myGully.com - Einzelnen Beitrag anzeigen - Net-Worm.Win32.Kido.ir und .ih hab ich den?wie kann ich die entfernen

Thema: Net-Worm.Win32.Kido.ir und .ih hab ich den?wie kann ich die entfernen

Einzelnen Beitrag anzeigen

21.07.13, 12:31	#1
Knusperbert Anfänger Registriert seit: Apr 2013 Beiträge: 27 Bedankt: 3	Net-Worm.Win32.Kido.ir und .ih hab ich den?wie kann ich die entfernen Hallo leute ich hab ein problem ich hab ein usb stick von nem kollegen und wir haben den in 2 rechnern reingesteckt.in meinem rechner zeigte er gleich Net-Worm.Win32.Kido.ir gefunden an.bei meinem vater der das gleiche viren programm drauf hat und akteuellere software hat,hat das programm das nicht angezeigt.. nun die frage hat mein rechner den virus jetzt auch? hab mir avz tool runtergeladen und füg das mal unten mal an den report bericht. villeicht kann mir ja einer was dazu sagen,ob ich den hab oder wie ich den entfernen kann? AVZ Antiviral Toolkit log; AVZ version is 4.41 Scanning started at 21.07.2013 13:04:31 Database loaded: signatures - 297614, NN profile(s) - 2, malware removal microprograms - 56, signature database released 12.07.2013 13:39 Heuristic microprograms loaded: 403 PVS microprograms loaded: 9 Digital signatures of system files loaded: 565706 Heuristic analyzer mode: Medium heuristics mode Malware removal mode: enabled Windows version is: 6.0.6002, Service Pack 2 ; AVZ is run with administrator rights System Restore: enabled 1. Searching for Rootkits and other software intercepting API functions 1.1 Searching for user-mode API hooks Analysis: kernel32.dll, export table found in section .text Analysis: ntdll.dll, export table found in section .text Analysis: user32.dll, export table found in section .text Analysis: advapi32.dll, export table found in section .text Analysis: ws2_32.dll, export table found in section .text Analysis: wininet.dll, export table found in section .text Analysis: rasapi32.dll, export table found in section .text Analysis: urlmon.dll, export table found in section .text Analysis: netapi32.dll, export table found in section .text 1.2 Searching for kernel-mode API hooks Driver loaded successfully SDT found (RVA=137B00) Kernel ntkrnlpa.exe found in memory at address 85A4B000 SDT = 85B82B00 KiST = 85AF76B4 (391) Function NtAdjustPrivilegesToken (0C) intercepted (85C3B682->95F466BA), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtAlpcConnectPort (15) intercepted (85C3589D->95EF9C02), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtAlpcCreatePort (16) intercepted (85C0599C->95EF9F4A), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtAlpcSendWaitReceivePort (26) intercepted (85C88B72->95EFA390), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtClose (30) intercepted (85C85EC8->95EE228C), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtConnectPort (36) intercepted (85C18B67->95EF98DC), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreateEvent (3A) intercepted (85C5DECE->95EE2804), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreateMutant (43) intercepted (85C6B9A3->95EE26EA), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreatePort (47) intercepted (85BD0A59->95EF9DAE), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreateSection (4B) intercepted (85C7CFA5->95F4952, hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreateSemaphore (4C) intercepted (85C22D5B->95EE2924), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreateSymbolicLinkObject (4D) intercepted (85C0B345->95F09EF0), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreateThread (4E) intercepted (85CDCE14->95F489BC), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreateWaitablePort (73) intercepted (85BC5D26->95EF9E7C), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtDebugActiveProcess (74) intercepted (85CAFF04->95F48506), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtDeviceIoControlFile (7F) intercepted (85C9367A->95EE22D0), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtDuplicateObject (81) intercepted (85C43581->95F467FC), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtLoadDriver (A5) intercepted (85BB6E12->95F46464), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtMapViewOfSection (B1) intercepted (85C5B99C->95F09F10), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtNotifyChangeKey (B5) intercepted (85C0A5F4->95EF806C), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtOpenEvent (B intercepted (85C44DFF->95EE289A), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtOpenMutant (BF) intercepted (85C5CC88->95EE277A), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtOpenProcess (C2) intercepted (85C6C13F->95F480AE), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtOpenSection (C5) intercepted (85C5C794->95F497D4), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtOpenSemaphore (C6) intercepted (85BF0F06->95EE29BA), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtOpenThread (C9) intercepted (85C6763B->95F4871, hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtPlugPlayControl (CD) intercepted (85BFB935->95F09F00), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtQueryDirectoryObject (DB) intercepted (85C5C855->95EE2A44), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtQueryObject (ED) intercepted (85C313D4->95EF827A), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtQueueApcThread (FF) intercepted (85BFC885->95F491D4), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtReplyPort (10E) intercepted (85C2C770->95EFA174), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtReplyWaitReceivePort (10F) intercepted (85C85060->95EFA002), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtReplyWaitReceivePortEx (110) intercepted (85C84F0F->95EFA0B, hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtRequestWaitReplyPort (114) intercepted (85C8F142->95EFA1E4), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtResumeThread (11A) intercepted (85C66C5A->95F48EFE), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtSecureConnectPort (11E) intercepted (85C18740->95EF9A6A), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtSetContextThread (121) intercepted (85CDE2AB->95F4905C), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtSetInformationToken (133) intercepted (85C10C84->95EE2AE6), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtSetSystemInformation (13D) intercepted (85C31F14->95F4656E), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtSuspendProcess (14A) intercepted (85CDE73B->95F4824E), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtSuspendThread (14B) intercepted (85BE5943->95F48DA6), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtSystemDebugControl (14C) intercepted (85C43EF1->95EE2AF, hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtTerminateProcess (14E) intercepted (85C3C173->95F483AE), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtTerminateThread (14F) intercepted (85C67670->95F488B, hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtUnmapViewOfSection (15C) intercepted (85C5BC5F->95F4993C), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtWriteVirtualMemory (166) intercepted (85C58A2F->95F49666), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreateThreadEx (17E) intercepted (85C67125->95F48BFC), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Function NtCreateUserProcess (17F) intercepted (85C14C43->95F48660), hook C:\Windows\system32\DRIVERS\klif.sys, driver recognized as trusted Functions checked: 391, intercepted: 48, restored: 0 1.3 Checking IDT and SYSENTER Analyzing CPU 1 Analyzing CPU 2 Checking IDT and SYSENTER - complete 1.4 Searching for masking processes and drivers Checking not performed: extended monitoring driver (AVZPM) is not installed 1.5 Checking IRP handlers Driver loaded successfully Checking - complete 2. Scanning RAM Number of processes found: 72 Number of modules loaded: 921 Scanning RAM - complete 3. Scanning disks Direct reading: C:\Users\Kevin\AppData\Local\Temp\~DF327B.tmp Direct reading: C:\Users\Kevin\AppData\Local\Temp\~DFCBBE.tmp Direct reading: C:\Users\Kevin\AppData\Local\Temp\~DFEADA.tmp 4. Checking Winsock Layered Service Provider (SPI/LSP) LSP settings checked. No errors detected 5. Searching for keyboard/mouse/windows events hooks (Keyloggers, Trojan DLLs) 6. Searching for opened TCP/UDP ports used by malicious software Checking - disabled by user 7. Heuristic system check >>> C:\PROGRA~1\DAP\DAPIE.DLL HSC: suspicion for Adware.SpeedBit >>> C:\PROGRA~1\DAP\DAPIE.DLL HSC: suspicion for Adware.SpeedBit Checking - complete 8. Searching for vulnerabilities >> Services: potentially dangerous service allowed: TermService (Terminaldienste) >> Services: potentially dangerous service allowed: SSDPSRV (SSDP-Suche) >> Services: potentially dangerous service allowed: Schedule (Aufgabenplanung) > Services: please bear in mind that the set of services depends on the use of the PC (home PC, office PC connected to corporate network, etc)! >> Security: disk drives' autorun is enabled >> Security: administrative shares (C$, D$ ...) are enabled >> Security: anonymous user access is enabled >> Security: sending Remote Assistant queries is enabled Checking - complete 9. Troubleshooting wizard Checking - complete Files scanned: 101080, extracted from archives: 64405, malicious software found 0, suspicions - 0 Scanning finished at 21.07.2013 13:25:48 Time of scanning: 00:21:19 If you have a suspicion on presence of viruses or questions on the suspected objects, you can address http://forum.kaspersky.com/index.php?showforum=19 For automatic scanning of files from the AVZ quarantine you can use the service http://virusdetector.ru/ __________________ danke im vorraus und schön grüße Knusper Rechtschreibfehler sind bestandteile meiner Tastatur.