Re: Backdoor.Agobot.ad was soll ich tun?
Logfile of HijackThis v1.98.0
Scan saved at 10:46:20, on 2004-09-20
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
E:\Tools\Sicherheit\F-Secure\Common\FSM32.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Gadu-Gadu 6.0\Gadu-Gadu\gg.exe
E:\Tools\SICHER~1\F-Secure\backweb\4476822\Program\SERVIC~1.EXE
E:\Tools\Diskeeper 8.0\DkService.exe
E:\Tools\Sicherheit\F-Secure\Anti-Virus\fsgk32st.exe
E:\Tools\Sicherheit\F-Secure\Anti-Virus\FSGK32.EXE
E:\Tools\Sicherheit\F-Secure\backweb\4476822\program\fsbwsys.exe
E:\Tools\Sicherheit\F-Secure\backweb\4476822\Program\BackWeb-4476822.exe
E:\Tools\Sicherheit\F-Secure\Common\FSMA32.EXE
E:\Tools\Sicherheit\F-Secure\Anti-Virus\fssm32.exe
E:\Tools\Sicherheit\F-Secure\Common\FSMB32.EXE
C:\NORTON~1\NORTON~3\GHOSTS~2.EXE
E:\Tools\Sicherheit\F-Secure\Common\FCH32.EXE
E:\Tools\Sicherheit\F-Secure\Common\FAMEH32.EXE
E:\Tools\Sicherheit\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
E:\Hacken\NMapWin\bin\nmapserv.exe
C:\NORTON~1\NORTON~1\NPROTECT.EXE
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
E:\Tools\Sicherheit\F-Secure\FWES\Program\fsdfwd.exe
E:\BitTorrent\btdownloadgui.exe
E:\BitTorrent\btdownloadgui.exe
E:\HP 435\HP Share-to-Web\hpgs2wnf.exe
E:\BitTorrent\btdownloadgui.exe
E:\FireFox 0.9.2\firefox.exe
E:\Programme\Tlen.pl\tlen.exe
E:\Programme\Office XP\Office10\WINWORD.EXE
E:\Programme\Office XP\Office10\EXCEL.EXE
E:\Tools\Sicherheit\HiJackthis 1.98\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F0 - system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [F-Secure Manager] "E:\Tools\Sicherheit\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "E:\Tools\Sicherheit\F-Secure\TNB\TNBUtil.exe" /CHECKALL
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Programme\Gadu-Gadu 6.0\Gadu-Gadu\gg.exe" /tray
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{C2FD7510-11F2-4CB7-B98D-70CA4271F051}: NameServer = 10.101.1.1,194.204.159.1
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
