|
WoW meldet Backdoor.Win32.Biforse.aej Hallo ! Urplötzlich meldet mein World of Warcraft beim Starten den Fund von Bifrose.aej Hab mein System mit Antivir sowie McAfee jeweils in aktueller Version gescannt und leider den Schädling nicht gefunden. Hier das HiJack Log: Logfile of Trend Micro HijackThis v2.0.0 (BETA) Scan saved at 21:17:33, on 29.05.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Programme\ATI Technologies\ATI.ACE\CLI.EXE C:\Programme\F-Secure\Common\FSM32.EXE C:\Programme\DAEMON Tools\daemon.exe C:\Programme\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe C:\Programme\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe C:\Programme\F-Secure\Anti-Virus\FSGK32.EXE C:\Programme\F-Secure\Common\FSMA32.EXE C:\Programme\F-Secure\Common\FSMB32.EXE C:\WINDOWS\system32\r_server.exe C:\Programme\F-Secure\Common\FCH32.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\svchost.exe C:\Programme\F-Secure\Anti-Virus\fsqh.exe C:\Programme\F-Secure\Common\FAMEH32.EXE C:\Programme\F-Secure\Common\FNRB32.EXE C:\Programme\F-Secure\Anti-Virus\fssm32.exe C:\Programme\F-Secure\FSAUA\program\fsaua.exe C:\Programme\F-Secure\Common\FIH32.EXE C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\Programme\F-Secure\FWES\Program\fsdfwd.exe C:\Programme\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\System32\alg.exe C:\Programme\F-Secure\Anti-Virus\fsav32.exe C:\Programme\F-Secure\FSGUI\fsguidll.exe C:\Programme\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe E:\HiJackThis_v2.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file) O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [SpyHunter] C:\Programme\Enigma Software Group\SpyHunter\SpyHunter.exe O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programme\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programme\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKCU\..\Run: [DAEMON Tools] "C:\Programme\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [AWMON] "C:\Programme\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: AudioDeck.lnk = C:\Programme\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Programme\Hello\PicasaCapture.dll O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Programme\Hello\PicasaCapture.dll O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: BEI - Sysinternals - www.sysinternals.com - C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\BEI.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Programme\F-Secure\Common\FNRB32.EXE O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Programme\F-Secure\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programme\F-Secure\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programme\F-Secure\Common\FSMA32.EXE O23 - Service: OPZHRNEFGLGJLU - Sysinternals - www.sysinternals.com - C:\DOKUME~1\Warlord\LOKALE~1\Temp\OPZHRNEFGLGJLU.exe O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe -- End of file - 5969 bytes Irgendwelche Ideen/Tipps ? |
Hallo, interessantes Logfile. :cool: Sehe ich das richtig, dass du den RootkitRevealer von Sysinternals eingesetzt hast? Warum? Zitat:
Da ich kein "Gamer" bin, habe ich keine Ahnung, was WoW meldet, wenn es einen Bifrose (den meinst du ja wohl, und nicht "Biforse") meldet. Gibt es eine Pfadangabe? Wenn ja, nenne sie bitte. Ansonsten lege ich dir einen Scan mit Silentrunners ans Herz. Du findest es hier, mit einer Anleitung. Poste im Anschluss das Log. |
Hier das Log: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "DAEMON Tools" = ""C:\Programme\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] "AWMON" = ""C:\Programme\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"" ["Lavasoft Sweden"] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "ATICCC" = ""C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe"" [null data] "F-Secure Manager" = ""C:\Programme\F-Secure\Common\FSM32.EXE" /splash" ["F-Secure Corporation"] "F-Secure TNB" = ""C:\Programme\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW" ["F-Secure Corporation"] HKLM\Software\Microsoft\Active Setup\Installed Components\ {5CE63B3D-6102-B2D9-A50C-15D800618C41}\(Default) = (no title provided) \StubPath = "C:\Programme\flashupdate\flashupd.exe s" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "CPL-Erweiterung für Anzeigeverschiebung" -> {HKLM...CLSID} = "CPL-Erweiterung für Anzeigeverschiebung" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Erweiterung für HyperTerminal-Icons" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D}" = "Messenger Sharing Folders" -> {HKLM...CLSID} = "Meine freigegebenen Ordner" \InProcServer32\(Default) = "C:\Programme\MSN Messenger\fsshext.8.1.0178.00.dll" [MS] "{70B28949-EC23-4D00-A411-AD8A1B3A8A5A}" = "awxDTools - ContextMenu ShellExtension" -> {HKLM...CLSID} = "awxDTShlExt Class" \InProcServer32\(Default) = "C:\Programme\DAEMON Tools\awxDTools.dll" ["arniWORX"] "{7A5117B0-B594-4DA8-829D-D15BF11996F2}" = "awxDTools - ColumnHandler ShellExtension" -> {HKLM...CLSID} = "awxDTColumnHandler Class" \InProcServer32\(Default) = "C:\Programme\DAEMON Tools\awxDTools.dll" ["arniWORX"] "{D7C3180D-83AA-464B-9154-6BD0B4E34FBD}" = "awxDTools - PropertySheetHandler ShellExtension" -> {HKLM...CLSID} = "awxDToolsPropSheet Class" \InProcServer32\(Default) = "C:\Programme\DAEMON Tools\awxDTools.dll" ["arniWORX"] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] "{5E2121EE-0300-11D4-8D3B-444553540000}" = "Catalyst Context Menu extension" -> {HKLM...CLSID} = "SimpleShlExt Class" \InProcServer32\(Default) = "C:\Programme\ATI Technologies\ATI.ACE\atiacmxx.dll" [empty string] "{1AED2A52-81A3-404D-AEF9-7DE981C316D1}" = "R-Wipe&Clean" -> {HKLM...CLSID} = "FWipeShellExt Class" \InProcServer32\(Default) = "C:\Programme\R-Wipe&Clean\RwcSh32.dll" ["R-tools Technology Inc."] "{D120D80B-BD26-4A74-8E43-2C2AF0966139}" = "QuickPar ContextMenu extension" -> {HKLM...CLSID} = "QuickParContextMenu Class" \InProcServer32\(Default) = "C:\Programme\QuickPar\QuickParShlExt.dll" ["Peter B Clements"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ <<!>> taskmgr.exe\Debugger = ""D:\PROCESSEXPLORER\PROCEXP.EXE"" ["Sysinternals"] HKLM\Software\Classes\Folder\shellex\ColumnHandlers\ {7A5117B0-B594-4DA8-829D-D15BF11996F2}\(Default) = "awxDTools - ColumnHandler" -> {HKLM...CLSID} = "awxDTColumnHandler Class" \InProcServer32\(Default) = "C:\Programme\DAEMON Tools\awxDTools.dll" ["arniWORX"] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ Quick Par\(Default) = "{D120D80B-BD26-4A74-8E43-2C2AF0966139}" -> {HKLM...CLSID} = "QuickParContextMenu Class" \InProcServer32\(Default) = "C:\Programme\QuickPar\QuickParShlExt.dll" ["Peter B Clements"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Programme\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ R-Wipe&Clean\(Default) = "{1AED2A52-81A3-404D-AEF9-7DE981C316D1}" -> {HKLM...CLSID} = "FWipeShellExt Class" \InProcServer32\(Default) = "C:\Programme\R-Wipe&Clean\RwcSh32.dll" ["R-tools Technology Inc."] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Grüne Idylle.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Grüne Idylle.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "Warlord" & "All Users" startup folders: --------------------------------------------------------- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart "AudioDeck" -> shortcut to: "C:\Programme\VIA Technologies, Inc\VIA Audio Driver Setup Program\AudioDeck\AudioDeck.exe -min" [empty string] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions\ {08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ "MenuText" = "Sun Java Konsole" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_01\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_01" \InProcServer32\(Default) = "C:\Programme\Java\jre1.6.0_01\bin\npjpi160_01.dll" ["Sun Microsystems, Inc."] {B13B4423-2647-4CFC-A4B3-C7D56CB83487}\ "ButtonText" = "Share in Hello" "MenuText" = "Share in H&ello" "CLSIDExtension" = "{B13B4423-2647-4cfc-A4B3-C7D56CB83487}" -> {HKLM...CLSID} = "IECmdExecute Class" \InProcServer32\(Default) = "C:\Programme\Hello\PicasaCapture.dll" ["Picasa, Inc."] {E59EB121-F339-4851-A3BA-FE49C35617C2}\ "ButtonText" = "ICQ6" "MenuText" = "ICQ6" "Exec" = "C:\Programme\ICQ6\ICQ.exe" ["ICQ, Inc."] {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Programme\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] F-Secure Anti-Virus Firewall Daemon, FSDFWD, ""C:\Programme\F-Secure\FWES\Program\fsdfwd.exe"" ["F-Secure Corporation"] F-Secure Automatic Update Agent, FSAUA, ""C:\Programme\F-Secure\FSAUA\program\fsaua.exe"" ["F-Secure Corporation"] F-Secure Management Agent, FSMA, ""C:\Programme\F-Secure\Common\FSMA32.EXE"" ["F-Secure Corporation"] F-Secure Network Request Broker, F-Secure Network Request Broker, ""C:\Programme\F-Secure\Common\FNRB32.EXE"" ["F-Secure Corporation"] FSGKHS, F-Secure Gatekeeper Handler Starter, ""C:\Programme\F-Secure\Anti-Virus\fsgk32st.exe"" ["F-Secure Corporation"] Remote Administrator Service, r_server, ""C:\WINDOWS\system32\r_server.exe" /service" [empty string] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] Print Monitors: --------------- HKLM\System\CurrentControlSet\Control\Print\Monitors\ hpzsnt10\Driver = "hpzsnt10.dll" ["HP"] ---------- <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 221 seconds. ---------- (total run time: 278 seconds) |
Zitat:
RootkitRevealer hab ich eingesetzt, im Rahmen vom Systemscan. WoW gibt natürlich KEINE Info wie und wo es Bifrose gefunden hat, sonst wärs ja zu einfach. |
Kann mir jemand ein aktiveres Board nennen ? Hier scheint niemand weiter zu wissen. |
@Franz1968: Zitat:
@Warlord711: Du magst zwar ein formidabler Kriegsherr sein, aber Herr deines Computer bist du nicht mehr. Deinen logs kann ich zwar nichts Verdächtiges entnehmen, aber hey: Zitat:
Macht 3 Blutfeen zur freien Verfügung! Ich hoffe, ihr Name hält, was er verspricht. |
Hi, das sieht sehr danach aus, dass es dein Bifrose ist: Code: HKLM\Software\Microsoft\Active Setup\Installed Components\
Datei mal bei VirusTotal scannen lassen. Wenn er es ist, dann heißt das formatieren und neu installieren. Und umgehend alle Passwörter von einem sauberen System aus wechseln. Bin zwar bekennender Antigamer, hab aber schon davon gehört, dass sich WoW-Accounts klauen und zu Geld machen lassen. Gruß, Karl |
Zitat:
|
Zitat:
Ähm, ich weiss nicht was ich von diesem Posting halten soll. Ich hatte bereits den Rechner mit 3 verschiedenen AV-Tools gescannt, sowie den Informationen von Sorphos usw. nachgegangen, Registry durchforstet sowie die "gängigen" Dateinamen für Bifrose gesucht und geprüft. Ich weiss auch nicht was deine kindischen Anspielungen auf WoW und meinen, schon seit mind. 15 Jahren von mir benutzten Nickname, sollen. Nachdem ich die Dateiein in dem Ordner gelöscht habe, den Karlkarl nannte, meldet auch WoW keinen Backdoor mehr. Komisch das etliche Scans nix gefunden haben. Aber das scheint er echt gewesen zu sein. Im Verzeichnis war eine .exe und eine .dat Datei, letztere liess sich nur entfernen nachdem ich per ProcessExplorer nach dem Handle gesucht habe, der sich im Firefox versteckte. Hoffentlich ist jetzt alles sauber. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 02:19 Uhr. |
Copyright ©2000-2025, Trojaner-Board