|
hallo leut, ich hab ma irgendwie den wuamgrd trojaner eingefangn, kann mir jemand helfen wie ich den runter bekomm? ich hab da so n hijack gemacht der wie folgt aussieht.. Logfile of HijackThis v1.97.7 Scan saved at 16:17:07, on 21.06.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\CA\eTrust Antivirus\InoRpc.exe C:\Programme\CA\eTrust Antivirus\InoRT.exe C:\Programme\CA\eTrust Antivirus\InoTask.exe C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\Dit.exe C:\PROGRA~1\CA\ETRUST~1\realmon.exe C:\WINDOWS\mHotkey.exe C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\PRISMSTA.EXE C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\System32\notepad32.exe C:\WINDOWS\DitExp.exe C:\Programme\MSN Messenger\msnmsgr.exe C:\WINDOWS\CNYHKey.exe C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe C:\WINDOWS\System32\wuauclt.exe C:\Programme\Internet Explorer\iexplore.exe C:\WINDOWS\System32\arahopq.exe C:\Dokumente und Einstellungen\gak1\Lokale Einstellungen\Temp\Temporäres Verzeichnis 1 für hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.medion.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s O4 - HKLM\..\Run: [CHotkey] mHotkey.exe O4 - HKLM\..\Run: [PCMService] "C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [Microsoft Update] wuamgrd.exe O4 - HKLM\..\Run: [Windows Autostart Loader] notepad32.exe O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\arahopq.exe O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe O4 - HKLM\..\RunServices: [Windows Autostart Loader] notepad32.exe O4 - HKLM\..\RunServices: [LAN Driver] landriver32.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Microsoft Update] wuamgrd.exe O4 - HKCU\..\Run: [Windows Autostart Loader] notepad32.exe O4 - HKCU\..\RunServices: [Windows DLL host] "C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe" O4 - Global Startup: Kontrollfeld für die kabellose Tastatur.lnk = C:\WINDOWS\CNYHKey.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...893.1583217593 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{FAC82026-A5C5-4C55-B9D4-DE3892B12FA4}: NameServer = 195.3.96.67 195.3.96.68 |
Oh, das sieht nicht gut aus, zumal dahinter z.T. leistungsfähige Backdoors stecken, die anderen vollen Zugriff auf dein System ermöglichen. Aktiviere erstmal für deine DFÜ-Verbindung die XP Verbindungsfirewall. Weißt du, wie das geht? Nachtrag: durch das Aktivieren dieser Verbindungsfirewall wird ausschließlich dem immer wieder neuen Schadsoftwarebefall durch diese Netzwerkwürmer entgegengewirkt. Schaden, der durch diese aktive Schadsoftware bereits verursacht wurde oder Zugriffe von außen über aktive Backdoors bleiben davon jedoch unberührt. Dein System befindet sich in undefiniertem Zustand, und sollte eigentlich nach Format c: neu aufgesetzt werden. Ich kann dir zwar die einzelnen Schadsoftwaredateien nennen, die du im abgesicherten Modus von Windows entfernen könntest, doch wie gesagt, bereits zu deinem Nachteil erfolgte Änderungen am System können dadurch nicht rückgängig gemacht werden. |
hallo, erstma danke dast gepostet hast, weis net wirklich was du meinst, grüss, stefan |
Öffne über in >Start >Systemsteuerung den Bereich "Netzwerk und Internetverbindungen". Klick mit rechts auf deine DFÜ-Verbindung und anschl. auf "Eigenschaften von (deiner DFÜ-Verbindung)". Klick auf "Erweitert" und setze einen Haken bei: "Internetverbindungsfirewall", bestätige abschließend mit OK. |
ok danke vielmals, hab das gemacht, also meinst das ich neu formatieren soll? ich habe unter ausführen-msconfig mal die exe ausgeschalten, das hilft aba nix? hab leider auf dem gebiet nicht grad das beste wissen, gruss stefan |
Prüf diese fünf Dateien: C:\WINDOWS\System32\notepad32.exe C:\WINDOWS\System32\arahopq.exe C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe wuamgrd.exe landriver32.exe ...bitte bei Kaspersky und poste hier die Ergebnisse. http://www.kaspersky.com/de/scanforvirus In HijackThis markieren, Fix Checked wählen: O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL O4 - HKLM\..\Run: [Microsoft Update] wuamgrd.exe O4 - HKLM\..\Run: [Windows Autostart Loader] notepad32.exe O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\arahopq.exe O4 - HKLM\..\RunServices: [Microsoft Update] wuamgrd.exe O4 - HKLM\..\RunServices: [Windows Autostart Loader] notepad32.exe O4 - HKLM\..\RunServices: [LAN Driver] landriver32.exe O4 - HKCU\..\Run: [Microsoft Update] wuamgrd.exe O4 - HKCU\..\Run: [Windows Autostart Loader] notepad32.exe O4 - HKCU\..\RunServices: [Windows DLL host] "C:\WINDOWS\system32\drivers\etc\winupd\winupd32.exe" |
</font><blockquote>Zitat:</font><hr />Original erstellt von Falx: ok danke vielmals, hab das gemacht,</font>[/QUOTE]OK, dann kommt jetzt wenigstens erstmal nichts mehr nach. </font><blockquote>Zitat:</font><hr />also meinst das ich neu formatieren soll?</font>[/QUOTE]Wäre imho das sicherste, vor allem deine zukünftige Datensicherheit betreffend. Ohne die genauen Scanergebnisse zu kennen, vermute ich Backdoor.SDbot, Backdoor.Rbot und Backdoor.Agobot auf deinem System. </font><blockquote>Zitat:</font><hr />ich habe unter ausführen-msconfig mal die exe ausgeschalten, das hilft aba nix?</font>[/QUOTE]Kaum, vor allem dann nicht, wenn noch immer aktive Backdoors sich wieder in die Registry schreiben. Da hilft am ehesten: - Start des Systems im abgesicherten Modus. - Beenden etaige laufender Backdoorprozesse über Strg + Alt + Entf, Prozess markieren, Prozess beenden. - Löschen von Hand aller eben genannten Backdoordateien sowie der genannten Registry-Einträge mittels HijackThis. |
hallo, ich kann diese seite nicht öffnen, kaspersky.com ok ich probier das mal mit hijackthis, meld mich danach wieder |
</font><blockquote>Zitat:</font><hr />Original erstellt von Falx: hallo, ich kann diese seite nicht öffnen, kaspersky.com</font>[/QUOTE]Sorry, mein Fehler, ich habe nicht bedacht, dass bei aktivem Backdoor.Agobot die hosts-Datei manipuliert ist und somit ein Zugriff auf bestimmte AV-Seiten vom Backdoor unterbunden wird. Du kannst mir oder Rokop-Security diese Dateien auch zur Prüfung zusenden (E-Mail-Adressen siehe unten in meiner Signatur). |
hallo hab nun mal das gemacht was du vorgeschlagen hast, mein hijackthis sieht nun wie folgt aus, Logfile of HijackThis v1.97.7 Scan saved at 17:12:52, on 21.06.2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\CA\eTrust Antivirus\InoRpc.exe C:\Programme\CA\eTrust Antivirus\InoRT.exe C:\Programme\CA\eTrust Antivirus\InoTask.exe C:\Programme\CA\SharedComponents\CA_LIC\LogWatNT.exe C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\Dit.exe C:\PROGRA~1\CA\ETRUST~1\realmon.exe C:\WINDOWS\mHotkey.exe C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\System32\RunDll32.exe C:\WINDOWS\System32\PRISMSTA.EXE C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe C:\Programme\MSN Messenger\msnmsgr.exe C:\WINDOWS\CNYHKey.exe C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe C:\WINDOWS\DitExp.exe C:\Programme\Internet Explorer\Iexplore.exe C:\Dokumente und Einstellungen\gak1\Lokale Einstellungen\Temp\Temporäres Verzeichnis 2 für hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.medion.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.aldi.com O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s O4 - HKLM\..\Run: [CHotkey] mHotkey.exe O4 - HKLM\..\Run: [PCMService] "C:\Programme\Medion Home Cinema XL II\PowerCinema\PCMService.exe" O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [PRISMSTA.EXE] PRISMSTA.EXE START O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Programme\Gemeinsame Dateien\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Programme\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\gehiyi.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: Kontrollfeld für die kabellose Tastatur.lnk = C:\WINDOWS\CNYHKey.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE O14 - IERESET.INF: START_PAGE_URL=http://www.aldi.com O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...893.1583217593 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab wie kann ich dir den die dateien schicken? ich find sie nicht wenn ich sie suche, ich hab aber schon alle Dateien eingeblendet(auch versteckte) gruss, Stefan |
Den Eintrag noch fixen: O4 - HKLM\..\Run: [Windows Update] C:\WINDOWS\System32\gehiyi.exe Anstatt die nicht auffindbaren Dateien zu versenden ;) , lass dieses Tool noch drüberlaufen: http://www.trojaner-board.de/forum/u...c;f=6;t=005602 Wichtig: vorher die Signaturen updaten, wie beschrieben! |
hallo markus, ich lass grad den scanner drüberlaufen, schon seit über 30 minuten, 40 viren entdeckt,muss jetzt aber raus ausn internet, ich post den log später wenn ich heimkomm oder morgn, also danke vielmals,bis morgn, stefan |
ok der scann is fertig, hab 140 files gefunden, davon ca 70 deleted, der rest renamed, soll ich die ganzen files raussuchen und hier posten? ich hab noch immer das problem das mein internet richtig funktioniert, gibs noch irgendwelche tips? thanks im voraus, stefan |
</font><blockquote>Zitat:</font><hr />Original erstellt von Falx: ok der scann is fertig, hab 140 files gefunden, davon ca 70 deleted, der rest renamed, soll ich die ganzen files raussuchen und hier posten?</font>[/QUOTE]Ja, bitte aus dem Logfile die Infos zu den gelöschten und auch zu jenen, die nicht gelöscht werden konnten. </font><blockquote>Zitat:</font><hr />ich hab noch immer das problem das mein internet richtig funktioniert, gibs noch irgendwelche tips?</font>[/QUOTE]Wenn die Auswertung der LogFiles nichts bringt: Neuafsetzen des Systems (was ich eh nahelegen würde. Grund: zu viel Schadsoftware). Wichtig aber: dann VOR der ersten Internetverbindung Absicherungsmaßnahmen treffen. Wie gehst du ins Netz? DFÜ-Verbindung? |
ok hier die files, Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[11].exe Mon Jun 21 17:52:50 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[11].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[12].exe Mon Jun 21 17:52:50 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[12].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[13].exe Mon Jun 21 17:52:50 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[13].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[14].exe Mon Jun 21 17:52:50 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[14].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[15].exe Mon Jun 21 17:52:50 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[15].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[16].exe Mon Jun 21 17:52:50 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[16].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[17].exe Mon Jun 21 17:52:50 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[17].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[18].exe Mon Jun 21 17:52:50 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[18].exe infected by "Worm.Win32.Padobot.i" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[19].exe Mon Jun 21 17:52:50 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[1].exe Mon Jun 21 17:52:51 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[1].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:51 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[2].exe Mon Jun 21 17:52:51 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[2].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:51 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[3].exe Mon Jun 21 17:52:51 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[3].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:51 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[4].exe Mon Jun 21 17:52:51 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[4].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:51 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[5].exe Mon Jun 21 17:52:51 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[5].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:51 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[6].exe Mon Jun 21 17:52:51 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[6].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:51 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[7].exe Mon Jun 21 17:52:51 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[7].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:51 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[8].exe Mon Jun 21 17:52:51 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[8].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:51 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[9].exe Mon Jun 21 17:52:51 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\45STQRWT\x[9].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:56 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\pb24[1].exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed. Mon Jun 21 17:52:56 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[10].exe Mon Jun 21 17:52:56 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[10].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:56 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[11].exe Mon Jun 21 17:52:56 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[11].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:56 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[12].exe Mon Jun 21 17:52:56 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[12].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:56 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[13].exe [**] Mon Jun 21 17:52:56 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[9].exe Mon Jun 21 17:52:56 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\EXYZI563\x[9].exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 17:52:56 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\index.dat Mon Jun 21 17:52:56 2004 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SYSTEM~1\LOKALE~1\TEMPOR~1\Content.IE5\index.dat Mon Jun 21 17:52:56 2004 => Scanning Folder: C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ITONWRY5\*.* Mon Jun 21 17:52:56 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ITONWRY5\desktop.ini Mon Jun 21 17:52:56 2004 => Scanning File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ITONWRY5\pb22[1].exe Mon Jun 21 17:53:01 2004 => File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\ITONWRY5\pb22[1].exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed. Mon Jun 21 17:55:22 2004 => File C:\WINDOWS\system32\wssvr.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 17:55:23 2004 => File C:\WINDOWS\system32\wuamgrd.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 17:55:30 2004 => File C:\34c.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 17:57:45 2004 => File C:\Dokumente und Einstellungen\gak1\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CLEV8HQV\s-phx12[1].exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 18:17:45 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005539.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken. Mon Jun 21 18:17:47 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005566.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:17:47 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005567.exe Mon Jun 21 18:17:47 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005567.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:17:47 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005568.exe Mon Jun 21 18:17:48 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005568.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:17:50 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005590.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:17:50 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005596.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:17:51 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005608.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:17:52 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP21\A0005611.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:17:56 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005784.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken. Mon Jun 21 18:17:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005809.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:17:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005810.exe Mon Jun 21 18:17:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005810.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:17:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005811.exe Mon Jun 21 18:17:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP23\A0005811.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:05 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005945.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken Mon Jun 21 18:18:07 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005968.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:07 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005969.exe Mon Jun 21 18:18:07 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005969.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:07 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005970.exe Mon Jun 21 18:18:07 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005970.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action ken: File Deleted. TaMon Jun 21 18:18:09 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005991.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken Mon Jun 21 18:18:09 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0005997.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:18:10 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0006011.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:18:11 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP25\A0006014.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:18:15 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006135.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken. Mon Jun 21 18:18:18 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006172.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:18 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006173.exe Mon Jun 21 18:18:18 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006173.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:18 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006174.exe Mon Jun 21 18:18:18 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP27\A0006174.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:30 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006524.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken. Mon Jun 21 18:18:31 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006537.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:31 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006538.exe Mon Jun 21 18:18:31 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006538.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:31 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006539.exe Mon Jun 21 18:18:31 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006540.exe Mon Jun 21 18:18:31 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006540.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:34 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006573.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:18:35 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006579.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:18:35 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006594.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:18:36 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP30\A0006597.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:18:51 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007143.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:51 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007144.exe Mon Jun 21 18:18:51 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007144.exe tagged as not-a-virus:RiskWare.Tool.HideWindows. No Action Taken. Mon Jun 21 18:18:51 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007145.exe Mon Jun 21 18:18:51 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007145.exe infected by "Trojan.Win32.VB.is" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:51 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007146.dll Mon Jun 21 18:18:51 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007146.dll infected by "Exploit.CAN-2003-0533" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:51 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007147.exe Mon Jun 21 18:18:52 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007147.exe infected by "Exploit.Win32.DameWare.f" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:52 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007148.exe Mon Jun 21 18:18:52 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007148.exe infected by "Exploit.IIS.Ssl.02" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:52 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007149.dll Mon Jun 21 18:18:52 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007149.dll infected by "Exploit.Win32.Locator.b" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:52 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007150.exe Mon Jun 21 18:18:52 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007150.exe infected by "HackTool.Win32.Mydoomer.b" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:52 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007151.exe Mon Jun 21 18:18:52 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007151.exe infected by "Exploit.Win32.Imail.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:52 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007152.exe Mon Jun 21 18:18:53 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007152.exe infected by "Backdoor.PsyBot.a" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007199.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007200.exe Mon Jun 21 18:18:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007200.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007201.exe Mon Jun 21 18:18:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007201.exe tagged as not-a-virus:RiskWare.Tool.HideWindows. No Action Taken. Mon Jun 21 18:18:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007202.exe Mon Jun 21 18:18:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007202.exe infected by "Trojan.Win32.VB.is" Virus. Action Taken: File Deleted. Mon Jun 21 18:18:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007203.dll Mon Jun 21 18:18:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007203.dll infected by "Exploit.CAN-2003-0533" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007204.exe Mon Jun 21 18:18:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007204.exe infected by "Exploit.Win32.DameWare.f" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007205.exe Mon Jun 21 18:18:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007205.exe infected by "Exploit.IIS.Ssl.02" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007206.dll Mon Jun 21 18:18:58 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007206.dll infected by "Exploit.Win32.Locator.b" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:58 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007207.exe Mon Jun 21 18:18:59 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007207.exe infected by "HackTool.Win32.Mydoomer.b" Virus. Action Taken: File Renamed. Mon Jun 21 18:18:59 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007208.exe Mon Jun 21 18:18:59 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP32\A0007208.exe infected by "Exploit.Win32.Imail.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:06 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007364.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken Mon Jun 21 18:19:08 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007384.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:08 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007385.dll Mon Jun 21 18:19:08 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007386.exe Mon Jun 21 18:19:08 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007386.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:08 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007387.dll Mon Jun 21 18:19:08 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007388.exe Mon Jun 21 18:19:08 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007388.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:10 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007410.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:19:11 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007416.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:19:11 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007430.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:19:12 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007433.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:19:12 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP36\A0007450.exe infected by "Worm.Win32.Padobot.gen" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:15 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007541.dll tagged as not-a-virus:AdvWare.Cydoor. No Action Taken. Mon Jun 21 18:19:18 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007568.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:18 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007569.exe Mon Jun 21 18:19:18 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007569.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:18 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007570.exe Mon Jun 21 18:19:18 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007570.exe infected by "TrojanDownloader.Win32.Keenval" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:21 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007607.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:19:21 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007613.dll tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:19:22 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007623.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:19:22 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007626.exe tagged as not-a-virus:AdvWare.Gator. No Action Taken. Mon Jun 21 18:19:22 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007627.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:29 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007679.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:29 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007680.exe Mon Jun 21 18:19:29 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007680.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:29 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007681.exe Mon Jun 21 18:19:29 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007681.exe tagged as not-a-virus:RiskWare.Tool.HideWindows. No Action Taken. Mon Jun 21 18:19:29 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007682.exe Mon Jun 21 18:19:29 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007682.exe infected by "Trojan.Win32.VB.is" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:29 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007683.dll Mon Jun 21 18:19:29 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007683.dll infected by "Exploit.CAN-2003-0533" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:29 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007684.exe Mon Jun 21 18:19:30 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007684.exe infected by "Exploit.Win32.DameWare.f" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:30 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007685.exe Mon Jun 21 18:19:30 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007685.exe infected by "Exploit.IIS.Ssl.02" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:30 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007686.dll Mon Jun 21 18:19:30 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007686.dll infected by "Exploit.Win32.Locator.b" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:30 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007687.exe Mon Jun 21 18:19:30 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007687.exe infected by "HackTool.Win32.Mydoomer.b" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:30 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007688.exe Mon Jun 21 18:19:30 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007688.exe infected by "Exploit.Win32.Imail.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:32 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP38\A0007809.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:34 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP39\A0007860.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:35 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP40\A0007863.exe infected by "HackTool.Win32.Mydoomer.b" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:42 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP41\A0008068.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:42 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP41\A0008069.exe Mon Jun 21 18:19:42 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP41\A0008069.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:42 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP41\A0008094.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:47 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011220.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:48 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011249.exe infected by "Worm.Win32.Padobot.h" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:48 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011264.exe infected by "Worm.Win32.Padobot.i" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:49 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011295.exe infected by "Exploit.Win32.DameWare.f" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:49 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011296.exe Mon Jun 21 18:19:49 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011296.exe infected by "Exploit.IIS.Ssl.02" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:49 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011297.exe Mon Jun 21 18:19:49 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011297.exe infected by "Exploit.Win32.Imail.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:49 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011298.dll Mon Jun 21 18:19:49 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011298.dll infected by "Exploit.Win32.Locator.b" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:49 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011299.exe Mon Jun 21 18:19:49 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011299.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:49 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011300.dll Mon Jun 21 18:19:50 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011300.dll infected by "Exploit.CAN-2003-0533" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:50 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011301.exe Mon Jun 21 18:19:50 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011301.exe infected by "Trojan.Win32.VB.is" Virus. Action Taken: File Deleted. Mon Jun 21 18:19:50 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011302.exe Mon Jun 21 18:19:50 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011302.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:50 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011303.exe Mon Jun 21 18:19:50 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011303.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:50 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011304.exe Mon Jun 21 18:19:50 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011304.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:50 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011305.exe Mon Jun 21 18:19:51 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011305.exe infected by "Backdoor.Rbot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:51 2004 => Scanning File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011306.exe Mon Jun 21 18:19:51 2004 => File C:\System Volume Information\_restore{D2189254-3B7A-40F6-B5A2-1BE8640521E9}\RP42\A0011306.exe infected by "Backdoor.Agobot.gen" Virus. Action Taken: File Renamed. Mon Jun 21 18:19:56 2004 => File C:\win2k3.exe infected by "Exploit.Win32.RPCLsa.01.c" Virus. Action Taken: File Renamed. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 22:18 Uhr. |
Copyright ©2000-2025, Trojaner-Board