Deaktiviere dein Firewall und Antivirenprogramm
* Entpacke die Datei auf Deinen Desktop.
* Doppelklicke die RootRepeal.exe, um den Scanner zu starten.
* Klicke auf den Reiter Report und dann auf den Button Scan.
* Mache einen Haken bei den folgenden Elementen und klicke Ok.

Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services
.
* Im Anschluss wirst Du gefragt, welche Laufwerke gescannt werden sollen.
* Wähle C:\ und klicke wieder Ok.
* Der Suchlauf beginnt automatisch, es wird eine Weile dauern, bitte Geduld.
* Bitte wärend des Scans nicht am Computer arbeiten!
* Wenn der Suchlauf beendet ist, klicke auf Save Report.
* Speichere das Logfile als RootRepeal.txt auf dem Desktop.
* Kopiere den Inhalt hier in den Thread.

burne 25.09.2009 18:47
habe ich doch geschrieben.. nicht gefunden!!

warum denn die JAva Dateien durchsuchen??

vielen dank

Donthackme 25.09.2009 18:58
Zitat:
NO ROOTKITS HAVE BEEN FOUND :confused:
Das bedeutet leider noch keine Entwarnung. Nicht alle Scanner finden, was sie finden sollten. "Rootrepeal" ist der beste und gründlichste von den Dreien...

Donthackme 25.09.2009 19:04
Zitat:
warum denn die JAva Dateien durchsuchen??
Weil Java Dateien eigentlich im Ordner "Programme" laufen und nicht im Ordner Windows 32. Wenn sie in C:Prgramme sind, sind sie harmlos, wenn im Ordner Windows 32, kann es sich um Malware handeln.

burne 25.09.2009 19:41
ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/09/25 19:55
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xAC63A000 Size: 98304 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xBA64C000 Size: 8192 File Visible: No Signed: -
Status: -

Name: giveio.sys
Image Path: giveio.sys
Address: 0xBA671000 Size: 1664 File Visible: No Signed: -
Status: -

Name: PCI_PNP3460
Image Path: \Driver\PCI_PNP3460
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Name: phooks.sys
Image Path: phooks.sys
Address: 0xBA328000 Size: 23552 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA86BD000 Size: 49152 File Visible: No Signed: -
Status: -

Name: spec.sys
Image Path: spec.sys
Address: 0xB9EA6000 Size: 1052672 File Visible: No Signed: -
Status: -

Name: speedfan.sys
Image Path: speedfan.sys
Address: 0xBA5AE000 Size: 5248 File Visible: No Signed: -
Status: -

Name: sptd
Image Path: \Driver\sptd
Address: 0x00000000 Size: 0 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: F:\System Volume Information\_restore{9BE1304A-CB87-4670-B381-3C2C5DA692A8}\RP189\A0070920.exe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Visible to the Windows API, but not on disk.

Path: F:\System Volume Information\_restore{9BE1304A-CB87-4670-B381-3C2C5DA692A8}\RP207\A0075638.exe:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}
Status: Visible to the Windows API, but not on disk.

SSDT
-------------------
#: 041 Function Name: NtCreateKey
Status: Hooked by "<unknown>" at address 0xba720e5e

#: 053 Function Name: NtCreateThread
Status: Hooked by "<unknown>" at address 0xba720e54

#: 063 Function Name: NtDeleteKey
Status: Hooked by "<unknown>" at address 0xba720e63

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "<unknown>" at address 0xba720e6d

#: 071 Function Name: NtEnumerateKey
Status: Hooked by "spec.sys" at address 0xb9ec5ca4

#: 073 Function Name: NtEnumerateValueKey
Status: Hooked by "spec.sys" at address 0xb9ec6032

#: 098 Function Name: NtLoadKey
Status: Hooked by "<unknown>" at address 0xba720e72

#: 119 Function Name: NtOpenKey
Status: Hooked by "spec.sys" at address 0xb9ea70c0

#: 122 Function Name: NtOpenProcess
Status: Hooked by "<unknown>" at address 0xba720e40

#: 128 Function Name: NtOpenThread
Status: Hooked by "<unknown>" at address 0xba720e45

#: 160 Function Name: NtQueryKey
Status: Hooked by "spec.sys" at address 0xb9ec610a

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "spec.sys" at address 0xb9ec5f8a

#: 193 Function Name: NtReplaceKey
Status: Hooked by "<unknown>" at address 0xba720e7c

#: 204 Function Name: NtRestoreKey
Status: Hooked by "<unknown>" at address 0xba720e77

#: 247 Function Name: NtSetValueKey
Status: Hooked by "<unknown>" at address 0xba720e68

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "<unknown>" at address 0xba720e4f

Stealth Objects
-------------------
Object: Hidden Code [Driver: Ntfs, IRP_MJ_CREATE]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLOSE]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_READ]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_WRITE]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_EA]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_EA]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_CLEANUP]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_SECURITY]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_SET_QUOTA]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Ntfs, IRP_MJ_PNP]
Process: System Address: 0x8a6211f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CREATE]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_CLOSE]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_READ]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_WRITE]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_POWER]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: Cdrom, IRP_MJ_PNP]
Process: System Address: 0x8a2f91f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_CREATE]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_CLOSE]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_READ]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_WRITE]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_POWER]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: dmio, IRP_MJ_PNP]
Process: System Address: 0x8a6931f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_CREATE]
Process: System Address: 0x8a1ff1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_CLOSE]
Process: System Address: 0x8a1ff1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a1ff1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a1ff1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_POWER]
Process: System Address: 0x8a1ff1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a1ff1f8 Size: 121

Object: Hidden Code [Driver: usbuhci, IRP_MJ_PNP]
Process: System Address: 0x8a1ff1f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CREATE]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_READ]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_WRITE]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_CLEANUP]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_POWER]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: Ftdisk, IRP_MJ_PNP]
Process: System Address: 0x8a6231f8 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_CREATE]
Process: System Address: 0x8a21f500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_CLOSE]
Process: System Address: 0x8a21f500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a21f500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a21f500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_CLEANUP]
Process: System Address: 0x8a21f500 Size: 121

Object: Hidden Code [Driver: NetBT, IRP_MJ_PNP]
Process: System Address: 0x8a21f500 Size: 121

Object: Hidden Code [Driver: akll30t2ࠅఊ祓譐LL蘨, IRP_MJ_CREATE]
Process: System Address: 0x8a2a0500 Size: 121

Object: Hidden Code [Driver: akll30t2ࠅఊ祓譐LL蘨, IRP_MJ_CLOSE]
Process: System Address: 0x8a2a0500 Size: 121

Object: Hidden Code [Driver: akll30t2ࠅఊ祓譐LL蘨, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a2a0500 Size: 121

Object: Hidden Code [Driver: akll30t2ࠅఊ祓譐LL蘨, IRP_MJ_POWER]
Process: System Address: 0x8a2a0500 Size: 121

Object: Hidden Code [Driver: akll30t2ࠅఊ祓譐LL蘨, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a2a0500 Size: 121

Object: Hidden Code [Driver: akll30t2ࠅఊ祓譐LL蘨, IRP_MJ_PNP]
Process: System Address: 0x8a2a0500 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_CREATE]
Process: System Address: 0x8a2f0500 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_CLOSE]
Process: System Address: 0x8a2f0500 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a2f0500 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a2f0500 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_POWER]
Process: System Address: 0x8a2f0500 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a2f0500 Size: 121

Object: Hidden Code [Driver: usbehci, IRP_MJ_PNP]
Process: System Address: 0x8a2f0500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_NAMED_PIPE]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLOSE]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_READ]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_WRITE]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_EA]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_EA]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FLUSH_BUFFERS]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_VOLUME_INFORMATION]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_INTERNAL_DEVICE_CONTROL]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CLEANUP]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_CREATE_MAILSLOT]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_SECURITY]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_SECURITY]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_POWER]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SYSTEM_CONTROL]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_DEVICE_CHANGE]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_QUERY_QUOTA]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_SET_QUOTA]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: MRxSmb, IRP_MJ_PNP]
Process: System Address: 0x8a20b500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_CREATE]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_CLOSE]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_READ]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_QUERY_INFORMATION]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_SET_INFORMATION]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_QUERY_VOLUME_INFORMATION]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_DIRECTORY_CONTROL]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_FILE_SYSTEM_CONTROL]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_DEVICE_CONTROL]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_SHUTDOWN]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_LOCK_CONTROL]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_CLEANUP]
Process: System Address: 0x8a13f500 Size: 121

Object: Hidden Code [Driver: CdfsЅఅ瑎獆찀ذ퇀ÿ, IRP_MJ_PNP]
Process: System Address: 0x8a13f500 Size: 121

==EOF==

burne 25.09.2009 19:42
und bei den Java Dateien wurde nichts gefunden!

Donthackme 26.09.2009 11:11
Zitat:
Zitat von burne (Beitrag 468347)
und bei den Java Dateien wurde nichts gefunden!
Gut:) Ich möchte gerne, dass du zur Sicherheit noch ein Scan mit Gmer Anti rootkit machst:
Bitte halte dich genau an die Anleitung.


Rootkit Scan

Einige Scans auf Dateien, Prozesse und Registryeinträge, die vor den meisten anderen Scannern versteckt werden (durch ein Rootkit). Während dieser Scans sollten:

* alle anderen Scanner gegen Viren, Spyware, usw deaktiviert sein
* keine Verbindung zu einem Netzwerk/Internet bestehen (WLAN nicht vergessen)
* nichts am Rechner getan werden

*Den log mit "Save" auf dein Desktop spreichern und in den Thread kopieren
* ROTE EINTRÄGE bitte gesondert in den Thread kopieren

burne 27.09.2009 12:32
habe GMER ausgeführt!

GMER 1.0.15.15087 - http://www.gmer.net
Rootkit quick scan 2009-09-27 13:30:23
Windows 5.1.2600 Service Pack 3
Running: nr6l3cqz.exe; Driver: C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\awnyqpog.sys


---- System - GMER 1.0.15 ----

SSDT spyh.sys ZwEnumerateKey [0xB9EC5CA4]
SSDT spyh.sys ZwEnumerateValueKey [0xB9EC6032]

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8A6931F8

---- EOF - GMER 1.0.15 ----


Vielen Dank für deine Hilfe!!


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:43 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19