IRC Trojaner

AUGUST

Nachtrag
was noch so in der Registry gefunden wurde

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\FilesNamedMRU
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}

000 = PSEXESVC.EXE
001 = winmgmt.exe
002 = wingmt.exe
003 = IR.conf
004 = rb.bat
005 = dwldr32
006 = taskman
007 = svchost32.exe
008 = secure.bat
009 = start.bat
010 = rconnect
011 = explore.dat
012 = bootdrv.dll
013 = activex.ocx
014 = cygwin1.dll
015 = psexec.exe
016 = omnithread_rt.dll
017 = 32dllemu.txt
018 = LSASS.exe
019 = Services.exe
020 = SVhost.exe
021 = Dtceindll32.dll
022 = QoSServer.dll
023 = .dcba

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{C4EE31F3-4768-11D2-BE5C-00A0C9A83DA1}\ContainingTextMRU

000 = Xdcc

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xdcc
Application NOTEPAD.EXE

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PSEXESVC

- Standard
- DisplayName (PSEXESVC)
- ErrorControl ist 1
- ImagePath (%SystemRoot%\System32\PSEXESVC.EXE)
- ObjectName (LocalSystem)
- Start (4)
- Type (10)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\PSEXESVC

- Standard
- DisplayName (PSEXESVC)
- ErrorControl ist 1
- ImagePath (%SystemRoot%\System32\PSEXESVC.EXE)
- ObjectName (LocalSystem)
- Start (4)
- Type (10)

HKEY_CLASSES_ROOT\AppID\winmgmt.exe

- AppId ( {8BC3F05E-D86B-11D0-A075-00C04FB68820} )

HKEY_CLASSES_ROOT\AppID\WinMgmt

- AppId ({74864DA1-0630-11D0-A5B6-00AA00680C3F} )
-------------------------------------------------------------------------------------------
HKEY_CLASSES_ROOT\CLSID\{74864DA1-0630-11D0-A5B6-00AA00680C3F}

- Standard Microsoft WBEM Server
- AppId {74864DA1-0630-11D0-A5B6-00AA00680C3F}
- LocalService WinMgmt
- ThreadingModel Both

HKEY_CLASSES_ROOT\CLSID\{74864DA1-0630-11D0-A5B6-00AA00680C3F}\LocalServer32

- Standard (C:\WINNT\System32\WBEM\winmgmt.exe)
- ThreadingModel (Both)

--------------------------------------------------------------------------------------------

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{74864DA1-0630-11D0-A5B6-00AA00680C3F}

- Standard winmgmt.exe
- LocalService WinMgmt

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinMgmt

- ImagePath %SystemRoot%\System32\WBEM\WinMgmt.exe
- ObjectName LocalSystem
- Start 2
- Type 10
- Failure Action

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\WinMgmt
- ImagePath %SystemRoot%\System32\WBEM\WinMgmt.exe
- ObjectName LocalSystem
- Start 2
- Type 10
- Failure Action

einiges davon gehört noch zu den Trojaner

Mfg.August

__________________
--> IRC Trojaner