|
Plagegeister aller Art und deren Bekämpfung: AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll'Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
07.07.2010, 15:22 | #16 |
/// Winkelfunktion /// TB-Süch-Tiger™ | AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus
__________________ Logfiles bitte immer in CODE-Tags posten |
07.07.2010, 16:18 | #17 |
| AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' GMER wollte nicht.
__________________Hier OSAM: OS: Windows Vista Home Premium Edition (Build 6000), 32-bit Default Browser: Mozilla Corporation Firefox 3.5.10 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [AppInit DLLs] -----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )----- "AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll [Control Panel Objects] -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "Nero BurnRights" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys (File found, but it contains no detailed information) "avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "catchme" (catchme) - ? - C:\Users\MARCOD~1\AppData\Local\Temp\catchme.sys (File not found) "InCD File System" (InCDfs) - "Nero AG" - C:\Windows\System32\drivers\InCDFs.sys "InCD Reader" (incdrm) - "Nero AG" - C:\Windows\System32\drivers\InCDRm.sys "InCDPass" (InCDPass) - "Nero AG" - C:\Windows\System32\drivers\InCDPass.sys "InCDrec" (InCDrec) - "Nero AG" - C:\Windows\system32\drivers\InCDrec.sys "IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found) "IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found) "IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found) "lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys (File found, but it contains no detailed information) "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys "regi" (regi) - "InterVideo" - C:\Windows\System32\drivers\regi.sys "Sony DMI Call service" (DMICall) - "Sony Corporation" - C:\Windows\System32\DRIVERS\DMICall.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys "SSPORT" (SSPORT) - "Samsung Electronics" - C:\Windows\system32\Drivers\SSPORT.sys "Team MFP Comm Driver" (DgiVecp) - "Samsung Electronics Co., Ltd." - C:\Windows\System32\Drivers\DgiVecp.sys "WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys [Explorer] -----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )----- {10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {17B7276C-778A-446C-9E8C-5B61EABCC836} "Depositfiles Manager Explorer Extension" - ? - C:\Program Files\DepositFiles\DF Manager\dfexex.dll (File found, but it contains no detailed information) {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {CAE3251E-9B15-4810-B268-852AD9792A59} "InCDShellExt Class" - "Nero AG" - C:\Program Files\Nero\Nero 7\InCD\InCDshx.dll {B3D9AEDE-B2C3-406d-A254-6BE07767B08B} "InCDUdfPerm Class" - "Nero AG" - C:\Program Files\Nero\Nero 7\InCD\InCDUP.dll {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero CoverDesigner\CoverEdExtension.dll {B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll {7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Program Files\Common Files\Ahead\Lib\NeroDigitalExt.dll {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {ED58A35B-B554-42AF-A26C-6F3D424200D3} "SPMPanel" - "Sony Corporation" - C:\Program Files\Sony\VAIO Power Management\SPMPanel.dll {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "&Google Toolbar" - ? - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (File found, but it contains no detailed information) <binary data> "Deposit IE Toolbar" - ? - C:\PROGRA~1\DEPOSI~1\DFMANA~1\DEPOSI~1.DLL <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? - (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- {48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll {D5AD327A-A089-4F04-89FD-4EA9812B3913} "Download all with DF Manager" - ? - C:\PROGRA~1\DEPOSI~1\DFMANA~1\DEPOSI~1.DLL {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL {77BF5300-1474-4EC7-9980-D32B190E9B07} "Skype" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- <binary data> "&Google Toolbar" - ? - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (File found, but it contains no detailed information) {6AA40521-14E7-4B1D-B1B4-98528C1388C9} "Deposit IE Toolbar" - ? - C:\PROGRA~1\DEPOSI~1\DFMANA~1\DEPOSI~1.DLL -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll {CA6319C0-31B7-401E-A518-A07C3DB8F777} "CBrowserHelperObject Object" - "Your Company Name" - C:\PROGRA~1\GOOGLE~1\BAE.dll {9DFE2FE9-CF99-4ADF-A28E-9B5ADB8DC74F} "DepositFiles IE BHO" - ? - C:\PROGRA~1\DEPOSI~1\DFMANA~1\DEPOSI~1.DLL {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} "Google Dictionary Compression sdch" - "Google Inc." - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll {AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - ? - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll (File found, but it contains no detailed information) {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll {22BF413B-C6D2-4d91-82A9-A0F997BA588C} "Skype add-on (mastermind)" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "NSUFloatingUI" - "Sony Corporation" - "C:\Program Files\Sony\Network Utility\LANUtil.exe" "Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized "swg" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe "avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min "ISBMgr.exe" - ? - "C:\Program Files\Sony\ISB Utility\ISBMgr.exe" "iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe" "Samsung PanelMgr" - ? - C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe "Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "IviRegMgr" (IviRegMgr) - "InterVideo" - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe "LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE "MSCSPTISRV" (MSCSPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe "NBService" (NBService) - "Nero AG" - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe "NSUService" (NSUService) - "Sony Corporation" - C:\Program Files\Sony\Network Utility\NSUService.exe "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "SQL Server VSS Writer" (SQLWriter) - ? - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe "Symantec Lic NetConnect service" (CLTNetCnService) - ? - "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (File not found) "VAIO Entertainment Database Service" (VzCdbSvc) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe "VAIO Entertainment File Import Service" (VzFw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe [Winlogon] -----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )----- "VESWinlogon" - "Sony Corporation" - C:\Windows\system32\VESWinlogon.dll [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru Gruß, Marco |
07.07.2010, 18:34 | #18 |
/// Winkelfunktion /// TB-Süch-Tiger™ | AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
__________________Denk dran beide Tools zu updaten vor dem Scan!!
__________________ |
09.07.2010, 11:10 | #19 |
| AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' Malware: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Datenbank Version: 4291 Windows 6.0.6000 Internet Explorer 7.0.6000.17037 08.07.2010 11:45:16 mbam-log-2010-07-08 (11-45-16).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Durchsuchte Objekte: 320924 Laufzeit: 1 Stunde(n), 36 Minute(n), 49 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 0 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 0 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: (Keine bösartigen Objekte gefunden) Anti-Spyware: SUPERAntiSpyware Scan Log hxxp://www.superantispyware.com Generated 07/08/2010 at 03:15 PM Application Version : 4.40.1002 Core Rules Database Version : 5171 Trace Rules Database Version: 2983 Scan type : Complete Scan Total Scan Time : 03:20:32 Memory items scanned : 673 Memory threats detected : 0 Registry items scanned : 9317 Registry threats detected : 0 File items scanned : 183159 File threats detected : 66 Adware.Tracking Cookie C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***t@ad.porta.eol[2].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***t@zanox[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@apmebf[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@tribalfusion[2].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\marco_dott@ad.adserver01[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***t@collective-media[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@www.zanox-affiliate[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@mediaplex[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@traffictrack[2].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@doubleclick[2].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@adfarm1.adition[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@www.traffictrack[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ad.zanox[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@atdmt[1].txt C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@zanox-affiliate[1].txt .specificclick.net [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] www.addfreestats.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .doubleclick.net [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .trafficrevenue.net [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .zedo.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .zedo.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .zedo.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .zedo.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .zedo.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .zedo.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .content.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .zanox.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .webmasterplan.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .webmasterplan.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] tracking.mlsat02.de [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .myroitracking.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .adbrite.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .adbrite.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .adbrite.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .adbrite.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .adbrite.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .adbrite.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .clicksor.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .clicksor.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .clicksor.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .clicksor.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .doubleclick.net [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .adbrite.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .adtech.de [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .statcounter.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .doubleclick.net [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] www.visit-tracker.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .clicksor.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .clicksor.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] www.visit-tracker.biz [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] www.visit-tracker.biz [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .content.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] ad.yieldmanager.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .shinystat.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] s14.shinystat.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] .partypoker.com [ C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\g9h7kovv.default\cookies.sqlite ] Gruß, Marco |
09.07.2010, 11:20 | #20 |
/// Winkelfunktion /// TB-Süch-Tiger™ | AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' SASW hat nur harmlose Cookies gefunden, oder war da noch mehr?
__________________ Logfiles bitte immer in CODE-Tags posten |
09.07.2010, 11:59 | #21 |
| AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' Nein, da waren nur die Cookies, keine Meldungen sonst. Gruß, Marco |
09.07.2010, 12:28 | #22 |
/// Winkelfunktion /// TB-Süch-Tiger™ | AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' Ok Rechner auch wieder alles normal?
__________________ Logfiles bitte immer in CODE-Tags posten |
09.07.2010, 14:00 | #23 |
| AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' Ja, keine Meldungen, alles läuft normal. Gruß, Marco |
09.07.2010, 15:06 | #24 | |
/// Winkelfunktion /// TB-Süch-Tiger™ | AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' Gut, dann bitte unbedingt die Updates prüfen, denn: Zitat:
Halte Dich an diesen Leitfaden: Microsoftupdate Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Anleitung Windows-Update PDF-Reader aktualisieren Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink => http://filepony.de/?q=Flash+Player Java-Update Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
10.07.2010, 07:43 | #25 |
| AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' Okay, alles erledigt. Ist denn jetzt soweit alles in Ordnung? Ich fahre nämlich heute für eine Woche weg - ohne Rechner!!! - und kann folglich nicht weiter Deine Anweisungen befolgen. Falls noch was ist, kann ich erst danach weitermachen. Ich möchte mich in jedem Falle nochmal sehr herzlich für Deine Hilfe bedanken. Großartig, dass es so etwas wie dieses Board gibt. Also danke! Gute Grüße, Marco |
Themen zu AVira : 'BDS/Papras.JX' [backdoor] in C:\Windows\System32\makeasrv.dll' |
0 bytes, acroiehelper.dll, addon.exe, avgntflt.sys, avira, backdoor, bho, bonjour, cc cleaner, ccsetup, components, corp./icp, data restore, druck, error, excel.exe, firefox, firefox.exe, flash player, google, home, home premium, iastor.sys, iexplore.exe, install.exe, intranet, location, logfile, microsoft office word, mozilla, nvlddmkm.sys, nvstor.sys, oldtimer, otl.exe, pirates, plug-in, programdata, programm, realtek, registry, rundll, saver, sched.exe, searchplugins, security, senden, shell32.dll, skype.exe, software, svchost.exe, symantec, system, virus, vista, vlc media player, windows |