Eine wirkliche Spezie... Trj/Nabload.DPS :(, Trojaner Nabload.DPS seit 1Woche hier am wuseln...werd ihn nicht los. Einstellungen

[belikewater]

Hallo,
vor ner Woche hab ich per panda security nen online scan durchgeführt da insgesamt 5mal nen account von mir auf einer der großen online communitys gesperrt war (...mit der begründung das dieser account gecrackt wurde!) , wobei nebst ein paar cookies auch der Nabload.DPS Trojaner gefunden wurde.
Panda konnte ihn nach dem auffinden nicht desinfizieren , woraufhin ich mich auf die Suche nach nem Tool hierfür gemachthabe-ohne Erfolg:(
Scheint ne wirkliche Spezie zu sein...mit unglaublichen Mimikry-Talent. (Norton wuselt so in seelenruhe auf meinem PC herum...schnaaarch!)
Der Räuber steckt jedenfalls (bisher?) in 2 combofix dateien :

1. c:\users\sic\downloads\combofix.exe[32788r22fwjfw\catchme.cfxxe]
2. c:\combofix\catchme.cfxxe

Hab die erste auch bei virustotal hochgeladen... das ergebnis von
catchme.cfxxs
http://www.virustotal.com/de/analisis/480a...72d0-1265836637

die zweite konnte ich nicht finden und somit nicht hochladen...denke aber,es wäre nix besseres bei rumgekommen.

Mittlerweile komm ich noch nichteinmal in den normalen modus.
windows fährt hoch aber bleibt nach der eingabe des konto-passworts stehen.
Funkenstille.


ich hab schon versucht per rootkit cleaner irgendwas zu erreichen-aber nicht bedacht das im abgesicherten modus sowas nicht funzt.

Mein Hijackthislog ist hier...


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:22:36, on 14.02.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18882)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\IPSBHO.DLL
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\coIEPlg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ7.0\ICQ.exe" silent loginmode=4
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra 'Tools' menuitem: &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.33.0\gears.dll
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Buyertools Reminder - {27914077-B4D6-4A0E-9763-76B6E9DD9A81} - C:\Program Files\Buyertools Reminder\ReminderIE.exe
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files\ICQ7.0\ICQ.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe (file missing)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/...can8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{56FB059E-49F3-4CFD-A117-DC47D0BC215F}: NameServer = 213.191.92.86 62.109.123.6
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: ADSM Service (ADSMService) - ASUSTek Computer Inc. - C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVM WLAN Connection Service - AVM Berlin - C:\Program Files\avmwlanstick\WlanNetService.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BroadCam Video Streaming Server (BroadCamService) - Unknown owner - C:\Program Files\NCH Software\BroadCam\broadcam.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: FsUsbExService - Teruten - C:\Windows\system32\FsUsbExService.Exe
O23 - Service: Google Update Service (gupdate1ca11d4c0f3da50) (gupdate1ca11d4c0f3da50) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\17.5.0.127\ccSvcHst.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Remote Procedure Call (RPC) Net (rpcnet) - Absolute Software Corp. - C:\Windows\system32\rpcnet.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

--
End of file - 7783 bytes

[belikewater]

okay letzter post meinerseits hier... wenn dann keine reaktion kommt, kann der post auch geschlossen werden.

hab gestern trotz fehler im update nochmal den avz scan laufen lassen.
mit dem gleichen ergebnis- nach mehr als 9std scan keine ende in sicht.

ich möcht an der stelle auch mal sagen, das die bechreibung auf dem trojaner board sehr schwammig is.
hatte letztes mal doch nichts falsch gemacht... dachte es nur .
sollte besser gekennzeichnet sein wann nen scan anfängt ... wenn schon oben drüber dick steht das man nicht auf scannen drücken soll...und während des scans nichts am rechner tun soll.
wenn man nämlich programme aufhat...und auch ne internetverbindung stehen hat während man die angeblichen vorarbeiten erledigt... aber dann auf execute script klickt (nich jeder weiß das es mit scannen gleichzusetzen ist!) dann hat man den schlamassel.

jedenfalls... hab ich dann auf stop geklickt weil es wie letztes mal (während der scan bei anwendungsdaten war) nicht weiterlief.
er hat so einiges gefunden und ich habe in voraussicht das mir hier e wieder keiner helfen wird die sachen in die quarantäne verschoben (keine lust auf nochmal 10std scan und am ende für umsonst).
der log is hier:

CODE

Attention !!! Database was last updated 21.08.2009 it is necessary to update the database (via File - Database update)
AVZ Antiviral Toolkit log; AVZ version is 4.32
Scanning started at 20.02.2010 04:17:32
Database loaded: signatures - 237871, NN profile(s) - 2, malware removal microprograms - 56, signature database released 21.08.2009 14:23
Heuristic microprograms loaded: 374
PVS microprograms loaded: 9
Digital signatures of system files loaded: 135524
Heuristic analyzer mode: Medium heuristics mode
Malware removal mode: enabled
Windows version is: 6.0.6002, Service Pack 2 ; AVZ is run with administrator rights
System Restore: enabled
1. Searching for Rootkits and other software intercepting API functions
1.1 Searching for user-mode API hooks
Analysis: kernel32.dll, export table found in section .text
Function kernel32.dll:CopyFileA (99) intercepted, method - APICodeHijack.JmpTo[10001B66]
>>> Rootkit code in function CopyFileA blocked
Function kernel32.dll:CopyFileExA (100) intercepted, method - APICodeHijack.JmpTo[10001BA6]
>>> Rootkit code in function CopyFileExA blocked
Function kernel32.dll:CopyFileExW (101) intercepted, method - APICodeHijack.JmpTo[10001BC6]
>>> Rootkit code in function CopyFileExW blocked
Function kernel32.dll:CopyFileW (104) intercepted, method - APICodeHijack.JmpTo[10001B86]
>>> Rootkit code in function CopyFileW blocked
Function kernel32.dll:CreateFileA (123) intercepted, method - APICodeHijack.JmpTo[10001B26]
>>> Rootkit code in function CreateFileA blocked
Function kernel32.dll:CreateFileW (130) intercepted, method - APICodeHijack.JmpTo[10001B46]
>>> Rootkit code in function CreateFileW blocked
Function kernel32.dll:CreateProcessA (151) intercepted, method - APICodeHijack.JmpTo[10001A46]
>>> Rootkit code in function CreateProcessA blocked
Function kernel32.dll:CreateProcessW (154) intercepted, method - APICodeHijack.JmpTo[10001A66]
>>> Rootkit code in function CreateProcessW blocked
Function kernel32.dll:DeleteFileA (195) intercepted, method - APICodeHijack.JmpTo[10001CA6]
>>> Rootkit code in function DeleteFileA blocked
Function kernel32.dll:DeleteFileW (198) intercepted, method - APICodeHijack.JmpTo[10001CC6]
>>> Rootkit code in function DeleteFileW blocked
Function kernel32.dll:GetModuleHandleA (505) intercepted, method - APICodeHijack.JmpTo[10001CE6]
>>> Rootkit code in function GetModuleHandleA blocked
Function kernel32.dll:GetModuleHandleW (508) intercepted, method - APICodeHijack.JmpTo[10001D06]
>>> Rootkit code in function GetModuleHandleW blocked
Function kernel32.dll:GetProcAddress (548) intercepted, method - APICodeHijack.JmpTo[10001A86]
>>> Rootkit code in function GetProcAddress blocked
Function kernel32.dll:LoadLibraryA (759) intercepted, method - APICodeHijack.JmpTo[10001D26]
>>> Rootkit code in function LoadLibraryA blocked
Function kernel32.dll:LoadLibraryExA (760) intercepted, method - APICodeHijack.JmpTo[10001AC6]
>>> Rootkit code in function LoadLibraryExA blocked
Function kernel32.dll:LoadLibraryExW (761) intercepted, method - APICodeHijack.JmpTo[10001AE6]
>>> Rootkit code in function LoadLibraryExW blocked
Function kernel32.dll:LoadLibraryW (762) intercepted, method - APICodeHijack.JmpTo[10001D46]
>>> Rootkit code in function LoadLibraryW blocked
Function kernel32.dll:LoadModule (763) intercepted, method - APICodeHijack.JmpTo[10001AA6]
>>> Rootkit code in function LoadModule blocked
Function kernel32.dll:MoveFileA (791) intercepted, method - APICodeHijack.JmpTo[10001BE6]
>>> Rootkit code in function MoveFileA blocked
Function kernel32.dll:MoveFileExA (792) intercepted, method - APICodeHijack.JmpTo[10001C26]
>>> Rootkit code in function MoveFileExA blocked
Function kernel32.dll:MoveFileExW (793) intercepted, method - APICodeHijack.JmpTo[10001C46]
>>> Rootkit code in function MoveFileExW blocked
Function kernel32.dll:MoveFileW (796) intercepted, method - APICodeHijack.JmpTo[10001C06]
>>> Rootkit code in function MoveFileW blocked
Function kernel32.dll:MoveFileWithProgressA (797) intercepted, method - APICodeHijack.JmpTo[10001C66]
>>> Rootkit code in function MoveFileWithProgressA blocked
Function kernel32.dll:MoveFileWithProgressW (798) intercepted, method - APICodeHijack.JmpTo[10001C86]
>>> Rootkit code in function MoveFileWithProgressW blocked
Function kernel32.dll:OpenFile (815) intercepted, method - APICodeHijack.JmpTo[10001B06]
>>> Rootkit code in function OpenFile blocked
Function kernel32.dll:WinExec (1159) intercepted, method - APICodeHijack.JmpTo[10001D66]
>>> Rootkit code in function WinExec blocked
Analysis: ntdll.dll, export table found in section .text
Function ntdll.dll:LdrGetProcedureAddress (115) intercepted, method - APICodeHijack.JmpTo[100019E6]
>>> Rootkit code in function LdrGetProcedureAddress blocked
Function ntdll.dll:LdrLoadDll (122) intercepted, method - APICodeHijack.JmpTo[10004546]
>>> Rootkit code in function LdrLoadDll blocked
Function ntdll.dll:LdrUnloadDll (144) intercepted, method - APICodeHijack.JmpTo[100081D6]
>>> Rootkit code in function LdrUnloadDll blocked
Function ntdll.dll:NtAllocateVirtualMemory (180) intercepted, method - APICodeHijack.JmpTo[10001946]
>>> Rootkit code in function NtAllocateVirtualMemory blocked
Function ntdll.dll:NtClose (212) intercepted, method - APICodeHijack.JmpTo[100082A6]
>>> Rootkit code in function NtClose blocked
Function ntdll.dll:NtCreateFile (228) intercepted, method - APICodeHijack.JmpTo[100018C6]
>>> Rootkit code in function NtCreateFile blocked
Function ntdll.dll:NtCreateProcess (241) intercepted, method - APICodeHijack.JmpTo[10001886]
>>> Rootkit code in function NtCreateProcess blocked
Function ntdll.dll:NtCreateUserProcess (254) intercepted, method - APICodeHijack.JmpTo[10007036]
>>> Rootkit code in function NtCreateUserProcess blocked
Function ntdll.dll:NtDeleteFile (264) intercepted, method - APICodeHijack.JmpTo[10001906]
>>> Rootkit code in function NtDeleteFile blocked
Function ntdll.dll:NtFreeVirtualMemory (290) intercepted, method - APICodeHijack.JmpTo[10001A26]
>>> Rootkit code in function NtFreeVirtualMemory blocked
Function ntdll.dll:NtLoadDriver (315) intercepted, method - APICodeHijack.JmpTo[10001966]
>>> Rootkit code in function NtLoadDriver blocked
Function ntdll.dll:NtOpenFile (338) intercepted, method - APICodeHijack.JmpTo[100018E6]
>>> Rootkit code in function NtOpenFile blocked
Function ntdll.dll:NtProtectVirtualMemory (372) intercepted, method - APICodeHijack.JmpTo[10001926]
>>> Rootkit code in function NtProtectVirtualMemory blocked
Function ntdll.dll:NtSetInformationProcess (489) intercepted, method - APICodeHijack.JmpTo[100019C6]
>>> Rootkit code in function NtSetInformationProcess blocked
Function ntdll.dll:NtUnloadDriver (532) intercepted, method - APICodeHijack.JmpTo[10001986]
>>> Rootkit code in function NtUnloadDriver blocked
Function ntdll.dll:NtWriteVirtualMemory (552) intercepted, method - APICodeHijack.JmpTo[100018A6]
>>> Rootkit code in function NtWriteVirtualMemory blocked
Function ntdll.dll:RtlAllocateHeap (597) intercepted, method - APICodeHijack.JmpTo[10001A06]
>>> Rootkit code in function RtlAllocateHeap blocked
Analysis: user32.dll, export table found in section .text
Function user32.dll:EndTask (2215) intercepted, method - APICodeHijack.JmpTo[10007E76]
>>> Rootkit code in function EndTask blocked
Analysis: advapi32.dll, export table found in section .text
Function advapi32.dll:CreateServiceA (126) intercepted, method - APICodeHijack.JmpTo[10000FF6]
>>> Rootkit code in function CreateServiceA blocked
Function advapi32.dll:CreateServiceW (127) intercepted, method - APICodeHijack.JmpTo[10001246]
>>> Rootkit code in function CreateServiceW blocked
Function advapi32.dll:OpenServiceA (501) intercepted, method - APICodeHijack.JmpTo[10001636]
>>> Rootkit code in function OpenServiceA blocked
Function advapi32.dll:OpenServiceW (502) intercepted, method - APICodeHijack.JmpTo[10001476]
>>> Rootkit code in function OpenServiceW blocked
Analysis: ws2_32.dll, export table found in section .text
Function ws2_32.dll:WSASocketA (99) intercepted, method - APICodeHijack.JmpTo[10001E66]
>>> Rootkit code in function WSASocketA blocked
Function ws2_32.dll:WSASocketW (100) intercepted, method - APICodeHijack.JmpTo[10001E86]
>>> Rootkit code in function WSASocketW blocked
Analysis: wininet.dll, export table found in section .text
Function wininet.dll:InternetConnectA (231) intercepted, method - APICodeHijack.JmpTo[10001E26]
>>> Rootkit code in function InternetConnectA blocked
Function wininet.dll:InternetConnectW (232) intercepted, method - APICodeHijack.JmpTo[10001E46]
>>> Rootkit code in function InternetConnectW blocked
Analysis: rasapi32.dll, export table found in section .text
Analysis: urlmon.dll, export table found in section .text
Function urlmon.dll:URLDownloadToCacheFileA (216) intercepted, method - APICodeHijack.JmpTo[10001EE6]
>>> Rootkit code in function URLDownloadToCacheFileA blocked
Function urlmon.dll:URLDownloadToCacheFileW (217) intercepted, method - APICodeHijack.JmpTo[10001F06]
>>> Rootkit code in function URLDownloadToCacheFileW blocked
Function urlmon.dll:URLDownloadToFileA (218) intercepted, method - APICodeHijack.JmpTo[10001EA6]
>>> Rootkit code in function URLDownloadToFileA blocked
Function urlmon.dll:URLDownloadToFileW (219) intercepted, method - APICodeHijack.JmpTo[10001EC6]
>>> Rootkit code in function URLDownloadToFileW blocked
Analysis: netapi32.dll, export table found in section .text
1.2 Searching for kernel-mode API hooks
Driver loaded successfully
SDT found (RVA=137B00)
Kernel ntkrnlpa.exe found in memory at address 81E04000
SDT = 81F3BB00
KiST = 81EB084C (391)
Function NtAdjustPrivilegesToken (0C) intercepted (81FF426F->90213F8E), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtAlpcConnectPort (15) intercepted (81FEE4B2->90214F5C), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtAlpcCreatePort (16) intercepted (81FBE91F->90214174), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtConnectPort (36) intercepted (81FD1AA7->902133FA), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateFile (3C) intercepted (82045D59->90213BF4), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreatePort (47) intercepted (81F89A40->902132DC), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSection (4B) intercepted (82035803->90213A82), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateSymbolicLinkObject (4D) intercepted (81FC4306->90214C16), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateThread (4E) intercepted (82095580->8A5F46EC), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtDuplicateObject (81) intercepted (81FFC16E->90212CD4), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtLoadDriver (A5) intercepted (81F6FDF0->90214898), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtMakeTemporaryObject (AE) intercepted (81FDB366->9021367E), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenFile (BA) intercepted (82009F9F->90213DD0), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenProcess (C2) intercepted (82024B58->8A5F46D8), hook not defined
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenSection (C5) intercepted (8201521F->9021390E), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtOpenThread (C9) intercepted (820200AA->90212B7C), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtRequestWaitReplyPort (114) intercepted (820479AE->902153C6), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtSecureConnectPort (11E) intercepted (81FD1680->90214634), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtSetSystemInformation (13D) intercepted (81FEAB16->90214A46), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtShutdownSystem (146) intercepted (820B6AA5->90213618), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtSystemDebugControl (14C) intercepted (81FFCADE->90213802), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateProcess (14E) intercepted (81FF4D60->902131A6), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtTerminateThread (14F) intercepted (820200DF->90213074), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Function NtCreateThreadEx (17E) intercepted (8201FB94->90214280), hook C:\Windows\System32\DRIVERS\cmdguard.sys
>>> Function restored successfully !
>>> Hook code blocked
Functions checked: 391, intercepted: 24, restored: 24
1.3 Checking IDT and SYSENTER
Analyzing CPU 1
Analyzing CPU 2
CmpCallCallBacks = 00000000
Checking IDT and SYSENTER - complete
1.4 Searching for masking processes and drivers
Checking not performed: extended monitoring driver (AVZPM) is not installed
Driver loaded successfully
1.5 Checking IRP handlers
Checking - complete
2. Scanning RAM
Number of processes found: 73
Number of modules loaded: 570
Scanning RAM - complete
3. Scanning disks
4. Checking Winsock Layered Service Provider (SPI/LSP)
LSP settings checked. No errors detected
5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs)
C:\Windows\system32\guard32.dll --> Suspicion for Keylogger or Trojan DLL
C:\Windows\system32\guard32.dll>>> Behaviour analysis
Behaviour typical for keyloggers was not detected
File quarantined succesfully (C:\Windows\system32\guard32.dll)
Note: Do NOT delete suspicious files, send them for analysis (see FAQ for more details), because there are lots of useful hooking DLLs
6. Searching for opened TCP/UDP ports used by malicious software
Checking - disabled by user
7. Heuristic system check
Checking - complete
8. Searching for vulnerabilities
Checking - complete
9. Troubleshooting wizard
Checking - complete
Files scanned: 1072589, extracted from archives: 174964, malicious software found 0, suspicions - 0
Scanning finished at 20.02.2010 13:20:37
!!! Attention !!! Restored 24 KiST functions during Anti-Rootkit operation
This may affect execution of certain software, so it is strongly recommended to reboot
Time of scanning: 09:03:08
If you have a suspicion on presence of viruses or questions on the suspected objects,
you can address http://virusinfo.info conference
Scanning - interrupted by user
File quarantined succesfully (C:\Windows\System32\DRIVERS\cmdguard.sys)

ein TEIL meiner probleme /auffälligkeiten ist hier:

sehr langsames hochfahren ( 2minuten trotz deaktivierung aller programme ausser comodo,adobe& avira)

kein (at) zeichen machen können...ausser ich schalte die firewall aus
nicht copy&taste vorgang machen können...ausser firewall wird ausgeschaltet
alle 2-3 tage vorkommnis das der mauszeiger nicht mehr kontrollierbar ist- (keine maus keine infrarot maus touchpad)
ccleaner auffälligkeiten auch nach neuinstallation --> sagt 290kb zu löschen... löscht dann aber 30mb zb ...oder anersrum sagt 30mb zu löschen aber löscht dann nur 3mb (firefox ist aus) oder 0kb zu löschen...analysierungsvorgang mehrmals ...dann auf einmal 2,3gb !!!!
als norton noch da war... probleme beim scan... normaler durchlauf max 90min ---- teilweise 5-6 std gescannt und kein ende in sicht
bleibt hängen
bekannte mit nen ich über messenger etc kontakt habe kriegen auch probleme mit ihren pcs (crashs)
prozesse aktivieren sich immer wieder selber (skypepm.exe ---- dies sogar komplett deinstalliert) ...

ALU.exe (updater von asus) ... kann ich abstellen etc ... kommt immer wieder.
comodo meldet auch das Alu immer auf irgendwas im internet zugreifen will
unzählig viele prozesse am laufen obwohl der pc garnich beansprucht wird...viele prozesse mind. doppelt bis zu 10 prozesse gleichen types (explorer , crss.exe, teilweise 15 svchost prozesse obwohl nur skype ,comodo&avira,firefox 1fenster/3abs, itunes auf)
langsames öffnen von firefox (entgegen benutzerkonto-keins dieser probleme!)


überall werbung... manchmal einfach als pop up und sehr auffällig weil verdeckt den bildschirm oder als mehr oder minder geschickt gesetzt ins seitenlayout (fällt trotzdem auf weil meist sehr simpel gestrickt...farbquali //wenn farbe//sehr blass...ansonsten viel blinkblink)
passwörter geklaut
curser springt beims schreiben immer in andere zeilen


danke im voraus.