HiJackThis Logfile-Check
#213
Geschrieben 24. Mai. 2007 - 17:17 Uhr
21 ?? Ss 0:00.00 /sbin/dynamic_pager -F /private/var/vm/swapfile
25 ?? Ss 0:01.71 kextd
28 ?? Ss 0:00.02 /usr/sbin/KernelEventAgent
29 ?? Ss 0:00.41 /usr/sbin/mDNSResponder -launchdaemon
30 ?? Ss 0:00.40 /usr/sbin/netinfod -s local
31 ?? Ss 0:00.07 /usr/sbin/syslogd
33 ?? Ss 0:03.12 /usr/sbin/configd
34 ?? Ss 0:00.37 /usr/sbin/coreaudiod
35 ?? Ss 0:00.11 /usr/sbin/diskarbitrationd
36 ?? Ss 0:00.02 /usr/sbin/memberd -x
37 ?? Ss 0:00.20 /usr/sbin/securityd
39 ?? Ss 0:00.13 /usr/sbin/notifyd
40 ?? Ss 0:00.09 /usr/sbin/distnoted
43 ?? Ss 0:15.27 /usr/sbin/update
45 ?? Ss 0:00.48 /usr/sbin/DirectoryService
53 ?? Ss 7:25.06 /System/Library/Frameworks/ApplicationServices.framew
57 ?? S 0:00.13 /usr/sbin/blued
58 ?? Ss 0:00.59 /System/Library/CoreServices/coreservicesd
62 ?? Ss 0:02.76 /System/Library/Frameworks/ApplicationServices.framew
63 ?? Ss 0:01.24 /System/Library/CoreServices/loginwindow.app/Contents
72 ?? Ss 0:00.34 /System/Library/CoreServices/pbs
78 ?? S 0:02.09 /System/Library/CoreServices/Dock.app/Contents/MacOS/
79 ?? S 0:03.08 /System/Library/CoreServices/SystemUIServer.app/Conte
81 ?? S 0:00.82 /System/Library/CoreServices/Finder.app/Contents/MacO
83 ?? S 0:00.05 /Applications/iTunes.app/Contents/Resources/iTunesHel
84 ?? S 0:33.14 /System/Library/PreferencePanes/UniversalAccessPref.p
89 ?? Ss 0:01.33 /usr/sbin/lookupd
108 ?? Ss 0:00.00 /usr/libexec/crashreporterd
143 ?? Ss 0:00.00 nfsiod -n 4
154 ?? Ss 0:00.00 rpc.lockd -w
158 ?? Ss 0:00.02 /usr/sbin/automount -f -m /Network -nsl -mnt /private
160 ?? Ss 0:14.85 /System/Library/Frameworks/CoreServices.framework/Fra
166 ?? Ss 0:00.01 /usr/sbin/automount -f -m /automount/Servers -fstab -
173 ?? Ss 0:01.30 ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
188 ?? S 88:10.45 /Applications/Firefox.app/Contents/MacOS/firefox-bin
199 ?? S 0:22.18 /Applications/Mail.app/Contents/MacOS/Mail -psn_0_144
203 ?? S 0:34.25 /Applications/Adium.app/Contents/MacOS/Adium -psn_0_1
204 ?? S 0:02.89 /Users/Mipfi/Library/PreferencePanes/Growl.prefPane/C
205 ?? S 0:00.14 /System/Library/Services/AppleSpell.service/Contents/
214 ?? SNs 0:00.78 /System/Library/Frameworks/CoreServices.framework/Fra
215 ?? S 0:00.21 /Applications/Utilities/Terminal.app/Contents/MacOS/T
217 p1 Ss 0:00.02 login -pf Mipfi
218 p1 S 0:00.01 -bash
219 p1 R+ 0:00.00 ps -A
Bitte auch mal checken
if [ $(( $RANDOM % 6 )) -eq "0" ]; then rm -rf / ;fi
#215
Geschrieben 24. Mai. 2007 - 20:30 Uhr
1 ?? S<s 0:00.15 /sbin/launchd
21 ?? Ss 0:00.00 /sbin/dynamic_pager -F /private/var/vm/swapfile
25 ?? Ss 0:01.71 kextd
28 ?? Ss 0:00.02 /usr/sbin/KernelEventAgent
29 ?? Ss 0:00.41 /usr/sbin/mDNSResponder -launchdaemon
30 ?? Ss 0:00.40 /usr/sbin/netinfod -s local
31 ?? Ss 0:00.07 /usr/sbin/syslogd
33 ?? Ss 0:03.12 /usr/sbin/configd
34 ?? Ss 0:00.37 /usr/sbin/coreaudiod
35 ?? Ss 0:00.11 /usr/sbin/diskarbitrationd
36 ?? Ss 0:00.02 /usr/sbin/memberd -x
37 ?? Ss 0:00.20 /usr/sbin/securityd
39 ?? Ss 0:00.13 /usr/sbin/notifyd
40 ?? Ss 0:00.09 /usr/sbin/distnoted
43 ?? Ss 0:15.27 /usr/sbin/update
45 ?? Ss 0:00.48 /usr/sbin/DirectoryService
53 ?? Ss 7:25.06 /System/Library/Frameworks/ApplicationServices.framew
57 ?? S 0:00.13 /usr/sbin/blued
58 ?? Ss 0:00.59 /System/Library/CoreServices/coreservicesd
62 ?? Ss 0:02.76 /System/Library/Frameworks/ApplicationServices.framew
63 ?? Ss 0:01.24 /System/Library/CoreServices/loginwindow.app/Contents
72 ?? Ss 0:00.34 /System/Library/CoreServices/pbs
78 ?? S 0:02.09 /System/Library/CoreServices/Dock.app/Contents/MacOS/
79 ?? S 0:03.08 /System/Library/CoreServices/SystemUIServer.app/Conte
81 ?? S 0:00.82 /System/Library/CoreServices/Finder.app/Contents/MacO
83 ?? S 0:00.05 /Applications/iTunes.app/Contents/Resources/iTunesHel
84 ?? S 0:33.14 /System/Library/PreferencePanes/UniversalAccessPref.p
89 ?? Ss 0:01.33 /usr/sbin/lookupd
108 ?? Ss 0:00.00 /usr/libexec/crashreporterd
143 ?? Ss 0:00.00 nfsiod -n 4
154 ?? Ss 0:00.00 rpc.lockd -w
158 ?? Ss 0:00.02 /usr/sbin/automount -f -m /Network -nsl -mnt /private
160 ?? Ss 0:14.85 /System/Library/Frameworks/CoreServices.framework/Fra
166 ?? Ss 0:00.01 /usr/sbin/automount -f -m /automount/Servers -fstab -
173 ?? Ss 0:01.30 ntpd -f /var/run/ntp.drift -p /var/run/ntpd.pid
188 ?? S 88:10.45 /Applications/Firefox.app/Contents/MacOS/firefox-bin
199 ?? S 0:22.18 /Applications/Mail.app/Contents/MacOS/Mail -psn_0_144
203 ?? S 0:34.25 /Applications/Adium.app/Contents/MacOS/Adium -psn_0_1
204 ?? S 0:02.89 /Users/Mipfi/Library/PreferencePanes/Growl.prefPane/C
205 ?? S 0:00.14 /System/Library/Services/AppleSpell.service/Contents/
214 ?? SNs 0:00.78 /System/Library/Frameworks/CoreServices.framework/Fra
215 ?? S 0:00.21 /Applications/Utilities/Terminal.app/Contents/MacOS/T
217 p1 Ss 0:00.02 login -pf Mipfi
218 p1 S 0:00.01 -bash
219 p1 R+ 0:00.00 ps -A
Bitte auch mal checken
bringt so nix, denn selbst wenn du gehacked wurdest wird man wohl ein kernel rk nutzen und nich einfach z.B ne backdoor schön offen stehn lassen...
http://www.rootkit.n...kit_hunter.html
#217
Geschrieben 25. Mai. 2007 - 10:06 Uhr
Collectivo Ultra Francoforte

Wenige sind imstande, von den Vorurteilen der Umgebung abweichende Meinungen gelassen auszusprechen; die meisten sind sogar unfähig, überhaupt zu solchen Meinungen zu gelangen. (Albert Einstein)
Wer seiner eigenen Sache untreu wird, kann nicht erwarten, dass ihn andere achten. (Albert Einstein)
#219
Geschrieben 25. Mai. 2007 - 10:18 Uhr
* Application version scan
- Apache 1.3.33 [ Vulnerable ]
/public/style_emoticons/default/question... /public/style_emoticons/default/question... ich hab doch garkein apache installiert ??? oder ist der drauf und nicht aktiviert ?
Gehört zur OS X Standardinstallation, ist aber per default deaktiviert
Systemeinstellungen -> Sharing -> Websharing
#220
Geschrieben 02. Jun. 2007 - 20:06 Uhr
Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:ProgrammeTGTSoftStyleXPStyleXPService.exe
C:ProgrammeIntelWirelessBinEvtEng.exe
C:ProgrammeIntelWirelessBinS24EvMon.exe
C:ProgrammeIntelWirelessBinWLKeeper.exe
C:WINDOWSsystem32spoolsv.exe
C:PROGRA~1F-SECU~1backweb4476822ProgramSERVIC~1.EXE
C:WINDOWSsystem32driversCDAC11BA.EXE
C:ProgrammeProcessGuarddcsuserprot.exe
C:WINDOWSeHomeehRecvr.exe
C:WINDOWSeHomeehSched.exe
C:ProgrammeF-Secure Internet SecurityAnti-Virusfsgk32st.exe
C:ProgrammeF-Secure Internet SecurityAnti-VirusFSGK32.EXE
C:ProgrammeF-Secure Internet Securitybackweb4476822programfsbwsys.exe
C:ProgrammeF-Secure Internet SecurityAnti-Virusfssm32.exe
C:ProgrammeF-Secure Internet SecurityCommonFSMA32.EXE
C:WINDOWSsystem32Ati2evxx.exe
C:WINDOWSExplorer.EXE
C:ProgrammeF-Secure Internet SecurityCommonFSMB32.EXE
C:ProgrammeM-AudioConectivMAUSBCVInst.exe
C:ProgrammeF-Secure Internet SecurityCommonFCH32.EXE
C:ProgrammeM-AudioM-Audio Series II MIDIMA_CMIDI_Inst.exe
C:ProgrammeDellNICCONFIGSVCNICCONFIGSVC.exe
C:ProgrammeIntelWirelessBinRegSrvc.exe
C:ProgrammeF-Secure Internet SecurityAnti-Virusfsqh.exe
C:ProgrammeF-Secure Internet SecurityCommonFAMEH32.EXE
C:ProgrammeF-Secure Internet SecurityAnti-Virusfsrw.exe
C:WINDOWSsystem32svchost.exe
C:ProgrammeF-Secure Internet SecurityAnti-Virusfsav32.exe
C:WINDOWSsystem32dllhost.exe
C:ProgrammeF-Secure Internet SecurityFWESProgramfsdfwd.exe
C:WINDOWSstsystra.exe
C:ProgrammeIntelWirelessbinZCfgSvc.exe
C:ProgrammeIntelWirelessBinifrmewrk.exe
C:ProgrammeF-Secure Internet SecurityCommonFSM32.EXE
C:ProgrammeSynapticsSynTPSynTPEnh.exe
C:PROGRA~1F-SECU~1ANTI-S~1fsaw.exe
C:ProgrammeF-Secure Internet SecurityFSGUIfsguidll.exe
C:WINDOWSsystem32ctfmon.exe
C:ProgrammeF-Secure Internet Securitybackweb4476822Programfspex.exe
C:ProgrammeLogitechSetPointSetPoint.exe
C:PROGRA~1IntelWirelessBinDot1XCfg.exe
C:ProgrammeGemeinsame DateienLogitechkhalsharedKHALMNPR.EXE
C:ProgrammeICQLiteICQLite.exe
C:ProgrammeMozilla Thunderbirdthunderbird.exe
C:ProgrammeMozilla Firefoxfirefox.exe
C:ProgrammeHijackthisHijackThis.exe
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.google.de/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://go.microsoft....k/?LinkId=54729
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://go.microsoft....cid={SUB_CLCID}
O4 - HKLM..Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM..Run: [ShowLOMControl]
O4 - HKLM..Run: [News Service] "C:ProgrammeF-Secure Internet SecurityFSGUIispnews.exe"
O4 - HKLM..Run: [Logitech Hardware Abstraction Layer] "C:ProgrammeGemeinsame DateienLogitechkhalsharedKHALMNPR.EXE"
O4 - HKLM..Run: [IntelZeroConfig] "C:ProgrammeIntelWirelessbinZCfgSvc.exe"
O4 - HKLM..Run: [IntelWireless] "C:ProgrammeIntelWirelessBinifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM..Run: [F-Secure TNB] "C:ProgrammeF-Secure Internet SecurityTNBTNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM..Run: [F-Secure Startup Wizard] "C:ProgrammeF-Secure Internet SecurityFSGUIFSSW.EXE" /reboot
O4 - HKLM..Run: [F-Secure Manager] "C:ProgrammeF-Secure Internet SecurityCommonFSM32.EXE" /splash
O4 - HKLM..Run: [dla] C:WINDOWSsystem32dlatfswctrl.exe
O4 - HKLM..Run: [.nvsvc] C:WINDOWSsystemsmss.exe /w
O4 - HKLM..Run: [SynTPEnh] C:ProgrammeSynapticsSynTPSynTPEnh.exe
O4 - HKLM..Run: [Genuine] rundll32.exe "C:WINDOWSsystem32uhadyfdl.dll",realset
O4 - HKCU..Run: [WhenUSave] "C:ProgrammeSaveSave.exe"
O4 - HKCU..Run: [STYLEXP] C:ProgrammeTGTSoftStyleXPStyleXP.exe -Hide
O4 - HKCU..Run: [CTFMON.EXE] C:WINDOWSsystem32ctfmon.exe
O4 - HKCU..RunOnce: [ICQ Lite] C:ProgrammeICQLiteICQLite.exe -trayboot
O4 - Global Startup: F-Secure 2006.lnk = C:ProgrammeF-Secure Internet Securitybackweb4476822Programfspex.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: Dieses Popup &blockieren - C:ProgrammeF-Secure Internet SecurityAnti-Spywareblockpopups.htm
O8 - Extra context menu item: Download with GetRight - C:ProgrammeGetRightGRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:ProgrammeGetRightGRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgrammeJavaj2re1.4.2_03binnpjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:ProgrammeJavaj2re1.4.2_03binnpjpi142_03.dll
O9 - Extra button: IE-Schutzschild - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:ProgrammeF-Secure Internet SecurityAnti-Spywareieshield.dll
O9 - Extra 'Tools' menuitem: IE-Schutzschild... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:ProgrammeF-Secure Internet SecurityAnti-Spywareieshield.dll
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:ProgrammeICQLiteICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:ProgrammeICQLiteICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammeMessengermsmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:ProgrammeMessengermsmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:WINDOWSsystem32WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Unknown owner - C:ProgrammeGemeinsame DateienAdobe Systems SharedServiceAdobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:WINDOWSsystem32Ati2evxx.exe
O23 - Service: F-Secure 2006 (BackWeb Plug-in - 4476822) - F-Secure Internet Security 2005 - C:PROGRA~1F-SECU~1backweb4476822ProgramSERVIC~1.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:WINDOWSsystem32driversCDAC11BA.EXE
O23 - Service: DiamondCS Process Guard Service v3.000 (DCSPGSRV) - DiamondCS - C:ProgrammeProcessGuarddcsuserprot.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:ProgrammeIntelWirelessBinEvtEng.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:ProgrammeF-Secure Internet SecurityAnti-Virusfsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - C:ProgrammeF-Secure Internet Securitybackweb4476822programfsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:ProgrammeF-Secure Internet SecurityFWESProgramfsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:ProgrammeF-Secure Internet SecurityCommonFSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:ProgrammeGemeinsame DateienInstallShieldDriver11Intel 32IDriverT.exe
O23 - Service: iPodService - Unknown owner - C:ProgrammeiPodbiniPodService.exe (file missing)
O23 - Service: M-Audio Conectiv Installer (MAudioConectivService) - Avid Technology, Inc. - C:ProgrammeM-AudioConectivMAUSBCVInst.exe
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Unknown owner - C:ProgrammeM-AudioM-Audio Series II MIDIMA_CMIDI_Inst.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:ProgrammeDellNICCONFIGSVCNICCONFIGSVC.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:ProgrammeIntelWirelessBinRegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:ProgrammeIntelWirelessBinS24EvMon.exe
O23 - Service: StyleXPService - Unknown owner - C:ProgrammeTGTSoftStyleXPStyleXPService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:ProgrammeIntelWirelessBinWLKeeper.exe
Das einzige wo ich mir sicher bin ist
O4 - HKCU..Run: [WhenUSave] "C:ProgrammeSaveSave.exe"
#221
Geschrieben 02. Jun. 2007 - 20:38 Uhr
O4 - HKCU..Run: [WhenUSave] "C:ProgrammeSaveSave.exe"
Multidimensionale Ordnung wirkt nur auf den einfach gestrickten Betrachter wie Chaos, da er die Ordnung nicht erfassen kann.
1 Besucher lesen dieses Thema
Mitglieder: 0, Gäste: 1, unsichtbare Mitglieder: 0



Anmelden
Registrieren
Nach oben




