Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   BullsEye wütet wieder! (https://www.trojaner-board.de/18146-bullseye-wuetet.html)

Squad 02.06.2005 21:29

Hier ist das Ergebnis:

Zitat:

Zitat von chaosman
@Squad
poste bitte folgendes
________________________________________
Öffne C:\bases\mwav.log
Am Ende folgendes suchen und hier rein kopieren:
Zitat:
Total Files Scanned: 107141
Total Virus(es) Found: 59
Total Disinfected Files:0
Total Files Renamed:0
Total Deleted Files: 0
Total Errors: 205
Time Elapsed: 02:11:08
Virus Database Date: 2005/05/20
Virus Database Count: 130890


chaosman 02.06.2005 21:37

@Squad
Total Virus(es) Found: 59 :eek:
poste mal folgendes
EscanErgebnis
Teile uns das Ergebnis des eScan mit: "öffne die mwav.log -> Bearbeiten -> Suchen -> infected oder tagged eingeben -> Weitersuchen -> Treffer markieren/kopieren und ins Forum übertragen."

chaosman

Squad 02.06.2005 22:00

Alle Suchergebnisse mit infected:

Thu Jun 02 17:18:45 2005 => System found infected with Bargain Buddy Spyware/Adware ({4eb7bbe8-2e15-424b-9ddb-2cdb9516b2c3})! Action taken: No Action Taken.
Thu Jun 02 17:18:45 2005 => Object "Bargain Buddy Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:18:45 2005 => System found infected with Bargain Buddy Spyware/Adware ({c6906a23-4717-4e1f-b6fd-f06ebed15678})! Action taken: No Action Taken.
Thu Jun 02 17:18:45 2005 => Object "Bargain Buddy Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:18:45 2005 => System found infected with Bargain Buddy Spyware/Adware ({8eee58d5-130e-4cbd-9c83-35a0564e5678})! Action taken: No Action Taken.
Thu Jun 02 17:18:45 2005 => Object "Bargain Buddy Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:18:46 2005 => System found infected with Alexa Spyware/Adware ({c95fe080-8f5d-11d2-a20b-00aa003c157a})! Action taken: No Action Taken.
Thu Jun 02 17:18:46 2005 => Object "Alexa Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (exul.exe)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (instsrv.exe)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (exul3.exe)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (msexreg.exe)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (exdl.exe)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (bbchk.exe)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (exdl3.exe)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (mqexdlm.srg)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (vx3x.nls)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (vx3.nls)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (vx0.nls)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (exclean.exe)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (netut80ex.vxd)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 17:20:10 2005 => System found infected with eZula Spyware/Adware (javexulm.vxd)! Action taken: No Action Taken.
Thu Jun 02 17:20:10 2005 => Object "eZula Spyware/Adware" found in File System! Action Taken: No Action Taken.

Thu Jun 02 18:05:39 2005 => File C:\WINDOWS\Downloaded Program Files\installer_MARKETING32.exe infected by "Trojan-Downloader.Win32.Adload.a" Virus! Action Taken: No Action Taken.

Thu Jun 02 19:13:50 2005 => Scanning Folder: C:\Programme\AVPersonal\INFECTED\*.*

Thu Jun 02 19:13:50 2005 => Scanning File C:\Programme\AVPersonal\INFECTED\2[1].HTM.VIR

Alle Suchergebnisse mit tagged:

Thu Jun 02 17:18:44 2005 => File C:\WINDOWS\zeta.exe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.

Thu Jun 02 17:21:11 2005 => File C:\WINDOWS\autoheal.exe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.

Thu Jun 02 17:22:20 2005 => File C:\WINDOWS\System32\exdl.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:24:23 2005 => File C:\WINDOWS\System32\exul.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:24:23 2005 => File C:\WINDOWS\System32\javexulm.vxd tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:24:29 2005 => File C:\WINDOWS\System32\exdl2.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:24:30 2005 => File C:\WINDOWS\System32\exdl3.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:24:31 2005 => File C:\WINDOWS\System32\exdl1.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:24:32 2005 => File C:\WINDOWS\System32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.

Thu Jun 02 17:24:34 2005 => File C:\WINDOWS\System32\mac80ex.idf tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.

Thu Jun 02 17:24:36 2005 => File C:\WINDOWS\System32\javex80.vxd tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.

Thu Jun 02 17:24:42 2005 => File C:\WINDOWS\System32\psis80ex.ax tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.

Thu Jun 02 17:24:43 2005 => File C:\WINDOWS\System32\exul3.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:24:44 2005 => File C:\WINDOWS\System32\exul1.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:24:44 2005 => File C:\WINDOWS\System32\mqexdlm.srg tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:24:53 2005 => File C:\WINDOWS\System32\netut80ex.vxd tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:53:46 2005 => File C:\WINDOWS\system32\exdl.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:56:19 2005 => File C:\WINDOWS\system32\exul.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:56:19 2005 => File C:\WINDOWS\system32\javexulm.vxd tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

...Fortsetzung folgt... :pukeface:

Squad 02.06.2005 22:09

Fortsetzung:


Thu Jun 02 17:56:25 2005 => File C:\WINDOWS\system32\exdl2.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:56:25 2005 => File C:\WINDOWS\system32\exdl3.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:56:26 2005 => File C:\WINDOWS\system32\exdl1.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:56:27 2005 => File C:\WINDOWS\system32\instsrv.exe tagged as not-a-virus:RiskWare.Tool.ServiceRunner.f. No Action Taken.

Thu Jun 02 17:56:30 2005 => File C:\WINDOWS\system32\mac80ex.idf tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.

Thu Jun 02 17:56:31 2005 => File C:\WINDOWS\system32\javex80.vxd tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.

Thu Jun 02 17:56:37 2005 => File C:\WINDOWS\system32\psis80ex.ax tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.

Thu Jun 02 17:56:38 2005 => File C:\WINDOWS\system32\exul3.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:56:39 2005 => File C:\WINDOWS\system32\exul1.exe tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:56:39 2005 => File C:\WINDOWS\system32\mqexdlm.srg tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 17:56:49 2005 => File C:\WINDOWS\system32\netut80ex.vxd tagged as "not-a-virus:AdWare.BargainBuddy.q". Action Taken: No Action Taken.

Thu Jun 02 18:05:42 2005 => File C:\WINDOWS\autoheal.exe tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.

Thu Jun 02 18:43:30 2005 => File C:\Dokumente und Einstellungen\Gast\Eigene Dateien\Ralph\CD-Brennd\tägliche Losung\Winlos03.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

Thu Jun 02 18:48:23 2005 => File C:\Dokumente und Einstellungen\Jan\Eigene Dateien\Jan\backups\backup-20050523-115914-837.dll tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.

Thu Jun 02 18:48:23 2005 => File C:\Dokumente und Einstellungen\Jan\Eigene Dateien\Jan\backups\backup-20050523-115914-344.dll tagged as "not-a-virus:AdWare.BargainBuddy.l". Action Taken: No Action Taken.

Thu Jun 02 18:48:23 2005 => File C:\Dokumente und Einstellungen\Jan\Eigene Dateien\Jan\backups\backup-20050523-115914-345.dll tagged as "not-a-virus:AdWare.BargainBuddy.n". Action Taken: No Action Taken.

Thu Jun 02 19:28:13 2005 => File C:\HCW\wpcuinst.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.


So, das war alles und ich hab' echt die Schnauze voll! So ein verseuchter Rechner - und das auf der Arbeit! :kloppen:

Squad 03.06.2005 16:42

Kann mir wirklich keiner helfen??? :confused:

Na ja, so verlaust wie der Rechner ist, kann ich das verstehen. :(
Ist übrigens ein Notebook, macht das einen Unterschied?

Kann ich das ganze System denn so einfach neu aufsetzen? Auf der Festplatte sind nämlich 'ne Menge Daten drauf...!

Gruß, Squad

Cidre 03.06.2005 16:48

Hallo Squad,

es ist aus meiner Sicht sinnvoller, wenn du dich an den Admin wendest und dieser dann, das Problem behebt bzw. neu aufsetzt und anschließend dementsprechende Gegenmaßnahmen einleitet.

Squad 17.06.2005 11:07

Ich habe ein Problem beim Neuaufsetzen des Systems. Es werden ja dann alle Daten auf C: gelöscht, richtig? Da sind aber wichtige Firmendaten drauf. Wie kann ich diese ganzen Daten vor dem Neuaufsetzen sichern, ohne eine Malware mitzuspeichern? Geht das überhaupt?

Danke für alle hilfreichen Tipps!

Gruß, Squad


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131