|
Plagegeister aller Art und deren Bekämpfung: Backdoor ProgrammWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
18.12.2004, 14:05 | #1 |
| Backdoor Programm Ich habe auf meinem PC ein Backdoor Programm. Jedesmal wenn ich Windows hochgefahren ist dann kommt die Meldung: gefährliches Backdoorprogramm BDS/AgentAY Wenn ich dann das Programm mit Antivir lösche dann kommt die gleihe Meldung beim nächsten starten von Windows wieder. |
18.12.2004, 15:22 | #2 |
Gast | Backdoor Programm Poste ein HijackThis-Log: http://filepony.de/download-hijackthis/
__________________ |
18.12.2004, 17:03 | #3 |
| Backdoor Programm Das ist mein Hijack This-Log mit der Version 1.99
__________________Logfile of HijackThis v1.99.0 Scan saved at 17:01:41, on 18.12.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVPersonal\AVGUARD.EXE C:\WINDOWS\ASUSKBService.exe C:\Programme\AVPersonal\AVWUPSRV.EXE D:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Programme\Intel\Intel Application Accelerator\iaantmon.exe D:\Programme\AHead\InCD\InCDsrv.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Programme\SoftPerfect Personal Firewall\fw.exe C:\Programme\Intel\Intel Application Accelerator\iaanotif.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\ALCWZRD.EXE C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe D:\Programme\AHead\InCD\InCD.exe C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE D:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE D:\Programme\ICQLite\ICQLite.exe C:\WINDOWS\System32\P2P Networking\P2P Networking.exe C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe D:\Programme\QuickTime\qttask.exe D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe C:\Programme\AVPersonal\AVGNT.EXE C:\Programme\AVPersonal\AVSched32.EXE C:\WINDOWS\System32\ctfmon.exe D:\Programme\Logitech\Profiler\lwemon.exe D:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe D:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Programme\Gemeinsame Dateien\GMT\GMT.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\freenet\freenet.exe C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\Markus\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freenet.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freenet.de R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von freenet.de R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=surfproxy.freenet.de:8080 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] "C:\Programme\SoftPerfect Personal Firewall\fw.exe" O4 - HKLM\..\Run: [IAAnotif] C:\Programme\Intel\Intel Application Accelerator\iaanotif.exe O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAudPropShortcut.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] D:\Programme\AHead\InCD\InCD.exe O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE O4 - HKLM\..\Run: [ICQ Lite] D:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [SearchUpgrader] C:\Programme\Common files\SearchUpgrader\SearchUpgrader.exe O4 - HKLM\..\Run: [CMESys] "C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Zone Labs Client] "d:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min O4 - HKLM\..\Run: [AVSCHED32] C:\Programme\AVPersonal\AVSched32.EXE /min O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Start WingMan Profiler] "D:\Programme\Logitech\Profiler\lwemon.exe" /noui O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [areslite] "D:\Programme\Ares Lite Edition\AresLite.exe" -h O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Senden an &Bluetooth - D:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar1.dll/cmsimilar.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O14 - IERESET.INF: START_PAGE_URL=http://www.freenet.de O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1848bc26...dxIE601_de.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{AAE38B58-B6D1-4FBF-9020-D46898DF2EFC}: NameServer = 62.104.191.241 62.104.196.134 O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: ASUS Keyboard Service - ASUSTeK COMPUTER INC. - C:\WINDOWS\ASUSKBService.exe O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: Bluetooth Service - WIDCOMM, Inc. - D:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: IAA Event Monitor - Intel Corporation - C:\Programme\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InCD File System Service - AHEAD Software - D:\Programme\AHead\InCD\InCDsrv.exe O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
18.12.2004, 18:28 | #4 |
| Backdoor Programm @Marki99 das ist der hier lade dir escan download escan anleitung führe es genauso durch wie verlangt wird, scan dauert 1 stunde EscanErgebnis Teile uns das Ergebnis des eScan mit: "öffne die mwav.log -> Bearbeiten -> Suchen -> infected eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen." chaosman
__________________ Bonus vir semper tiro |
19.12.2004, 17:41 | #5 |
| Backdoor Programm Das ist der Logfile von eScan.Ich musste die datei leider teilen weil sie zu groß war Teil 1 File C:\PROGRA~1\GEMEIN~1\CMEII\CMEIIAPI.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\CMESys.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\gappmgr.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\GCONTR~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\gdwldeng.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\GIocl.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\GIOCLC~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\gmtproxy.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\GObjs.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\GStore.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File c:\PROGRA~1\GEMEIN~1\cmeii\GSTORE~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\Gtools.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\EGGCEN~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\EGIEPR~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\EGNSEN~1.DLL infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\GatorRes.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\GMT\GMT.exe infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\PROGRA~1\GEMEIN~1\CMEII\CMESys.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File C:\WINDOWS\System32\cd_clint.dll infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\Markus\LOKALE~1\Temp\asmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\Markus\LOKALE~1\TEMPOR~1\Content.IE5\4WNMSRUJ\wow[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\Markus\LOKALE~1\TEMPOR~1\Content.IE5\G8U786GE\masta[1].chm infected by "Exploit.CodeBaseExec" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\Markus\LOKALE~1\TEMPOR~1\Content.IE5\G8U786GE\masta[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\Markus\LOKALE~1\TEMPOR~1\Content.IE5\V4J1UNB7\masta[1].chm infected by "Exploit.CodeBaseExec" Virus. Action Taken: No Action Taken. File C:\DOKUME~1\Markus\LOKALE~1\TEMPOR~1\Content.IE5\V4J1UNB7\masta[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\CD Burning\ORIGSW\6KanSound\MODEM\PCTEL\W9X_NT\PTSNOOP.EXE tagged as not-a-virus:FalseAlarm.Symantec.Ptsnoop. No Action Taken. File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\CD Burning\ORIGSW\PCP_0204\files\admin-tools\activitymon\amagent30.exe tagged as not-a-virus:RiskWare.Monitor.ActivityMonitor.37. No Action Taken. |
19.12.2004, 17:42 | #6 |
| Backdoor Programm File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\CD Burning\ORIGSW\PCP_0204\files\admin-tools\activitymon\amonitor30f.exe tagged as not-a-virus:RiskWare.Monitor.ActivityMonitor.37. No Action Taken. File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\CD Burning\ORIGSW\PCP_0204\files\admin-tools\NetworkActiv\NetworkActivPIAFCTMv1.5.exe tagged as not-a-virus:NetTool.Sniffer.Piafctm.152. No Action Taken. File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\CD Burning\ORIGSW\PCP_0204\files\basics\vbrun\vbrun500.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\CD Burning\ORIGSW\TOOLS\WinCommander\fr-wc454.exe tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken. File C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft\CD Burning\ORIGSW\XEXX.X tagged as not-a-virus:PornWare.Dialer.Kotu.c. No Action Taken. File C:\Dokumente und Einstellungen\Markus\Desktop\Spiele\areslite181.exe infected by "not-a-virus:AdWare.NavExcel.d" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temp\asmfiles.cab infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\4WNMSRUJ\wow[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\G8U786GE\masta[1].chm infected by "Exploit.CodeBaseExec" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\G8U786GE\masta[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\V4J1UNB7\masta[1].chm infected by "Exploit.CodeBaseExec" Virus. Action Taken: No Action Taken. File C:\Dokumente und Einstellungen\Markus\Lokale Einstellungen\Temporary Internet Files\Content.IE5\V4J1UNB7\masta[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Download Manager\adm25.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Download Manager\adm4.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Download Manager\adm4005.exe infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Download Manager\admprog.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\Program Files\Altnet\Points Manager\sysdetect.dll infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\A0034363.EXE.VIR infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.001 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.002 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.003 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.004 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.005 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.006 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.007 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.008 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.009 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.010 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.011 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.012 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.013 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.014 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.015 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.016 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.017 infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\BNANNCDRP.EXE.VIR infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\EXE[1].VIR infected by "Trojan-Downloader.Win32.Agent.fw" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\FILE.EXE.VIR infected by "TrojanDownloader.Win32.Small.xk" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\JHALNDBE.EXE.VIR infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\Q8276112.EXE.VIR infected by "Trojan-Downloader.Win32.Agent.fw" Virus. Action Taken: No Action Taken. File C:\Programme\AVPersonal\INFECTED\SEARCHUPGRADER.EXE.VIR infected by "TrojanDownloader.Win32.Keenval.g" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\CMEIIAPI.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\CMESys.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GAppMgr.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GController.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GDwldEng.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GIocl.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GIoclClient.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GMTProxy.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GObjs.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. |
19.12.2004, 17:43 | #7 |
| Backdoor Programm Das ist der 3.Teil File C:\Programme\Gemeinsame Dateien\CMEII\GStore.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\GStoreServer.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\CMEII\Gtools.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\EGGCEngine.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\egIEEngine.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\EGIEProcess.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\EGNSEngine.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\GatorRes.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\GatorStubSetup.exe infected by "not-a-virus:AdWare.Gator.6034" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\GMT.exe infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\gtrawbm.fil infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\GMT\GUninstaller.exe infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\Programme\Gemeinsame Dateien\nlntlnnb\nfdpdlrdbe\BNANNCDRP.EXE.VIR infected by "not-a-virus:AdWare.Gator.a" Virus. Action Taken: No Action Taken. File C:\Programme\MyWay\myBar\1.bin\MY2NS.EXE infected by "not-a-virus:AdWare.Toolbar.MyWay.b" Virus. Action Taken: No Action Taken. File C:\Programme\MyWay\myBar\1.bin\NPMYWAY.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.f" Virus. Action Taken: No Action Taken. File C:\Programme\NavExcel\NavHelper\v2.0.4c\NHUninstaller.exe infected by "not-a-virus:AdWare.NavExcel" Virus. Action Taken: No Action Taken. File C:\Programme\NavExcel\NavHelper\v2.0.4c\NHUpdater.exe infected by "not-a-virus:AdWare.NavExcel.b" Virus. Action Taken: No Action Taken. File C:\Programme\NavExcel\NavHelper\v2.0.4c\v2.0.4c.c.cab infected by "not-a-virus:AdWare.NavExcel" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP47\A0012182.exe infected by "not-a-virus:AdWare.NavExcel" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP47\A0012183.exe infected by "not-a-virus:AdWare.NavExcel.b" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP53\A0014500.exe infected by "not-a-virus:AdWare.Gator.5115" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP53\A0014507.exe infected by "not-a-virus:AdWare.Gator.5115" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP53\A0014511.dll infected by "not-a-virus:AdWare.Gator.6041" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP53\A0014513.dll infected by "not-a-virus:AdWare.Gator.5115" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP53\A0014518.exe infected by "not-a-virus:AdWare.Gator.5115" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP72\A0024747.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP72\A0024748.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP95\A0034401.dll infected by "not-a-virus:AdWare.Perfnav.a" Virus. Action Taken: No Action Taken. File C:\System Volume Information\_restore{A4B1C0BD-EFE8-4922-866E-7155FEEFEF0D}\RP95\A0034402.DLL infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken. File C:\WINDOWS\browserxtras\pn\remove.exe infected by "TrojanDownloader.Win32.Keenval.f" Virus. Action Taken: No Action Taken. File C:\WINDOWS\system32\cd_clint.dll infected by "not-a-virus:AdWare.Cydoor" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Adware\Setup_PerfectNav.exe infected by "not-a-virus:AdWare.Perfnav.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\adm.exe infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\adm25.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\adm4.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\admprog.dll infected by "not-a-virus:AdWare.Altnet.a" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\mysearch.cab infected by "not-a-virus:AdWare.ToolBar.MyWay.g" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\pmfiles.cab infected by "not-a-virus:AdWare.BrilliantDigital.1007" Virus. Action Taken: No Action Taken. File C:\WINDOWS\Temp\Altnet\Setup.exe infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. File D:\ORIGSW\6KanSound\MODEM\PCTEL\W9X_NT\PTSNOOP.EXE tagged as not-a-virus:FalseAlarm.Symantec.Ptsnoop. No Action Taken. File D:\ORIGSW\PCP_0204\files\admin-tools\activitymon\amagent30.exe tagged as not-a-virus:RiskWare.Monitor.ActivityMonitor.37. No Action Taken. File D:\ORIGSW\PCP_0204\files\admin-tools\activitymon\amonitor30f.exe tagged as not-a-virus:RiskWare.Monitor.ActivityMonitor.37. No Action Taken. File D:\ORIGSW\PCP_0204\files\admin-tools\NetworkActiv\NetworkActivPIAFCTMv1.5.exe tagged as not-a-virus:NetTool.Sniffer.Piafctm.152. No Action Taken. File D:\ORIGSW\PCP_0204\files\basics\vbrun\vbrun500.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File D:\ORIGSW\TOOLS\WinCommander\fr-wc454.exe tagged as not-a-virus:FalseAlarm.DrWeb.Backdoor.Theef.111. No Action Taken. File D:\ORIGSW\XEXX.X tagged as not-a-virus:PornWare.Dialer.Kotu.c. No Action Taken. File D:\program files\Altnet\Download Manager\asmps.dll infected by "not-a-virus:AdWare.Altnet.b" Virus. Action Taken: No Action Taken. |
19.12.2004, 17:44 | #8 |
| Backdoor Programm Kann mir jetzt vieleicht jemand helfen???????????????? |
19.12.2004, 17:48 | #9 |
| Backdoor Programm Das ist auch noch aus dem Logfile von eScan Sun Dec 19 14:12:21 2004 => Total Files Scanned: 134813 Sun Dec 19 14:12:21 2004 => Total Virus(es) Found: 124 Sun Dec 19 14:12:21 2004 => Total Disinfected Files: 0 Sun Dec 19 14:12:21 2004 => Total Files Renamed: 0 Sun Dec 19 14:12:21 2004 => Total Deleted Files: 0 Sun Dec 19 14:12:21 2004 => Total Errors: 21 Sun Dec 19 14:12:21 2004 => Time Elapsed: 01:54:47 Sun Dec 19 14:12:21 2004 => Virus Database Date: 2004/12/17 Sun Dec 19 14:12:21 2004 => Virus Database Count: 112674 Sun Dec 19 14:12:21 2004 => Scan Completed. |
19.12.2004, 19:46 | #10 |
| Backdoor Programm Hallo Marki99, lade Dir hier Ad-Aware 6 Personal und Spybot-Search & Destroy 1.3 runter, scanne damit Deinen Rechner und lass die bestehenden Probleme beheben. Lade Dir ausserdem das Clearprog runter und leere damit alle Ordner TEMP, Temporary Internet Files, Cookies und den Verlauf. Die Dateien aus denen Dialer ersichtlich sind, solltest Du vor dem Löschen auf Diskette speichern .. zum Beispiel File D:\ORIGSW\XEXX.X tagged as not-a-virus:PornWare.Dialer.Kotu.c. No Action Taken. (Dialer-Hinweis) Erstelle dann ein weiteres Hijack This Logfile und poste es. SD |
20.12.2004, 16:50 | #11 |
| Backdoor Programm So das ist mein neure Hijack This Logfile. Nachdem ich das gemacht habe was du gesagt hast. Logfile of HijackThis v1.99.0 Scan saved at 16:41:46, on 20.12.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\AVPersonal\AVGUARD.EXE C:\WINDOWS\ASUSKBService.exe C:\Programme\AVPersonal\AVWUPSRV.EXE D:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Programme\Intel\Intel Application Accelerator\iaantmon.exe D:\Programme\AHead\InCD\InCDsrv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Programme\SoftPerfect Personal Firewall\fw.exe C:\Programme\Intel\Intel Application Accelerator\iaanotif.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\ALCWZRD.EXE C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe D:\Programme\AHead\InCD\InCD.exe C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE C:\PROGRA~1\GEMEIN~1\PCSuite\Services\SERVIC~1.EXE D:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE C:\WINDOWS\System32\P2P Networking\P2P Networking.exe D:\Programme\QuickTime\qttask.exe C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe C:\Programme\AVPersonal\AVSched32.EXE C:\Programme\AVPersonal\AVGNT.EXE D:\Programme\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\System32\ctfmon.exe D:\Programme\Logitech\Profiler\lwemon.exe D:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe D:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Dokumente und Einstellungen\Markus\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.freenet.de/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.freenet.de R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer von freenet.de R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=surfproxy.freenet.de:8080 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot - Search & Destroy2\SDHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar2.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar2.dll O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] "C:\Programme\SoftPerfect Personal Firewall\fw.exe" O4 - HKLM\..\Run: [IAAnotif] C:\Programme\Intel\Intel Application Accelerator\iaanotif.exe O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAudPropShortcut.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [InCD] D:\Programme\AHead\InCD\InCD.exe O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\GEMEIN~1\PCSuite\DATALA~1\DATALA~1.EXE O4 - HKLM\..\Run: [PCSuiteTrayApplication] D:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE O4 - HKLM\..\Run: [ICQ Lite] D:\Programme\ICQLite\ICQLite.exe -minimize O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [AVSCHED32] C:\Programme\AVPersonal\AVSched32.EXE /min O4 - HKLM\..\Run: [AVGCtrl] C:\Programme\AVPersonal\AVGNT.EXE /min O4 - HKLM\..\Run: [Zone Labs Client] "d:\Programme\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [Start WingMan Profiler] "D:\Programme\Logitech\Profiler\lwemon.exe" /noui O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [areslite] "D:\Programme\Ares Lite Edition\AresLite.exe" -h O4 - HKCU\..\RunOnce: [ICQ Lite] D:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Startup: PowerReg Scheduler.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = D:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://c:\programme\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: Im Cache gespeicherte Seite - res://c:\programme\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Senden an &Bluetooth - D:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Verweisseiten - res://c:\programme\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Ähnliche Seiten - res://c:\programme\google\GoogleToolbar2.dll/cmsimilar.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - D:\Programme\ICQLite\ICQLite.exe O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm O14 - IERESET.INF: START_PAGE_URL=http://www.freenet.de O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/1848bc26...dxIE601_de.cab O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - C:\Programme\AVPersonal\AVGUARD.EXE O23 - Service: ASUS Keyboard Service - ASUSTeK COMPUTER INC. - C:\WINDOWS\ASUSKBService.exe O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - C:\Programme\AVPersonal\AVWUPSRV.EXE O23 - Service: Bluetooth Service - WIDCOMM, Inc. - D:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe O23 - Service: IAA Event Monitor - Intel Corporation - C:\Programme\Intel\Intel Application Accelerator\iaantmon.exe O23 - Service: InCD File System Service - AHEAD Software - D:\Programme\AHead\InCD\InCDsrv.exe O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
20.12.2004, 17:04 | #12 |
| Backdoor Programm @Marki99 bis auf den hier C:\WINDOWS\System32\P2P Networking\P2P Networking.exe ist dein logfile sauber. am besten deinstallieren, er holt dir auch malware, spyware und andere sachen auf den rechner. chaosman
__________________ Bonus vir semper tiro |
21.12.2004, 20:25 | #13 |
| Backdoor Programm Danke für die Hilfe Das Programm P2P Networking habe ich jetzt auch noch gelöscht. Jetzt ist alles wieder ok. Ich bekomme auch keine Meldungen mehr von Anti Vir |
23.08.2008, 01:24 | #14 |
Gesperrt | Backdoor Programm [edit] bitte eröffne, wie jeder andere hier auch, für dein problem einen eigenen beitrag nur so wird sichergestellt, das jedem user übersichtlich und individuell geholfen werden kann danke GUA [/edit] |
Themen zu Backdoor Programm |
antivir, arten, backdoor, backdoor programm, backdoorprogramm, hochgefahren, meldung, program, programm, starte, starten, windows |