Hier finden Sie den vollständigen Artikel

Gizmo · Verfasst am: Fr Nov 21, 2008 0:07 Titel: Virus

Leutz ;-)

obacht
ein virus/tojaner/malware ist zur Zeit in umlauf :evil:

scannt mal euren Rechner mit sypbot und eure Antir gleichzeitig durch

das böse ding :( versteckt unter anderem in

*************************************************************
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{f6a7ccb9-cdbf-4f92-810e-284f0785d6c0}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.201;85.255.112.169 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{f6a7ccb9-cdbf-4f92-810e-284f0785d6c0}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.201;85.255.112.169 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{f6a7ccb9-cdbf-4f92-810e-284f0785d6c0}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.201;85.255.112.169 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{f6a7ccb9-cdbf-4f92-810e-284f0785d6c0}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.201;85.255.112.169 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{f6a7ccb9-cdbf-4f92-810e-284f0785d6c0}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.201;85.255.112.169 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{f6a7ccb9-cdbf-4f92-810e-284f0785d6c0}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.201;85.255.112.169 -> Quarantined and deleted successfully.

Folders Infected:
C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
C:\Windows\System32\TDSScrrx.dll (Rootkit.Agent) -> Delete on reboot.
C:\Windows\System32\TDSSdotf.dll (Rootkit.Agent) -> Delete on reboot.
C:\Windows\System32\TDSSfopt.dll (Rootkit.Agent) -> Delete on reboot.
C:\Windows\System32\TDSSntlv.dll (Rootkit.Agent) -> Delete on reboot.
C:\Windows\System32\TDSSnyfn.log (Trojan.TDSS) -> Delete on reboot.
C:\Windows\System32\TDSSrfpp.dll (Rootkit.Agent) -> Delete on reboot.
C:\Windows\System32\TDSStmei.dll (Rootkit.Agent) -> Delete on reboot.
C:\Windows\System32\drivers\TDSSnbcb.sys (Rootkit.Agent) -> Delete on reboot.
*************************************************************

falls probleme beim problem lösen geben sollte , einfach fragen