| |
| |||||||
Log-Analyse und Auswertung: Vermute ein guter Trojaner hat mich erwicht !!!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
21.03.2007, 23:51
| #1 |
| |  Vermute ein guter Trojaner hat mich erwicht !!! Hallo , Also hab die da ein Kostenloses Programm Runtergeladen (7MB) , hab es geöffnet. Die EXE verschwand, ich vermute einen Trojaner , ich hab die EXE nochmal entpackt und geöffnet und er schreibt mir. Das gleiche habe ich auch beim vmware. ich vermute es wird ein rootkit verwendet. Ich bitte um hilfe , << Themida A monitor programm has been found running in your system. Please, unload it from memory and restart your programm. >> Virustotal Daten: Webwasher-Gateway 6.0.1 03.21.2007 Heuristic.Crypted Sunbelt 2.2.907.0 03.16.2007 VIPRE.Suspicious Ikarus T3.1.1.3 03.21.2007 Backdoor.VB.EV Fortinet 2.85.0.0 03.21.2007 suspicious AntiVir 7.3.1.44 03.21.2007 HEUR/Crypted Das andere alle No virus found. Aditional Information File size: 1209856 bytes MD5: 590062d0b2bb7876a227ea683e1d5631 SHA1: 078f0c1ede77371a32bbe7dc155f84df951eec2f packers: Themida Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics. Ich kenn mich schon was aus , aber irgendwie finde ich keine Spuren in der Datenbank von Windows(regedit) , ich versuche sogar mit regmon zu prüfen wo er sich hin installiert hat und was er an der datenbank für änderung unternommen hat. Logfile of HijackThis v1.99.1 Scan saved at 23:41:53, on 21.03.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16414) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\Alwil Software\Avast4\aswUpdSv.exe C:\Programme\Alwil Software\Avast4\ashServ.exe C:\Programme\Alwil Software\Avast4\ashMaiSv.exe C:\Programme\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\SOUNDMAN.EXE C:\Programme\Alwil Software\Avast4\ashDisp.exe C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Logitech\G-series Software\LCDMon.exe C:\Programme\Logitech\LCD-Status\LCD-Status.exe C:\Programme\Logitech\SetPoint\SetPoint.exe C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE C:\WINDOWS\system32\svchost.exe C:\Programme\VMware\VMware Workstation\vmware.exe C:\Programme\VMware\VMware Workstation\bin\vmware-vmx.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Mozilla Firefox\firefox.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\MSN Messenger\msnmsgr.exe C:\Eigene Dateien 2\Apps - Diagnose\hijackthis\HijackThis.exe C:\Eigene Dateien 2\Apps - Diagnose\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://de.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de  fficialR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Blade Explorer O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [avast!] "C:\Programme\Alwil Software\Avast4\ashDisp.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Logitech G-series LCD Monitor] C:\Programme\Logitech\G-series Software\LCDMon.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{948432B7-26A9-4E6F-8B70-71B1AEE66A98}: NameServer = 195.50.140.250 195.50.140.114 O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\MSOXMLMF.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\ O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programme\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programme\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Programme\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
|
21.03.2007, 23:58
| #2 |
| | Vermute ein guter Trojaner hat mich erwicht !!! log regmon
__________________1 1.91349208 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IDoser.exe NOT FOUND 2 2.06334949 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll NOT FOUND 3 2.06346011 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll NOT FOUND 4 2.06457472 IDoser.exe:1064 OpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS Access: 0x20019 5 2.06467628 IDoser.exe:1064 QueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LeakTrack NOT FOUND 6 2.06476498 IDoser.exe:1064 CloseKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon SUCCESS 7 2.06489539 IDoser.exe:1064 OpenKey HKLM SUCCESS Access: 0x2000000 8 2.06579590 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics NOT FOUND 9 2.06587029 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll NOT FOUND 10 2.07412219 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32 SUCCESS Access: 0x20019 11 2.07437849 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32\IDoser NOT FOUND 12 2.07456970 IDoser.exe:1064 CloseKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32 SUCCESS 13 2.07482004 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility SUCCESS Access: 0x20019 14 2.07491612 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility\IDoser NOT FOUND 15 2.07505369 IDoser.exe:1064 CloseKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility SUCCESS 16 2.07659936 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows SUCCESS Access: 0x20019 17 2.07662535 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SUCCESS "" 18 2.07696724 IDoser.exe:1064 CloseKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows SUCCESS 19 2.07888889 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll NOT FOUND 20 2.07900953 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMCTL32.dll NOT FOUND 21 2.08104682 IDoser.exe:1064 OpenKey HKCU SUCCESS Access: 0x20019 22 2.08141279 IDoser.exe:1064 OpenKey HKCU\Control Panel\Desktop SUCCESS Access: 0x20019 23 2.08143687 IDoser.exe:1064 QueryValue HKCU\Control Panel\Desktop\SmoothScroll NOT FOUND 24 2.08145761 IDoser.exe:1064 CloseKey HKCU\Control Panel\Desktop SUCCESS 25 2.08351541 IDoser.exe:1064 CloseKey HKCU SUCCESS 26 2.08518815 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll NOT FOUND 27 2.08533430 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll NOT FOUND 28 2.22009373 IDoser.exe:1064 OpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS Access: 0x1 29 2.22012210 IDoser.exe:1064 QueryValue HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled SUCCESS 0x1 30 2.22055960 IDoser.exe:1064 CloseKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers SUCCESS 31 2.22152519 IDoser.exe:1064 OpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers NOT FOUND 32 2.22184968 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmm.dll NOT FOUND 33 2.22193217 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32 SUCCESS Access: 0x80000000 34 2.22207689 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave SUCCESS "wdmaud.drv" 35 2.22297812 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave SUCCESS "wdmaud.drv" 36 2.22310877 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave1 NOT FOUND 37 2.22313023 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave2 NOT FOUND 38 2.22333121 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave3 NOT FOUND 39 2.22481012 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave4 NOT FOUND 40 2.22483706 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave5 NOT FOUND 41 2.22485709 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave6 NOT FOUND 42 2.22501159 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave7 NOT FOUND 43 2.22627425 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave8 NOT FOUND 44 2.22630262 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\wave9 NOT FOUND 45 2.22632599 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi SUCCESS "wdmaud.drv" 46 2.22651863 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi SUCCESS "wdmaud.drv" 47 2.22664499 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi1 NOT FOUND 48 2.22666740 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi2 NOT FOUND 49 2.22668719 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi3 NOT FOUND 50 2.22684121 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi4 NOT FOUND 51 2.22693324 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi5 NOT FOUND 52 2.22695541 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi6 NOT FOUND 53 2.22697520 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi7 NOT FOUND 54 2.22713590 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi8 NOT FOUND 55 2.22723842 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\midi9 NOT FOUND 56 2.22735476 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux SUCCESS "wdmaud.drv" 57 2.22737718 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux SUCCESS "wdmaud.drv" 58 2.22770596 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux1 NOT FOUND 59 2.22786450 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux2 NOT FOUND 60 2.22788620 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux3 NOT FOUND 61 2.22790504 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux4 NOT FOUND 62 2.22808456 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux5 NOT FOUND 63 2.22820044 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux6 NOT FOUND 64 2.22822070 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux7 NOT FOUND 65 2.22823954 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux8 NOT FOUND 66 2.22837043 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\aux9 NOT FOUND 67 2.22882247 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer SUCCESS "wdmaud.drv" 68 2.22896385 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer SUCCESS "wdmaud.drv" 69 2.22898626 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer1 NOT FOUND 70 2.22919726 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer2 NOT FOUND 71 2.22929335 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer3 NOT FOUND 72 2.22931576 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer4 NOT FOUND 73 2.22933555 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer5 NOT FOUND 74 2.22948766 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer6 NOT FOUND 75 2.22960043 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer7 NOT FOUND 76 2.22962284 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer8 NOT FOUND 77 2.22964239 IDoser.exe:1064 QueryValue HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32\mixer9 NOT FOUND 78 2.30367994 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll NOT FOUND 79 2.36828303 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll NOT FOUND 80 2.38364792 IDoser.exe:1064 OpenKey HKLM\SOFTWARE\Microsoft\CTF\Compatibility\IDoser.exe NOT FOUND 81 2.38470244 IDoser.exe:1064 OpenKey HKCU SUCCESS Access: 0x2000000 82 2.38515067 IDoser.exe:1064 OpenKey HKCU\Keyboard Layout\Toggle SUCCESS Access: 0x20019 83 2.38519359 IDoser.exe:1064 QueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS "1" 84 2.38521099 IDoser.exe:1064 QueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS "1" 85 2.38525343 IDoser.exe:1064 QueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS "2" 86 2.38552070 IDoser.exe:1064 QueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS "2" 87 2.38554978 IDoser.exe:1064 CloseKey HKCU\Keyboard Layout\Toggle SUCCESS 88 2.38622904 IDoser.exe:1064 OpenKey HKCU SUCCESS Access: 0x2000000 89 2.38755608 IDoser.exe:1064 OpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NOT FOUND 90 2.38857293 IDoser.exe:1064 OpenKey HKCU\Control Panel\Desktop SUCCESS Access: 0x80000000 91 2.38866401 IDoser.exe:1064 QueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NOT FOUND 92 2.38872147 IDoser.exe:1064 CloseKey HKCU\Control Panel\Desktop SUCCESS 93 2.38900733 IDoser.exe:1064 CloseKey HKCU SUCCESS 94 2.38929439 IDoser.exe:1064 OpenKey HKLM\SOFTWARE\Microsoft\CTF\ SUCCESS Access: 0x20019 95 2.38931417 IDoser.exe:1064 QueryValue HKLM\SOFTWARE\Microsoft\CTF\EnableAnchorContext NOT FOUND 96 2.38946223 IDoser.exe:1064 CloseKey HKLM\SOFTWARE\Microsoft\CTF\ SUCCESS 97 2.42498255 IDoser.exe:1064 OpenKey HKCU SUCCESS Access: 0x2000000 98 2.42505908 IDoser.exe:1064 OpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NOT FOUND 99 2.42510104 IDoser.exe:1064 OpenKey HKCU\Control Panel\Desktop SUCCESS Access: 0x80000000 100 2.42512631 IDoser.exe:1064 QueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NOT FOUND 101 2.42515659 IDoser.exe:1064 CloseKey HKCU\Control Panel\Desktop SUCCESS 102 2.42518091 IDoser.exe:1064 CloseKey HKCU SUCCESS 103 2.42537808 IDoser.exe:1064 OpenKey HKCU SUCCESS Access: 0x2000000 104 2.42539930 IDoser.exe:1064 OpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NOT FOUND 105 2.42587686 IDoser.exe:1064 OpenKey HKCU\Control Panel\Desktop SUCCESS Access: 0x80000000 106 2.42589664 IDoser.exe:1064 QueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NOT FOUND 107 2.42594600 IDoser.exe:1064 CloseKey HKCU\Control Panel\Desktop SUCCESS 108 2.42596841 IDoser.exe:1064 CloseKey HKCU SUCCESS 109 2.42906761 IDoser.exe:1064 OpenKey HKCU\Keyboard Layout\Toggle SUCCESS Access: 0x20019 110 2.42909932 IDoser.exe:1064 QueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS "1" 111 2.43127370 IDoser.exe:1064 QueryValue HKCU\Keyboard Layout\Toggle\Language Hotkey SUCCESS "1" 112 2.43130255 IDoser.exe:1064 QueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS "2" 113 2.43131852 IDoser.exe:1064 QueryValue HKCU\Keyboard Layout\Toggle\Layout Hotkey SUCCESS "2" 114 2.43136525 IDoser.exe:1064 CloseKey HKCU\Keyboard Layout\Toggle SUCCESS 115 2.43149209 IDoser.exe:1064 OpenKey HKCU SUCCESS Access: 0x2000000 116 2.43151879 IDoser.exe:1064 OpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NOT FOUND 117 2.43155336 IDoser.exe:1064 OpenKey HKCU\Control Panel\Desktop SUCCESS Access: 0x80000000 118 2.43157434 IDoser.exe:1064 QueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NOT FOUND 119 2.43159962 IDoser.exe:1064 CloseKey HKCU\Control Panel\Desktop SUCCESS 120 2.43162227 IDoser.exe:1064 CloseKey HKCU SUCCESS 121 2.43527436 IDoser.exe:1064 OpenKey HKCU SUCCESS Access: 0x2000000 122 2.43530750 IDoser.exe:1064 OpenKey HKCU\Software\Policies\Microsoft\Control Panel\Desktop NOT FOUND 123 2.43534613 IDoser.exe:1064 OpenKey HKCU\Control Panel\Desktop SUCCESS Access: 0x80000000 124 2.43537045 IDoser.exe:1064 QueryValue HKCU\Control Panel\Desktop\MultiUILanguageId NOT FOUND 125 2.43539953 IDoser.exe:1064 CloseKey HKCU\Control Panel\Desktop SUCCESS 126 2.43542361 IDoser.exe:1064 CloseKey HKCU SUCCESS 127 2.43547940 IDoser.exe:1064 OpenKey HKCU\SOFTWARE\Microsoft\CTF\LangBarAddIn\ NOT FOUND 128 2.43571854 IDoser.exe:1064 OpenKey HKLM\SOFTWARE\Microsoft\CTF\LangBarAddIn\ NOT FOUND 129 2.87389398 IDoser.exe:1064 OpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hook.dll NOT FOUND 130 3.71228886 IDoser.exe:1064 CloseKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\DRIVERS32 SUCCESS |
|
22.03.2007, 07:59
| #3 |
| /// Helfer-Team    | Vermute ein guter Trojaner hat mich erwicht !!! Hui, das muss wirklich ein guter Trojaner sein, der sich sogar in einem kostenlosen Programm versteckt. Aber du bist ihm ja auf die Spur gekommen, indem du es geöffnet hast.
__________________Wenn du dich auskennst, werden dir eScan (Anleitung in den FAQ beachten!) und Blacklight ein Begriff sein.
__________________ |
|
23.03.2007, 18:14
| #4 |
 | Vermute ein guter Trojaner hat mich erwicht !!! Vielleicht könntest Du schreiben in welchem 7MB großen Programm ein guter, kostenloser trojaner drin war... |
|
| Themen zu Vermute ein guter Trojaner hat mich erwicht !!! |
| antivirus, avast, avast!, bho, bitte um hilfe, browser, exe, explorer, firefox, generic, helper, heur/crypted, hijack, hijackthis, internet, internet explorer, microsoft, monitor, mozilla, mozilla firefox, programm, programme, prüfen, rootkit, software, trojaner, windows, windows xp |
Linear-Darstellung
