![]() |
Hallo Das Tool CDShredder hatte mir gerade einen Trojaner Namen ausgespuckt und zwar Coolwebsearch Trojan (CWS Smartsearch2).Ich hoffe da hilft weiter. MFG Chefkoch74 |
Suche mal die Datei mwXface.log und poste deren Inhalt. Danach sind wir hoffentlich schlauer. ;) |
Hallo So habe ich gefunden.Hier das ergebniss [0x00000b30] 22/09/2004 09:32:57:265 :[msvLclnt.dll]ModuleName = C:\Bases\mwavscan.com [0x00000b30] 22/09/2004 09:32:57:265 :[msvLclnt.dll]Registry Key Deleted Properly!!! [0x00000b30] 22/09/2004 09:32:57:968 :[msvLclnt.dll]Options Set by External applications mwavscan.com are 9896960 (0x970400): [0x00000b30] 22/09/2004 09:32:57:968 :[msvLclnt.dll]Mode :PACKED,ARCHIVED,CA,WARNINGS,MAILPLAIN [0x00000b30] 22/09/2004 09:32:57:968 :[msvLclnt.dll]TimeOut : ffffffff [0x00000b30] 22/09/2004 09:32:57:968 :[msvLclnt.dll]Priority : NORMAL [0x00000b30] 22/09/2004 09:32:58:234 :[msvLclnt.dll]VirusCount = 104407 Latest Date = 2004/09/22 [0x00000d48] 22/09/2004 09:33:26:187 :[msvLclnt.dll][00000001] File C:\WINDOWS\System32\phji.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 09:33:27:781 :[msvLclnt.dll][00000001] File C:\WINDOWS\System32\phji.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 09:35:13:953 :[msvLclnt.dll][00000001] File C:\WINDOWS\System32\TFTP988 infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 09:35:14:609 :[msvLclnt.dll][00000001] File C:\WINDOWS\System32\TFTP988 infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 09:35:20:640 :[msvLclnt.dll][00000001] File C:\WINDOWS\System32\vpc32.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 09:35:21:281 :[msvLclnt.dll][00000001] File C:\WINDOWS\System32\vpc32.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 09:50:58:875 :[msvLclnt.dll][00000001] File C:\Dokumente und Einstellungen\Marco\Lokale Einstellungen\Temporary Internet Files\Content.IE5\UFMN0BUR\rbot[1].exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 09:50:59:406 :[msvLclnt.dll][00000001] File C:\Dokumente und Einstellungen\Marco\Lokale Einstellungen\Temporary Internet Files\Content.IE5\UFMN0BUR\rbot[1].exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 09:52:45:718 :[msvLclnt.dll][00000001] File C:\Programme\AVPersonal\INFECTED\A0031071.EXE.VIR infected by Worm.Win32.Welchia.b [0x00000d48] 22/09/2004 09:52:45:734 :[msvLclnt.dll][00000001] File C:\Programme\AVPersonal\INFECTED\A0031071.EXE.VIR infected by Worm.Win32.Welchia.b [0x00000d48] 22/09/2004 09:52:45:796 :[msvLclnt.dll][00000001] File C:\Programme\AVPersonal\INFECTED\A0097850.EXE.VIR infected by Worm.Win32.Welchia.e [0x00000d48] 22/09/2004 09:52:45:843 :[msvLclnt.dll][00000001] File C:\Programme\AVPersonal\INFECTED\A0097850.EXE.VIR infected by Worm.Win32.Welchia.e [0x00000d48] 22/09/2004 09:52:46:171 :[msvLclnt.dll][00000001] File C:\Programme\AVPersonal\INFECTED\SVCHOST.EXE.001 infected by Worm.Win32.Welchia.e [0x00000d48] 22/09/2004 09:52:46:187 :[msvLclnt.dll][00000001] File C:\Programme\AVPersonal\INFECTED\SVCHOST.EXE.001 infected by Worm.Win32.Welchia.e [0x00000d48] 22/09/2004 10:05:19:671 :[msvLclnt.dll][00000001] File C:\System Volume Information\_restore{7EDC81A1-6DF4-4C16-9F1B-7ED7F2CBF85B}\RP318\A0110527.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 10:05:20:359 :[msvLclnt.dll][00000001] File C:\System Volume Information\_restore{7EDC81A1-6DF4-4C16-9F1B-7ED7F2CBF85B}\RP318\A0110527.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 10:05:45:468 :[msvLclnt.dll][00000001] File C:\System Volume Information\_restore{7EDC81A1-6DF4-4C16-9F1B-7ED7F2CBF85B}\RP324\A0113902.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 10:05:46:109 :[msvLclnt.dll][00000001] File C:\System Volume Information\_restore{7EDC81A1-6DF4-4C16-9F1B-7ED7F2CBF85B}\RP324\A0113902.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 10:05:59:625 :[msvLclnt.dll][00000001] File C:\System Volume Information\_restore{7EDC81A1-6DF4-4C16-9F1B-7ED7F2CBF85B}\RP332\A0116032.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 10:06:00:062 :[msvLclnt.dll][00000001] File C:\System Volume Information\_restore{7EDC81A1-6DF4-4C16-9F1B-7ED7F2CBF85B}\RP332\A0116032.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 10:06:00:734 :[msvLclnt.dll][00000001] File C:\System Volume Information\_restore{7EDC81A1-6DF4-4C16-9F1B-7ED7F2CBF85B}\RP332\A0116033.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 10:06:01:375 :[msvLclnt.dll][00000001] File C:\System Volume Information\_restore{7EDC81A1-6DF4-4C16-9F1B-7ED7F2CBF85B}\RP332\A0116033.exe infected by Backdoor.Rbot.gen [0x00000d48] 22/09/2004 10:12:31:671 :[msvLclnt.dll][00000001] File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CXSF6RER\WksPatch[7].exe infected by Worm.Win32.Welchia.e [0x00000d48] 22/09/2004 10:12:31:703 :[msvLclnt.dll][00000001] File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CXSF6RER\WksPatch[7].exe infected by Worm.Win32.Welchia.e [0x00000d48] 22/09/2004 10:12:31:828 :[msvLclnt.dll][00000001] File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\MRC32FO5\WksPatch[5].exe infected by Worm.Win32.Welchia.h [0x00000d48] 22/09/2004 10:12:31:828 :[msvLclnt.dll][00000001] File C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Temporary Internet Files\Content.IE5\MRC32FO5\WksPatch[5].exe infected by Worm.Win32.Welchia.h [0x00000d48] 22/09/2004 10:13:36:265 :[msvLclnt.dll][00000001] File C:\WINDOWS\system32\drivers\etc\hosts infected by Trojan.Win32.Qhost [0x00000d48] 22/09/2004 10:13:36:281 :[msvLclnt.dll][00000001] File C:\WINDOWS\system32\drivers\etc\hosts infected by Trojan.Win32.Qhost [0x00000d48] 22/09/2004 10:27:16:265 :[msvLclnt.dll]VirusCount = 104407 Latest Date = 2004/09/22 [0x00000a20] 22/09/2004 12:42:34:890 :[msvLclnt.dll]ModuleName = C:\Bases\mwavscan.com [0x00000a20] 22/09/2004 12:42:34:890 :[msvLclnt.dll]Registry Key Deleted Properly!!! [0x00000a20] 22/09/2004 12:42:36:062 :[msvLclnt.dll]Options Set by External applications mwavscan.com are 9896960 (0x970400): [0x00000a20] 22/09/2004 12:42:36:062 :[msvLclnt.dll]Mode :PACKED,ARCHIVED,CA,WARNINGS,MAILPLAIN [0x00000a20] 22/09/2004 12:42:36:062 :[msvLclnt.dll]TimeOut : ffffffff [0x00000a20] 22/09/2004 12:42:36:062 :[msvLclnt.dll]Priority : NORMAL [0x00000a20] 22/09/2004 12:42:36:281 :[msvLclnt.dll]VirusCount = 104407 Latest Date = 2004/09/22 [0x00000bac] 22/09/2004 13:42:23:312 :[msvLclnt.dll]VirusCount = 104407 Latest Date = 2004/09/22 [0x00000880] 22/09/2004 14:48:31:937 :[msvLclnt.dll]VirusCount = 104407 Latest Date = 2004/09/22 [0x00000a20] 22/09/2004 16:22:06:968 :[msvLclnt.dll]VirusCount = 104407 Latest Date = 2004/09/22 sieht ja gar nicht so gut aus. MFG Chefkoch74 |
Alle Zeitangaben in WEZ +1. Es ist jetzt 08:02 Uhr. |
Copyright ©2000-2025, Trojaner-Board