Trojaner? Hilfe Bitte!
Hi @ all.
Mir sind ein paar komische Sachen aufgefallen und ich weiss nicht mehr weiter.
Hier meine "netstat -a" log: Code:
Proto Lokale Adresse Remoteadresse Status
TCP name-76bd7906aa:epmap name-76bd7906aa:0 ABHÖREN
TCP name-76bd7906aa:microsoft-ds name-76bd7906aa:0 ABHÖRE
TCP name-76bd7906aa:1110 name-76bd7906aa:0 ABHÖREN
TCP name-76bd7906aa:https name-76bd7906aa:0 ABHÖREN
TCP name-76bd7906aa:1030 name-76bd7906aa:0 ABHÖREN
TCP name-76bd7906aa:1110 localhost:3090 HERGESTELLT
TCP name-76bd7906aa:1110 localhost:3092 WARTEND
TCP name-76bd7906aa:1110 localhost:3094 WARTEND
TCP name-76bd7906aa:1110 localhost:3096 WARTEND
TCP name-76bd7906aa:1110 localhost:3097 WARTEND
TCP name-76bd7906aa:1110 localhost:3100 HERGESTELLT
TCP name-76bd7906aa:1110 localhost:3102 WARTEND
TCP name-76bd7906aa:1110 localhost:3106 HERGESTELLT
TCP name-76bd7906aa:1110 localhost:3108 WARTEND
TCP name-76bd7906aa:1110 localhost:3114 WARTEND
TCP name-76bd7906aa:1110 localhost:3118 WARTEND
TCP name-76bd7906aa:1110 localhost:3120 WARTEND
TCP name-76bd7906aa:1110 localhost:3121 WARTEND
TCP name-76bd7906aa:1110 localhost:3124 WARTEND
TCP name-76bd7906aa:1110 localhost:3126 WARTEND
TCP name-76bd7906aa:1110 localhost:3128 HERGESTELLT
TCP name-76bd7906aa:1110 localhost:3130 HERGESTELLT
TCP name-76bd7906aa:1110 localhost:3132 WARTEND
TCP name-76bd7906aa:1110 localhost:3136 WARTEND
TCP name-76bd7906aa:1110 localhost:3138 WARTEND
TCP name-76bd7906aa:1110 localhost:3139 WARTEND
TCP name-76bd7906aa:1110 localhost:3142 WARTEND
TCP name-76bd7906aa:1110 localhost:3143 WARTEND
TCP name-76bd7906aa:1110 localhost:3144 WARTEND
TCP name-76bd7906aa:1110 localhost:3145 WARTEND
TCP name-76bd7906aa:1110 localhost:3150 WARTEND
TCP name-76bd7906aa:1110 localhost:3152 WARTEND
TCP name-76bd7906aa:1110 localhost:3153 WARTEND
TCP name-76bd7906aa:1110 localhost:3156 WARTEND
TCP name-76bd7906aa:1110 localhost:3158 WARTEND
TCP name-76bd7906aa:1110 localhost:3159 WARTEND
TCP name-76bd7906aa:1110 localhost:3160 WARTEND
TCP name-76bd7906aa:1110 localhost:3161 WARTEND
TCP name-76bd7906aa:1110 localhost:3166 WARTEND
TCP name-76bd7906aa:1110 localhost:3190 WARTEND
TCP name-76bd7906aa:1110 localhost:3192 WARTEND
TCP name-76bd7906aa:1110 localhost:3193 WARTEND
TCP name-76bd7906aa:1110 localhost:3194 WARTEND
TCP name-76bd7906aa:1110 localhost:3198 WARTEND
TCP name-76bd7906aa:1110 localhost:3200 WARTEND
TCP name-76bd7906aa:1110 localhost:3202 WARTEND
TCP name-76bd7906aa:1110 localhost:3204 WARTEND
TCP name-76bd7906aa:1940 name-76bd7906aa:0 ABHÖREN
TCP name-76bd7906aa:1940 localhost:2048 HERGESTELLT
TCP name-76bd7906aa:1940 localhost:2185 HERGESTELLT
TCP name-76bd7906aa:1940 localhost:2186 HERGESTELLT
TCP name-76bd7906aa:2048 localhost:1940 HERGESTELLT
TCP name-76bd7906aa:2185 localhost:1940 HERGESTELLT
TCP name-76bd7906aa:2186 localhost:1940 HERGESTELLT
TCP name-76bd7906aa:3077 localhost:1110 WARTEND
TCP name-76bd7906aa:3080 localhost:3079 WARTEND
TCP name-76bd7906aa:3081 localhost:1110 WARTEND
TCP name-76bd7906aa:3083 localhost:3084 HERGESTELLT
TCP name-76bd7906aa:3084 localhost:3083 HERGESTELLT
TCP name-76bd7906aa:3090 localhost:1110 HERGESTELLT
TCP name-76bd7906aa:3100 localhost:1110 HERGESTELLT
TCP name-76bd7906aa:3106 localhost:1110 HERGESTELLT
TCP name-76bd7906aa:3110 localhost:1110 WARTEND
TCP name-76bd7906aa:3112 localhost:1110 WARTEND
TCP name-76bd7906aa:3116 localhost:1110 WARTEND
TCP name-76bd7906aa:3128 localhost:1110 HERGESTELLT
TCP name-76bd7906aa:3130 localhost:1110 HERGESTELLT
TCP name-76bd7906aa:3134 localhost:1110 WARTEND
TCP name-76bd7906aa:3168 localhost:1110 WARTEND
TCP name-76bd7906aa:3172 localhost:1110 WARTEND
TCP name-76bd7906aa:3178 localhost:1110 WARTEND
TCP name-76bd7906aa:3179 localhost:1110 WARTEND
TCP name-76bd7906aa:3181 localhost:1110 WARTEND
TCP name-76bd7906aa:3183 localhost:1110 WARTEND
TCP name-76bd7906aa:3184 localhost:1110 WARTEND
TCP name-76bd7906aa:3185 localhost:1110 WARTEND
TCP name-76bd7906aa:3206 localhost:1110 WARTEND
TCP name-76bd7906aa:11523 name-76bd7906aa:0 ABHÖREN
TCP name-76bd7906aa:11523 localhost:3078 WARTEND
TCP name-76bd7906aa:11523 localhost:3082 WARTEND
TCP name-76bd7906aa:11523 localhost:3117 WARTEND
TCP name-76bd7906aa:11523 localhost:3207 WARTEND
TCP name-76bd7906aa:12346 name-76bd7906aa:0 ABHÖREN
TCP name-76bd7906aa:1839 ats-dcb.dial.aol.com:13784 HERGESTE
TCP name-76bd7906aa:1840 bos-d018c.blue.aol.com:5190 HERGEST
TCP name-76bd7906aa:2003 64.12.25.150:5190 HERGESTELLT
TCP name-76bd7906aa:2015 205.188.1.104:5190 HERGESTELLT
TCP name-76bd7906aa:3086 72.14.205.19:https ZULETZT_ACK
TCP name-76bd7906aa:3091 66.249.85.99:http HERGESTELLT
TCP name-76bd7906aa:3101 66.249.85.104:http HERGESTELLT
TCP name-76bd7906aa:3105 72.14.205.19:http FIN_WARTEN_1
TCP name-76bd7906aa:3107 66.102.11.189:http HERGESTELLT
TCP name-76bd7906aa:3111 72.14.205.19:http FIN_WARTEN_1
TCP name-76bd7906aa:3113 dd5628.kasserver.com:http WARTEND
TCP name-76bd7906aa:3129 72.14.205.19:http HERGESTELLT
TCP name-76bd7906aa:3131 72.14.205.19:http HERGESTELLT
TCP name-76bd7906aa:3135 72.14.205.19:http FIN_WARTEN_1
TCP name-76bd7906aa:3169 dd5628.kasserver.com:http WARTEND
TCP name-76bd7906aa:3180 dd5628.kasserver.com:http WARTEND
TCP name-76bd7906aa:3182 dd5628.kasserver.com:http WARTEND
TCP name-76bd7906aa:3186 dd5628.kasserver.com:http WARTEND
TCP name-76bd7906aa:3187 dd5628.kasserver.com:http WARTEND
TCP name-76bd7906aa:3188 dd5628.kasserver.com:http WARTEND
TCP name-76bd7906aa:3189 dd5628.kasserver.com:http WARTEND
TCP name-76bd7906aa:netbios-ssn name-76bd7906aa:0 ABHÖREN
UDP name-76bd7906aa:microsoft-ds *:*
UDP name-76bd7906aa:isakmp *:*
UDP name-76bd7906aa:1027 *:*
UDP name-76bd7906aa:1126 *:*
UDP name-76bd7906aa:1127 *:*
UDP name-76bd7906aa:1282 *:*
UDP name-76bd7906aa:2273 *:*
UDP name-76bd7906aa:2280 *:*
UDP name-76bd7906aa:2297 *:*
UDP name-76bd7906aa:4500 *:*
UDP name-76bd7906aa:ntp *:*
UDP name-76bd7906aa:1026 *:*
UDP name-76bd7906aa:1029 *:*
UDP name-76bd7906aa:1863 *:*
UDP name-76bd7906aa:1900 *:*
UDP name-76bd7906aa:1939 *:*
UDP name-76bd7906aa:ntp *:*
UDP name-76bd7906aa:1900 *:*
UDP name-76bd7906aa:ntp *:*
UDP name-76bd7906aa:netbios-ns *:*
UDP name-76bd7906aa:netbios-dgm *:*
UDP name-76bd7906aa:1900 *:*
Weiss jemand was :
TCP name-76bd7906aa:2003 64.12.25.150:5190 HERGESTELLT
TCP name-76bd7906aa:2015 205.188.1.104:5190 HERGESTELLT
die beiden bedeuten?
und ist sonst noch etwas auffälliges ?
Hab mit Spyware Doctor gescant: Code:
Backdoor.SkRat (Backdoor.Win32.Skrat.e [Kaspersky]
Generic BackDoor.f [McAfee]
Trj/Multidropper.AWY [Panda])
Threat Level: High
Description: Backdoor.SkRat opens several ports which starts up with Windows and attempts to hide itself using a rootkit component. The backdoor function allows attackers access and control over the infected machine.
Code:
Trojan.Keylogger.H
Type: Keylogger
Threat Level: High
Description: Trojan.Keylogger.H installs as a result of a driveby. It captures all keystrokes to a log file on the computer itself, which can later be viewed by the attacker.
Advice: Toss
Meint ihr, dass es reicht wenn ich das über Spyware Doctor entferne?
Oder wie kann ich das manuell entfernen?
Danke für eure Hilfe !
MfG
humbs | 