|
Trojan-Downloader.Bagle und E-mail-Worm.Bagle Hallo! Wie ich das entfernen kann? CPU Auslastung liegt immer bei 70 % und höher. Danke. Mein HiJackThis Logs: Logfile of HijackThis v1.99.1 Scan saved at 18:04:57, on 23.03.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GMX\adminsvc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Programme\Spyware Doctor\pctsAuxs.exe C:\WINDOWS\Explorer.EXE C:\Programme\Spyware Doctor\pctsSvc.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe C:\Programme\ICQLite\ICQLite.exe C:\Programme\QuickTime\qttask.exe C:\WINDOWS\vsnpstd3.exe C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe C:\Programme\Spyware Nuker\swnxt.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Free Download Manager\fdm.exe C:\Programme\Messenger\msmsgs.exe C:\Programme\Google\Google Updater\GoogleUpdater.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Programme\Sun\StarOffice 8\program\soffice.exe C:\Programme\Sun\StarOffice 8\program\soffice.BIN C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\Programme\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\WINDOWS\system32\svchost.exe C:\Programme\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\eHome\ehmsas.exe C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe C:\Programme\Spyware Doctor\pctsGui.exe C:\Programme\Internet Explorer\iexplore.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\notepad.exe C:\Programme\Internet Explorer\IEXPLORE.EXE C:\Programme\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Downloads\Software\pruefung.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.gmx.net/home R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.gmx.net/home R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.gmx.net/home R3 - URLSearchHook: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Programme\LphantBar\tbLph1.dll O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Programme\LphantBar\tbLph1.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Programme\Free Download Manager\iefdm2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll O3 - Toolbar: LphantBar Toolbar - {6b284373-1765-4464-a587-80fbc2b2eefa} - C:\Programme\LphantBar\tbLph1.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe O4 - HKLM\..\Run: [Lexmark X84-X85 Button Monitor] C:\PROGRA~1\LEXMAR~1\ACMonitor_X84-X85.exe O4 - HKLM\..\Run: [Lexmark X84-X85 Button Manager] C:\PROGRA~1\LEXMAR~1\AcBtnMgr_X84-X85.exe O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\printray.exe O4 - HKLM\..\Run: [THGuard] "C:\Programme\TrojanHunter 4.2\THGuard.exe" O4 - HKLM\..\Run: [ISTray] "C:\Programme\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [SWN2] C:\Programme\Spyware Nuker\swnxt.exe /h O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [Free Download Manager] "C:\Programme\Free Download Manager\fdm.exe" -autorun O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [LphantAutoRun] C:\Programme\Lphant\eLePhantClient.exe O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O4 - Startup: StarOffice 8.lnk = C:\Programme\Sun\StarOffice 8\program\quickstart.exe O4 - Global Startup: Google Updater.lnk = C:\Programme\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Alles mit FDM herunterladen - file://C:\Programme\Free Download Manager\dlall.htm O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://C:\Programme\Free Download Manager\dlselected.htm O8 - Extra context menu item: Datei mit FDM herunterladen - file://C:\Programme\Free Download Manager\dllink.htm O8 - Extra context menu item: Videos mit FDM herunterladen - file://C:\Programme\Free Download Manager\dlfvideo.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL O23 - Service: GMX Browser Update (AdminSVC) - hablamax - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GMX\adminsvc.exe O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe |
hallo, zjz, welches av-programm hat bagle in welcher datei gefunden? bitte lade dir hier ftp://ftp.f-secure.com/anti-virus/tools/fsbl.exe blacklight herunter dann als admin : - i accept the agreement - next - scan und dann poste das log, das du im blacklight-ordner findest. |
Danke 03/23/08 19:35:56 [Info]: BlackLight Engine 1.0.67 initialized 03/23/08 19:35:56 [Info]: OS: 5.1 build 2600 (Service Pack 2) 03/23/08 19:35:56 [Note]: 7019 4 03/23/08 19:35:56 [Note]: 7005 0 03/23/08 19:36:05 [Note]: 7006 0 03/23/08 19:36:05 [Note]: 7027 1 03/23/08 19:36:05 [Note]: 7027 0 03/23/08 19:36:13 [Note]: 7026 0 03/23/08 19:36:19 [Note]: 7026 0 03/23/08 19:36:19 [Note]: 7024 3 03/23/08 19:36:19 [Info]: Hidden process: C:\WINDOWS\system32\drivers\hldrrr.exe 03/23/08 19:36:26 [Note]: FSRAW library version 1.7.1024 03/23/08 19:39:03 [Info]: Hidden file: c:\Programme\Movie Maker\Shared\Empty.txt 03/23/08 19:39:03 [Note]: 10002 3 03/23/08 19:39:03 [Info]: Hidden file: c:\Programme\Movie Maker\Shared\Filters.xml 03/23/08 19:39:03 [Note]: 10002 3 03/23/08 19:39:03 [Info]: Hidden file: c:\Programme\Movie Maker\Shared\news.png 03/23/08 19:39:03 [Note]: 10002 3 03/23/08 19:39:03 [Info]: Hidden file: c:\Programme\Movie Maker\Shared\paint.png 03/23/08 19:39:03 [Note]: 10002 3 03/23/08 19:39:03 [Info]: Hidden file: c:\Programme\Movie Maker\Shared\Profiles\Blank.txt 03/23/08 19:39:03 [Note]: 10002 3 03/23/08 19:39:03 [Info]: Hidden file: c:\Programme\Movie Maker\Shared\Sample1.jpg 03/23/08 19:39:03 [Note]: 10002 3 03/23/08 19:39:03 [Info]: Hidden file: c:\Programme\Movie Maker\Shared\Sample2.jpg 03/23/08 19:39:03 [Note]: 10002 3 03/23/08 19:39:03 [Note]: 10002 2 03/23/08 19:39:03 [Note]: 10002 2 03/23/08 19:43:10 [Note]: 10002 2 03/23/08 19:43:10 [Note]: 10002 2 03/23/08 19:43:41 [Info]: Hidden file: c:\WINDOWS\system32\drivers\srosa.sys 03/23/08 19:43:41 [Note]: 10002 2 03/23/08 19:43:41 [Info]: Hidden file: C:\WINDOWS\system32\drivers\hldrrr.exe 03/23/08 19:43:41 [Note]: 10002 2 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\123093.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15748406.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\66078.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\100015.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\101937.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\103843.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\104500.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\105265.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\105843.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\107968.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\108984.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\110468.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\110500.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\111250.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\113578.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\114390.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1147390.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1148500.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\114953.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1154937.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\115546.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1156015.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1158390.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\116140.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1161828.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1163078.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\116625.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1168234.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\117921.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1194656.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\119937.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1200046.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1203078.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1209109.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1212500.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1214015.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1221765.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15751312.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15754156.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15757296.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15758546.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\157609.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15765890.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15770578.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15775953.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15787312.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15792031.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15829234.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15836890.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\159953.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\163031.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\181593.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\188593.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\199703.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\206390.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\61000.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\61562.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\64359.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\65765.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\66484.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\68953.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\70343.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\70953.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\71203.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\71875.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\73359.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\74250.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\74343.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\75078.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\76671.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\77734.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\79515.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\79875.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\80359.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:44 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\80593.exe 03/23/08 19:43:44 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\82968.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\88421.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\94734.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\98000.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\99609.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\124265.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1290859.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\1298609.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\131765.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\135781.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\137046.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\142203.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\144875.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\151421.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\156218.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15692546.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15693609.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15699062.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15700250.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15702796.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15706062.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15706937.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15710687.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Info]: Hidden file: c:\WINDOWS\system32\drivers\down\15741109.exe 03/23/08 19:43:45 [Note]: 10002 3 03/23/08 19:43:45 [Note]: 10002 2 03/23/08 19:43:45 [Note]: 10002 2 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 3 03/23/08 19:43:50 [Note]: 10002 2 03/23/08 19:43:50 [Note]: 10002 2 03/23/08 19:51:57 [Note]: 7007 0 |
Wurde von "PC Tools Spyware Doctor" gefunden. Ich kann die zwei nicht löschen und beim Löschvorgang immer Neustart verlangt wird. Habe ausprobiert, bringt nichts. Danke für Ihre Hilfe. ZJZ. Trojan-Downloader.Bagle: Registry-Wert HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA, NextInstance HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa, Type HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa, Start HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa, ErrorControl HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa, ImagePath HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa, DisplayName Registry-Schlüssel: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa ********************************************************************** E-mail-Worm.Bagle Registry-Wert: HKEY_USERS\S-1-5-21-839522115-1592454029-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Run, german.exe |
Zitat:
oh, mit dem bedanken solltest du warten. da bagle in deinem system aktiv ist, führt leider kein weg am neuaufsetzen vorbei. http://www.trojaner-board.de/12154-a...sicherung.html was seit der infektion mit deinem rechner passiert ist, kannst du hier nachlesen: Technische Kompromittierung - Wikipedia Botnet - Wikipedia |
Hallo, Wenn ich alle meine Daten auf cd kopiere, wird auch Wurm mitkopiert? Danke |
hallo, eigene dokumente, bilder und musik kannst du sichern, keine ausführbaren dateien. Computersicherheit - Dateiendungen am sichersten ist das kopieren der dateien mit einer live-cd wie z.b. puppy linux. nach dem neuaufsetzen die dateien mit einem scanner überprüfen. |
Danke. Wird gemacht. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 05:08 Uhr. |
Copyright ©2000-2025, Trojaner-Board