Hallo Leute,
nachstehend ein Logfile, den mir das Rootkit-Programm GMER auf einer WinXP-SP2-Maschine ausgeworfen hat. Leider bin ich nicht imstande zu erkennen, welcher der markierten Einträge wirklich gefährlich ist, und welcher nicht. Kann mir das wer sagen?
Wolfgang Sohst
Hier der Log-Inhalt:
GMER 1.0.11.11384 - http://www.gmer.net
Rootkit 2007-01-15 12:59:22
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.11 ----
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwClose
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwCreateDirectoryObject
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwCreateFile
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwCreateKey
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwDeleteKey
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwEnumerateKey
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwEnumerateValueKey
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwFlushKey
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwMakeTemporaryObject
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwMapViewOfSection
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwOpenKey
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwOpenSection
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwQueryInformationFile
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwQueryKey
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwQueryValueKey
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwReadFile
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwSetInformationFile
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwSetInformationThread
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwSetValueKey
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwUnmapViewOfSection
SSDT \SystemRoot\System32\Drivers\Crypto.SYS ZwWriteFile
---- Devices - GMER 1.0.11 ----
Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE B0687C8A
Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE B06847C8
Device \FileSystem\Fastfat \Fat IRP_MJ_READ B068060A
Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE B0680AED
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION B068B958
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION B068E821
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA B069738A
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA B0696D49
Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS B0690BBE
Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION B0691331
Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION B069F4F4
Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL B0687B37
Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL B0683948
Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL B068D46B
Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN B069E79D
Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL B069DC4A
Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP B06842FD
Device \FileSystem\Fastfat \Fat IRP_MJ_PNP B069E1DB
Device \FileSystem\Fastfat \Fat FastIoCheckIfPossible B06991F9
---- Registry - GMER 1.0.11 ----
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x71 0x3B 0x04 0x66 ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0xFF 0x7C 0x85 0xE0 ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x3E 0x1E 0x9E 0xE0 ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xF5 0x1D 0x4D 0x73 ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x01 0x3A 0x48 0xFC ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0xF6 0x0F 0x4E 0x58 ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0xB1 0xCD 0x45 0x5A ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0xE3 0x0E 0x66 0xD5 ...
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL
Reg \Registry\MACHINE\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F ...
---- Files - GMER 1.0.11 ----
ADS C:\Dokumente und Einstellungen\Wolfgang Sohst\Favoriten\20th WCP Ontology.url:favicon
ADS C:\Dokumente und Einstellungen\Wolfgang Sohst\Favoriten\Berliner Volksbank - Online-Banking.url:favicon
ADS ...
---- EOF - GMER 1.0.11 ----
