|
Trojaner TR/DLdr.Small.qd Hallo! hab folgende Logs für euch zur auswertung: Logfile of HijackThis v1.98.2 Scan saved at 15:10:39, on 15.11.2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVPersonal\AVGUARD.EXE C:\Programme\AVPersonal\AVWUPSRV.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Programme\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe C:\WINDOWS\System32\VSStatmn32.exe C:\Programme\AVPersonal\AVGNT.EXE C:\WINDOWS\System32\ctfmon.exe C:\Programme\Tweak-XP Pro\AdBlocker.exe C:\Programme\Tweak-XP Pro\transtask.exe C:\WINDOWS\System32\wmplayer612.exe C:\lotus\organize\easyclip6.exe C:\WINDOWS\System32\wuauclt.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Programme\Internet Explorer\iexplore.exe C:\DOKUME~1\VERSIC~1\LOKALE~1\Temp\mwavscan.com C:\DOKUME~1\VERSIC~1\LOKALE~1\Temp\kavss.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\PROGRA~1\WINZIP\winzip32.exe C:\Dokumente und Einstellungen\Versicherungsbüro\Lokale Einstellungen\Temp\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.de/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SYSTEM\blank.htm O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Programme\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [CamMonitor] C:\Programme\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe O4 - HKLM\..\Run: [DSN] C:\WINDOWS\System32\RemoveUserDsn.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [Windows Media Player 6.1.2] wmplayer612.exe O4 - HKLM\..\Run: [$WindowsRegKey%update] IEXPLORE.EXE O4 - HKLM\..\Run: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min O4 - HKLM\..\RunServices: [Windows Media Player 6.1.2] wmplayer612.exe O4 - HKLM\..\RunServices: [$WindowsRegKey%update] IEXPLORE.EXE O4 - HKLM\..\RunServices: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [BlockAds] "C:\Programme\Tweak-XP Pro\AdBlocker.exe" O4 - HKCU\..\Run: [TransTask] "C:\Programme\Tweak-XP Pro\transtask.exe" O4 - HKCU\..\Run: [Windows Media Player 6.1.2] wmplayer612.exe O4 - HKCU\..\Run: [Mcafee Antivirus Monitoring System32mn] VSStatmn32.exe O4 - Startup: Lotus Organizer EasyClip.lnk = ? O4 - Startup: Lotus Organizer 6.0.lnk = C:\lotus\organize\org6.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O9 - Extra button: Web-Eintrag - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...3f7497194f6505 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1093588833293 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - http://www.ysbweb.com/ist/softwares/...sb_regular.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D72C0B51-5350-4985-8951-3AB1CB589407}: NameServer = 217.237.150.141 217.237.150.97 ich hoff irh könnt mir helfen. DAnke im vorraus PS: windows update lad ich grad runter |
ergänzung zu oben: Die folgende log isch von eScan: File C:\WINDOWS\System32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\clocker.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\IExplore32b.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\OPTIONS\CABS\EBD.CAB tagged as not-a-virus:Tool.DOS.Restart. No Action Taken. File C:\WINDOWS\SYSTEM32\clocker.exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\VSStatmn32.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\wmplayer612.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM32\IExplore32b.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: No Action Taken. File C:\WINDOWS\CONFIG\loudc.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\WINDOWS\CONFIG\pro.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\WinAdToolsX.dll tagged as not-a-virus:AdWare.WinAD. No Action Taken. File C:\Programme\AVPersonal\INFECTED\IEXPLORE.VIR infected by "Backdoor.Rbot.j" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR.EXE.VIR infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR[2].EXE.VIR infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR.EXE.001 infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR[1].EXE.VIR infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\YOURSITEBAR.EXE.002 infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Versicherungsbüro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\G127O5UV\tool[1].exe infected by "TrojanDownloader.Win32.IstBar.er" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Versicherungsbüro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\6VUB8HIJ\sbc[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Versicherungsbüro\Lokale Einstellungen\Temporary Internet Files\Content.IE5\6VUB8HIJ\pro[1].exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP513\A0038674.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP518\A0039788.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP518\A0039789.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP518\A0039797.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP518\A0039798.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP519\A0039804.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP519\A0039805.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP520\A0039811.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP520\A0039812.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP520\A0040818.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP520\A0040819.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP511\A0030673.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP511\A0031494.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP511\A0034502.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0038749.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0038750.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0038767.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0038768.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0039771.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP516\A0039777.dll tagged as not-a-virus:AdWare.WinAD. No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039778.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039779.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039785.dll tagged as not-a-virus:AdWare.WinAD. No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039786.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{E2DFB348-3D7C-4C24-8D89-0D56F50DDEB9}\RP517\A0039787.exe infected by "TrojanDownloader.Win32.Small.qd" Virus. Action Taken: No Action Taken. nochmals danke im vorraus |
Hallo, der Grund für diese derartige hohe Kompromittierung ist auf dein ungepatchtes System zurück zu führen. Zitat:
http://www.trojaner-board.de/showpos...28&postcount=2 |
Also ich hab jetzt den neusten patch drauf gemacht, gibt es noch eine andere möglichkeit außer formatieren? |
@ Bizarre, Die Sophos Viren-Enzyklopädie: Backdoor.Win32.Rbot.gen-> "Erläuterung". Cidre's Rat beachten und Festplatte formatieren - Schritt für Schritt. SD |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 17:29 Uhr. |
Copyright ©2000-2024, Trojaner-Board