ich glaube ich habe mir da was eingefangen.

habe mir hier im forum und im internet ein paar sachen dazu durchgesehen. Sieht ja nicht besonders toll aus.

Ich wende mich trotzdem an euch um hilfe, da ich mir nicht sicher bin, ob der trojaner nur auf dem system ist und dort abgelegt ist, oder ob es ein laufender prozess ist, bei dem ich keine andere wahl habe als das system neu aufzusetzten.

Hier meine escan auswertung ausm abgesichertem modus und mein hjt ausm laufenden windows

Vielen Dank schonmal im vorraus
Gruß Ursadon

escan:


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
Mon Nov 06 21:51:25 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP30\A0007294.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:26 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP30\A0007303.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:27 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP30\A0007304.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:27 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP30\A0007306.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:30 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007318.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:30 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007319.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:30 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007321.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:30 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007327.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:31 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007328.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:31 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007330.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:31 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007336.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:31 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007337.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:31 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007339.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007345.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007346.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007348.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007358.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007359.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:33 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007361.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:33 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007367.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:33 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007368.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:33 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP31\A0007370.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:36 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007381.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:36 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007382.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:36 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007384.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:37 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007392.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:37 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007393.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:37 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007395.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:37 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007405.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:37 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007406.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:38 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007408.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:38 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007417.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:38 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007418.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:38 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007420.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:39 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007427.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:39 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007428.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:39 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007430.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:39 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007437.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:39 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007438.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:39 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007440.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:40 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007448.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:40 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007449.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:40 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007451.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:41 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007458.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:41 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007459.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:41 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007461.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:41 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007468.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:41 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007469.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:42 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007471.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:42 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007477.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:42 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007478.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:42 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007480.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:42 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007486.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:42 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007487.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:51:43 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP32\A0007489.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:17 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP33\A0007584.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:17 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP33\A0007585.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:19 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP33\A0007596.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:19 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP33\A0007602.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:19 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP33\A0007603.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:19 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP33\A0007605.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:20 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP33\A0007616.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:20 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP33\A0007617.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:20 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP33\A0007619.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:24 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007652.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:24 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007653.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:24 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007655.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:25 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007679.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:25 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007680.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:25 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007682.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:25 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007704.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:26 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007705.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:26 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007707.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:26 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007731.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:26 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007732.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:27 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007734.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:28 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007764.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:28 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007765.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:28 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007767.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:28 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007785.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:28 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007786.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:29 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP34\A0007788.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:31 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP35\A0007795.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP35\A0007796.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP35\A0007798.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP35\A0007816.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP35\A0007817.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:32 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP35\A0007819.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:35 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP36\A0007826.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:35 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP36\A0007827.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:35 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP36\A0007829.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:35 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP36\A0007835.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:35 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP36\A0007836.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:36 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP36\A0007838.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:36 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP36\A0007847.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:36 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP36\A0007848.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:52:37 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP36\A0007850.exe infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 21:53:35 2006 => File C:\System Volume Information\_restore{DEFCE304-18C9-4EBF-A740-D63F38D95D7A}\RP43\A0008041.ini infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
Mon Nov 06 22:25:07 2006 => File C:\WINDOWS\system32\jja.dll infected by "Backdoor.Win32.Ciadoor.13" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
~~~~~~~~~~~
Registry
~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mon Nov 06 22:47:57 2006 => Total Errors: 7
Mon Nov 06 22:47:58 2006 => Time Elapsed: 01:55:56
Mon Nov 06 22:47:57 2006 => Total Objects Scanned: 69379
Mon Nov 06 20:43:07 2006 => Virus Database Date: 11/6/2006
Mon Nov 06 20:50:35 2006 => Virus Database Date: 11/6/2006
Mon Nov 06 22:47:58 2006 => Virus Database Date: 11/6/2006
Mon Nov 06 22:52:08 2006 => Virus Database Date: 11/6/2006
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--------------------------------------------------
C:\Base_X\MWAV.LOG
--------------------------------------------------

war zu lang, so hier nun auch das hjt:


Logfile of HijackThis v1.99.1
Scan saved at 22:56:20, on 06.11.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Intel\Wireless\Bin\EvtEng.exe
C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe
C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe
C:\Programme\Intel\Wireless\Bin\EOUWiz.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
C:\Programme\NHC\nhc.exe
C:\Programme\Quick Launch Button\QLButton.exe
C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Dokumente und Einstellungen\***\Desktop\HijackThis.exe

F3 - REG:win.ini: load=C:\WINDOWS\system32\scvhost.exe
F3 - REG:win.ini: run=C:\WINDOWS\system32\scvhost.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Programme\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NotebookHardwareControl] "C:\Programme\NHC\nhc.exe" -quiet
O4 - HKLM\..\Run: [QLButton] C:\Programme\Quick Launch Button\QLButton.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Generic Host Process] C:\WINDOWS\system32\scvhost.exe
O4 - HKLM\..\RunServices: [Generic Host Process] C:\WINDOWS\system32\scvhost.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158596427796
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NBService - Nero AG - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe

Hallo,

das stinkt und zwar gewaltig....

O4 - HKLM\..\Run: [Generic Host Process] C:\WINDOWS\system32\scvhost.exe
O4 - HKLM\..\RunServices: [Generic Host Process] C:\WINDOWS\system32\scvhost.exe

Lasse die beiden mal bei www.virustotal überprüfen.
Irrlicht

habe noch etwas vergessen:

beim booten kommt nach dem windows login im Windows die Fehlermeldung, das die scvhost.exe im system32 verzeichnis nicht gefunden und deswegen nicht gestartet werden kann.

Hallo,
die hier scheinen echt zu sein :

C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe

Die oben von mir gezeigten sind es nicht.
Warum ? Achte auf die Schreibweise !
Irrlicht

ehm pass auf mit diesem cia door ich hatte das auch vor paar tagen und mein pc wurde gehackt sämtliche seiten wurden aufgerufen wie zb ebay und alle freunde im icw wurden beleidgt im ebay gab der hacker eine bewertung ab!"die ware wurde versendet du dreckiger hurrensohn" hab fast anzeige bekommen PASS AUF MIT DEM TROJANER sag ich nur speichere keine passwörter und versuch ihn so schnell wie möglich los zu werrden aber bin mir nicht sicher ob es an dem trojaner lag!

MfG
Mario