Infizierte php geöffnet kann einer sich das mal anschauen xD

___ __ _
+ /- / | ____ __ __/ /_ (_)____ -\ +
/s h- / /| | / __ \/ / / / __ \/ / ___/ -h s\
oh-:d/ / ___ |/ / / / /_/ / /_/ / (__ ) /d:-ho
shh+hy- /_/ |_/_/ /_/\__,_/_.___/_/____/ -yh+hhs
-:+hhdhyys/- -\syyhdhh+:-
-//////dhhhhhddhhyss- Analysis Report -ssyhhddhhhhhd\\\\\\-
/++/////oydddddhhyys/ ooooooooooooooooooooo \syyhhdddddyo\\\\\++\
-+++///////odh/- -+hdo\\\\\\\+++-
+++++++++//yy+/: :\+yy\\+++++++++
/+soss+sys//yyo/os++o+: :+o++so\oyy\\sys+ssos+\
+oyyyys++o/+yss/+/oyyyy: :yyyyo\+\ssy+\o++syyyyo+
+oyyyyyyso+os/o/+yyyyyy/ \yyyyyy+\o\so+osyyyyyyo+


[#############################################################################]
Analysis Report for http://vide0portal.com/news/index.php
[#############################################################################]

Summary:
- Changes security settings of Internet Explorer:
This system alteration could seriously affect safety surfing the World
Wide Web.

- Performs File Modification and Destruction:
The executable modifiesand destructs files which are not temporary.

- Performs Registry Activities:
The executable reads and modifies registry values. It also creates and
monitors registry keys.

[=============================================================================]
Table of Contents
[=============================================================================]

- General information
- iexplore.exe
a) Registry Activities
b) File Activities
c) Process Activities
d) Network Activities
e) Other Activities


[#############################################################################]
1. General Information
[#############################################################################]
[=============================================================================]
Information about Anubis' invocation
[=============================================================================]
Time needed: 241 s
Report created: 12/30/08, 21:21:51 UTC
Termination reason: Timeout
Program version: 1.67.0

[=============================================================================]
Global Network Activities
[=============================================================================]
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
Unknown UDP Traffic:
[=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=]
From ANUBIS:1026 to 192.168.0.1:53
State: [ Normal establishment and termination ],
Outbound Bytes: [ 33 ], Inbound Bytes: [ 128 ]



[#############################################################################]
2. iexplore.exe
[#############################################################################]
[=============================================================================]
General information about this executable
[===]
Analysis Reason: Primary Analysis Subject
Filename: iexplore.exe
Command Line: "C:\Programme\Internet Explorer\iexplore.exe" http://vide0portal.com/news/index.php
Process-status
at analysis end: alive
Exit Code: 0

[===]
Load-time Dlls
[===]
Module Name: [ C:\WINDOWS\System32\ntdll.dll ],
Base Address: [0x77F40000 ], Size: [0x000B0000 ]
Module Name: [ C:\WINDOWS\system32\kernel32.dll ],
Base Address: [0x77E40000 ], Size: [0x000F7000 ]
Module Name: [ C:\WINDOWS\system32\msvcrt.dll ],
Base Address: [0x77BE0000 ], Size: [0x00053000 ]
Module Name: [ C:\WINDOWS\system32\USER32.dll ],
Base Address: [0x77D10000 ], Size: [0x0008D000 ]
Module Name: [ C:\WINDOWS\system32\GDI32.dll ],
Base Address: [0x77C40000 ], Size: [0x00040000 ]
Module Name: [ C:\WINDOWS\system32\ADVAPI32.dll ],
Base Address: [0x77DA0000 ], Size: [0x0009A000 ]
Module Name: [ C:\WINDOWS\system32\RPCRT4.dll ],
Base Address: [0x77C90000 ], Size: [0x00075000 ]
Module Name: [ C:\WINDOWS\system32\SHLWAPI.dll ],
Base Address: [0x772A0000 ], Size: [0x00063000 ]
Module Name: [ C:\WINDOWS\System32\SHDOCVW.dll ],
Base Address: [0x76970000 ], Size: [0x00149000 ]
Module Name: [ C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll ],
Base Address: [0x71950000 ], Size: [0x000E4000 ]

[===]
Run-time Dlls
[===]
Module Name: [ C:\WINDOWS\System32\wsock32.dll ],
Base Address: [0x00C40000 ], Size: [0x00009000 ]
Module Name: [ C:\WINDOWS\System32\WS2_32.dll ],
Base Address: [0x00C50000 ], Size: [0x00015000 ]
Module Name: [ C:\WINDOWS\System32\WS2HELP.dll ],
Base Address: [0x00C70000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\System32\wshtcpip.dll ],
Base Address: [0x00C80000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\system32\mswsock.dll ],
Base Address: [0x00EA0000 ], Size: [0x0003C000 ]
Module Name: [ C:\WINDOWS\System32\UxTheme.dll ],
Base Address: [0x5B0F0000 ], Size: [0x00034000 ]
Module Name: [ C:\Programme\Java\jre1.6.0_07\bin\ssv.dll ],
Base Address: [0x6D7C0000 ], Size: [0x0007B000 ]
Module Name: [ C:\WINDOWS\System32\NETAPI32.dll ],
Base Address: [0x71BA0000 ], Size: [0x0004F000 ]
Module Name: [ C:\WINDOWS\System32\sensapi.dll ],
Base Address: [0x72240000 ], Size: [0x00005000 ]
Module Name: [ C:\WINDOWS\System32\browselc.dll ],
Base Address: [0x723C0000 ], Size: [0x00013000 ]
Module Name: [ C:\WINDOWS\System32\MSLS31.DLL ],
Base Address: [0x74640000 ], Size: [0x00027000 ]
Module Name: [ C:\WINDOWS\System32\msimtf.dll ],
Base Address: [0x74670000 ], Size: [0x00029000 ]
Module Name: [ C:\WINDOWS\System32\MSCTF.dll ],
Base Address: [0x746A0000 ], Size: [0x0004B000 ]
Module Name: [ C:\WINDOWS\System32\mlang.dll ],
Base Address: [0x746F0000 ], Size: [0x0008F000 ]
Module Name: [ C:\WINDOWS\System32\mshtml.dll ],
Base Address: [0x74790000 ], Size: [0x002AD000 ]
Module Name: [ C:\WINDOWS\system32\USERENV.dll ],
Base Address: [0x75A10000 ], Size: [0x000A5000 ]
Module Name: [ C:\WINDOWS\System32\jscript.dll ],
Base Address: [0x75BF0000 ], Size: [0x00091000 ]
Module Name: [ C:\WINDOWS\System32\SXS.DLL ],
Base Address: [0x75E30000 ], Size: [0x000A2000 ]
Module Name: [ C:\WINDOWS\system32\appHelp.dll ],
Base Address: [0x75EE0000 ], Size: [0x0001D000 ]
Module Name: [ C:\WINDOWS\System32\BROWSEUI.dll ],
Base Address: [0x75F20000 ], Size: [0x000FC000 ]
Module Name: [ C:\WINDOWS\system32\urlmon.dll ],
Base Address: [0x76090000 ], Size: [0x00078000 ]
Module Name: [ C:\WINDOWS\System32\shdoclc.dll ],
Base Address: [0x76110000 ], Size: [0x0008E000 ]
Module Name: [ C:\WINDOWS\system32\WININET.dll ],
Base Address: [0x761A0000 ], Size: [0x00098000 ]
Module Name: [ C:\WINDOWS\system32\MSASN1.dll ],
Base Address: [0x76240000 ], Size: [0x0000F000 ]
Module Name: [ C:\WINDOWS\system32\CRYPT32.dll ],
Base Address: [0x76260000 ], Size: [0x0008B000 ]
Module Name: [ C:\WINDOWS\System32\IMM32.DLL ],
Base Address: [0x76330000 ], Size: [0x0001A000 ]
Module Name: [ C:\WINDOWS\System32\CSCDLL.dll ],
Base Address: [0x765A0000 ], Size: [0x0001B000 ]
Module Name: [ C:\WINDOWS\System32\cscui.dll ],
Base Address: [0x765C0000 ], Size: [0x00050000 ]
Module Name: [ C:\WINDOWS\System32\SETUPAPI.dll ],
Base Address: [0x76620000 ], Size: [0x000E5000 ]
Module Name: [ C:\WINDOWS\System32\shfolder.dll ],
Base Address: [0x76730000 ], Size: [0x00008000 ]
Module Name: [ C:\WINDOWS\System32\WINMM.dll ],
Base Address: [0x76AF0000 ], Size: [0x0002D000 ]
Module Name: [ C:\WINDOWS\System32\rtutils.dll ],
Base Address: [0x76E40000 ], Size: [0x0000D000 ]
Module Name: [ C:\WINDOWS\System32\rasman.dll ],
Base Address: [0x76E50000 ], Size: [0x00011000 ]
Module Name: [ C:\WINDOWS\System32\TAPI32.dll ],
Base Address: [0x76E70000 ], Size: [0x0002A000 ]
Module Name: [ C:\WINDOWS\System32\RASAPI32.DLL ],
Base Address: [0x76EA0000 ], Size: [0x00037000 ]
Module Name: [ C:\WINDOWS\System32\DNSAPI.dll ],
Base Address: [0x76EE0000 ], Size: [0x00025000 ]
Module Name: [ C:\WINDOWS\system32\WLDAP32.dll ],
Base Address: [0x76F20000 ], Size: [0x0002D000 ]
Module Name: [ C:\WINDOWS\System32\Secur32.dll ],
Base Address: [0x76F50000 ], Size: [0x00010000 ]
Module Name: [ C:\WINDOWS\System32\winrnr.dll ],
Base Address: [0x76F70000 ], Size: [0x00007000 ]
Module Name: [ C:\WINDOWS\System32\rasadhlp.dll ],
Base Address: [0x76F80000 ], Size: [0x00005000 ]
Module Name: [ C:\WINDOWS\System32\CLBCATQ.DLL ],
Base Address: [0x76F90000 ], Size: [0x00078000 ]
Module Name: [ C:\WINDOWS\System32\COMRes.dll ],
Base Address: [0x77010000 ], Size: [0x000D3000 ]
Module Name: [ C:\WINDOWS\system32\OLEAUT32.dll ],
Base Address: [0x770F0000 ], Size: [0x0008B000 ]
Module Name: [ C:\WINDOWS\system32\ole32.dll ],
Base Address: [0x77180000 ], Size: [0x0011A000 ]
Module Name: [ C:\WINDOWS\system32\comctl32.dll ],
Base Address: [0x77310000 ], Size: [0x0008B000 ]
Module Name: [ C:\WINDOWS\system32\SHELL32.dll ],
Base Address: [0x773A0000 ], Size: [0x007FE000 ]
Module Name: [ C:\WINDOWS\system32\VERSION.dll ],
Base Address: [0x77BD0000 ], Size: [0x00007000 ]
Module Name: [ C:\Programme\Java\jre1.6.0_07\bin\MSVCR71.dll ],
Base Address: [0x7C340000 ], Size: [0x00056000 ]

[===]
2.a) iexplore.exe - Registry Activities
[===]
[=-=]
Registry Values Read:
[=-=]
Key: [ HKLM\SYSTEM\CurrentControlSet\Control\Session Manager ],
Value Name: [ CriticalSectionTimeout ], Value: [ 2592000 ], 1 time
Key: [ HKLM\SYSTEM\CurrentControlSet\Services\Winsock\Parameters ],
Value Name: [ Transports ], Value: [ 0x5400630070006900700000004e0065007400420049004f00530000000000 ], 2 times
Key: [ HKLM\SYSTEM\Setup ],
Value Name: [ OsLoaderPath ], Value: [ \ ], 2 times
Key: [ HKLM\SYSTEM\Setup ],
Value Name: [ SystemPartition ], Value: [ \Device\HarddiskVolume1 ], 2 times
Key: [ HKLM\Software\Microsoft\Internet Explorer\URL Compatibility\~/CONNWIZ.HTM ],
Value Name: [ Compatibility Flags ], Value: [ 4 ], 1 time
Key: [ HKLM\Software\Microsoft\Internet Explorer\URL Compatibility\~/CWIZINTR.HTM ],
Value Name: [ Compatibility Flags ], Value: [ 4 ], 1 time
Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion ],
Value Name: [ DevicePath ], Value: [ %SystemRoot%\inf ], 1 time
Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\ICWCONN1.EXE ],
Value Name: [ Path ], Value: [ C:\Programme\Internet Explorer\Connection Wizard; ], 1 time
Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Setup ],
Value Name: [ DriverCachePath ], Value: [ %SystemRoot%\Driver Cache ], 2 times
Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Setup ],
Value Name: [ ServicePackSourcePath ], Value: [ D:\ ], 2 times
Key: [ HKLM\Software\Microsoft\Windows\CurrentVersion\Setup ],
Value Name: [ SourcePath ], Value: [ D:\ ], 2 times
Key: [ HKLM\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm ],
Value Name: [ wheel ], Value: [ 1 ], 1 time
Key: [ HKLM\System\CurrentControlSet\Control\ProductOptions ],
Value Name: [ ProductType ], Value: [ WinNT ], 1 time
Key: [ HKLM\System\CurrentControlSet\Control\Session Manager\WPA\PnP ],
Value Name: [ seed ], Value: [ 3051945280 ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\LDAP ],
Value Name: [ LdapClientIntegrity ], Value: [ 1 ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters ],
Value Name: [ UseDomainNameDevolution ], Value: [ 1 ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
Value Name: [ HelperDllName ], Value: [ %SystemRoot%\System32\wshtcpip.dll ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
Value Name: [ Mapping ], Value: [ 0x0b0000000300000002000000010000000600000002000000010000000000 ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
Value Name: [ MaxSockaddrLength ], Value: [ 16 ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
Value Name: [ MinSockaddrLength ], Value: [ 16 ], 1 time
Key: [ HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Winsock ],
Value Name: [ UseDelayedAcceptance ], Value: [ 0 ], 1 time
Key: [ HKU\S-1-5-21-1343024091-1292428093-1606980848-500\Keyboard Layout\Toggle ],
Value Name: [ Language Hotkey ], Value: [ 1 ], 2 times
Key: [ HKU\S-1-5-21-1343024091-1292428093-1606980848-500\Keyboard Layout\Toggle ],
Value Name: [ Layout Hotkey ], Value: [ 2 ], 2 times
Key: [ HKU\S-1-5-21-1343024091-1292428093-1606980848-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
Value Name: [ Local Settings ], Value: [ %USERPROFILE%\Lokale Einstellungen ], 1 time
Key: [ HKU\S-1-5-21-1343024091-1292428093-1606980848-500\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders ],
Value Name: [ Personal ], Value: [ %USERPROFILE%\Eigene Dateien ], 1 time


[===]
2.b) iexplore.exe - File Activities
[===]
[=-=]
Files Created:
[=-=]
File Name: [ C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CHT2SY0U\index[1].htm ]

[=-=]
Files Read:
[=-=]
File Name: [ PIPE\svcctl ]

[=-=]
Files Modified:
[=-=]
File Name: [ C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CHT2SY0U\index[1].htm ]
File Name: [ PIPE\svcctl ]
File Name: [ \Device\Afd\Endpoint ]

[=-=]
Device Control Communication:
[=-=]
File: [ \Device\KsecDD ], Control Code: [ 0x00390008 ], 8 times
[=-=]
Memory Mapped Files:
[=-=]
File Name: [ C:\Programme\Java\jre1.6.0_07\bin\MSVCR71.dll ]
File Name: [ C:\Programme\Java\jre1.6.0_07\bin\ssv.dll ]
File Name: [ C:\WINDOWS\System32\BROWSEUI.dll ]
File Name: [ C:\WINDOWS\System32\CLBCATQ.DLL ]
File Name: [ C:\WINDOWS\System32\COMRes.dll ]
File Name: [ C:\WINDOWS\System32\CSCDLL.dll ]
File Name: [ C:\WINDOWS\System32\DNSAPI.dll ]
File Name: [ C:\WINDOWS\System32\IMM32.DLL ]
File Name: [ C:\WINDOWS\System32\MSCTF.dll ]
File Name: [ C:\WINDOWS\System32\MSLS31.DLL ]
File Name: [ C:\WINDOWS\System32\NETAPI32.dll ]
File Name: [ C:\WINDOWS\System32\RASAPI32.DLL ]
File Name: [ C:\WINDOWS\System32\SETUPAPI.dll ]
File Name: [ C:\WINDOWS\System32\SXS.DLL ]
File Name: [ C:\WINDOWS\System32\Secur32.dll ]
File Name: [ C:\WINDOWS\System32\TAPI32.dll ]
File Name: [ C:\WINDOWS\System32\UxTheme.dll ]
File Name: [ C:\WINDOWS\System32\WINMM.dll ]
File Name: [ C:\WINDOWS\System32\WS2HELP.dll ]
File Name: [ C:\WINDOWS\System32\WS2_32.dll ]
File Name: [ C:\WINDOWS\System32\browselc.dll ]
File Name: [ C:\WINDOWS\System32\cscui.dll ]
File Name: [ C:\WINDOWS\System32\jscript.dll ]
File Name: [ C:\WINDOWS\System32\mlang.dll ]
File Name: [ C:\WINDOWS\System32\msimtf.dll ]
File Name: [ C:\WINDOWS\System32\rasadhlp.dll ]
File Name: [ C:\WINDOWS\System32\rasman.dll ]
File Name: [ C:\WINDOWS\System32\rtutils.dll ]
File Name: [ C:\WINDOWS\System32\sensapi.dll ]
File Name: [ C:\WINDOWS\System32\shdoclc.dll ]
File Name: [ C:\WINDOWS\System32\shfolder.dll ]
File Name: [ C:\WINDOWS\System32\winrnr.dll ]
File Name: [ C:\WINDOWS\System32\wshtcpip.dll ]
File Name: [ C:\WINDOWS\System32\wsock32.dll ]
File Name: [ C:\WINDOWS\system32\WININET.dll ]
File Name: [ C:\WINDOWS\system32\mswsock.dll ]
File Name: [ C:\WINDOWS\system32\urlmon.dll ]

[===]
2.c) iexplore.exe - Process Activities
[===]
[=-=]
Thread Overview:
[=-=]
After 125 seconds, Number of threads: 1


[===]
2.d) iexplore.exe - Network Activities
[===]
[=-=]
DNS Queries:
[=-=]
Name: [ vide0portal.com ], Query Type: [ DNS_TYPE_A ],
Query Result: [ 58.241.255.34 ], Successful: [ 1 ], Protocol: [ ]

[=-=]
HTTP Conversations:
[=-=]
From ANUBIS:1034 to 58.241.255.34:80 - [ vide0portal.com ]
Request: [ GET /news/index.php ], Response: [ 200 "OK" ]
[=-]
2.e) iexplore.exe - Other Activities
[=-=]
Mutexes Created:
[=-=]
Mutex: [ MSCTF.Shared.MUTEX.AFF ]
Mutex: [ MSCTF.TimListMUTEX. ]
Mutex: [ MSUIM.Assembly.Mutex ]
Mutex: [ MSUIM.GlobalCompartment.Mutex ]
Mutex: [ MSUIM.GlobalLangBarEventSink.Mutex ]
Mutex: [ MSUIM.Layouts.Mutex ]
Mutex: [ MSUIM.MarshalInterfaceMutex.TMD ]
Mutex: [ ZonesCacheCounterMutex ]
Mutex: [ ZonesCounterMutex ]
[=-=]
Keyboard Keys Monitored:
[=-=]
Virtual Key Code: [ VK_CONTROL (17) ], 18 times
Virtual Key Code: [ VK_ESCAPE (27) ], 22 times
Virtual Key Code: [ VK_SHIFT (16) ], 17 times
Virtual Key Code: [ VK_MENU (18) ], 17 times
Virtual Key Code: [ VK_LSHIFT (160) ], 12 times
Virtual Key Code: [ VK_LCONTROL (162) ], 12 times
Virtual Key Code: [ VK_LMENU (164) ], 12 times
Virtual Key Code: [ VK_LBUTTON (1) ], 64 times
Virtual Key Code: [ VK_RBUTTON (2) ], 5 times
Virtual Key Code: [ VK_MBUTTON (4) ], 5 times