Rootkit Agent gefunden

#1 Hi

habe vor ca 1 Stunde mal wieder ein Scan mit Mbam durchgeführt und dabei ein Rootkit Agent entdeckt.Anti Malware konnte diesen entfernen aber ich hab zur Sicherheit mal noch logs-->

Zitat

Malwarebytes' Anti-Malware 1.41
Datenbank Version: 3159
Windows 5.1.2600 Service Pack 3

13.11.2009 12:55:30
mbam-log-2009-11-13 (12-55-30).txt

Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 165869
Laufzeit: 21 minute(s), 57 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\System Volume Information\_restore{77A07AA0-5815-41A4-90C0-4C51220EA44C}\RP3\A0000387.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

Zitat

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:44:57, on 13.11.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Dokumente und Einstellungen\Administrator\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Programme\TechSmith\Snagit 9\SnagitIEAddin.dll
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} (get_atlcom Class) - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 4812 bytes

Zitat

GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-11-13 13:44:22
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.15 ----

SSDT B9ABFDEE ZwCreateKey
SSDT B9ABFDE4 ZwCreateThread
SSDT B9ABFDF3 ZwDeleteKey
SSDT B9ABFDFD ZwDeleteValueKey
SSDT B9ABFE02 ZwLoadKey
SSDT B9ABFDD0 ZwOpenProcess
SSDT B9ABFDD5 ZwOpenThread
SSDT B9ABFE0C ZwReplaceKey
SSDT B9ABFE07 ZwRestoreKey
SSDT B9ABFDF8 ZwSetValueKey
SSDT B9ABFDDF ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!_abnormal_termination + 235 804E2891 3 Bytes [FD, AB, B9]

---- User code sections - GMER 1.0.15 ----

.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] kernel32.dll!LoadResource 7C80A055 7 Bytes JMP 28001E30 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] kernel32.dll!FindResourceExW 7C80AD28 7 Bytes JMP 28001C70 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] kernel32.dll!FindResourceW 7C80BC6E 7 Bytes JMP 28001BF0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] kernel32.dll!SizeofResource 7C80BD09 7 Bytes JMP 28001EF0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] kernel32.dll!FindResourceA 7C80BF29 7 Bytes JMP 28001D00 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] kernel32.dll!LockResource 7C80CD37 5 Bytes JMP 28001F60 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] kernel32.dll!CreateEventA 7C8308B5 5 Bytes JMP 28001850 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] kernel32.dll!FindResourceExA 7C835FA8 7 Bytes JMP 28001D90 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] ADVAPI32.dll!CryptDeriveKey 77DB9FFD 7 Bytes JMP 28001000 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] ADVAPI32.dll!CryptDecrypt 77DBA129 7 Bytes JMP 28001060 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!GetWindowLongW 7E3688A6 7 Bytes JMP 28006AF0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!PeekMessageW 7E36929B 5 Bytes JMP 280046B0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!SetWindowPlacement 7E36DE46 5 Bytes JMP 28005E90 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!CreateDialogParamW 7E36EA3B 5 Bytes JMP 28006110 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!LoadImageW 7E377B97 5 Bytes JMP 28006760 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!CreateWindowExW 7E37D0A3 5 Bytes JMP 28003CE0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!SetWindowRgn 7E37E528 7 Bytes JMP 28005FD0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!LoadIconW 7E37E8BC 5 Bytes JMP 28006950 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 28006300 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] USER32.dll!TrackPopupMenuEx 7E3BCF62 5 Bytes JMP 28004F90 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] WS2_32.dll!closesocket 71A13E2B 5 Bytes JMP 2800B860 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] WS2_32.dll!send 71A14C27 5 Bytes JMP 2800B440 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] WS2_32.dll!WSARecv 71A14CB5 5 Bytes JMP 2800B220 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] WS2_32.dll!recv 71A1676F 5 Bytes JMP 2800B080 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] WS2_32.dll!WSASend 71A168FA 5 Bytes JMP 2800B620 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] SHELL32.dll!Shell_NotifyIconW 7E6DA5BF 5 Bytes JMP 28003430 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] ole32.dll!CoInitializeEx 774CEF7B 5 Bytes JMP 28002270 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] ole32.dll!CoCreateInstance 774D057E 5 Bytes JMP 28002610 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] ole32.dll!CoRegisterClassObject 774E7E90 5 Bytes JMP 28002370 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] WININET.dll!InternetReadFile 408C654B 5 Bytes JMP 2800A0E0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] WININET.dll!InternetCloseHandle 408C9088 5 Bytes JMP 2800A290 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] WININET.dll!HttpOpenRequestA 408CD508 5 Bytes JMP 28009F50 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)
.text C:\Programme\Windows Live\Messenger\msnmsgr.exe[1696] WININET.dll!HttpSendRequestA 408DEE89 5 Bytes JMP 2800A1C0 C:\Programme\Messenger Plus! Live\MsgPlusLive.dll (Messenger Plus! Live Add-On/Yuna Software)

---- EOF - GMER 1.0.15 ----

bitte mal genau anschauen.Danke!