Archief - Telenet Internet Sec. Pack: problemen !

Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
d

dêsh'

Legacy Member
Hallo,

Een tijdje geleden bood telenet het TISP aan en m'n vader had dit geïnstalleerd. Na een tijdje werd dit echter betalend en heeft hij besloten om het maar te verwijderen.

Echter, na antivir te laten lopen blijkt er nog steeds iets aanwezig te zijn van TISCP namelijk blackweb. Dus, had ik eens een search gedaan over alle harde schijven naar blackweb, en inderdaad, er stond nog een map van TISP op zijn schijf met daarin een blackweb map. Ik heb dan heel de map van TISP verwijderd en nogmaals antivir laten lopen.
Helaas, hij geeft nog altijd aan dat er iets van blackweb aanwezig is. :s

Hier de log van antivir:

Code: 
Creation date of the report file:  donderdag 20 oktober 2005  19:49
 
AntiVir®/XP (2000 + NT) PersonalEdition Classic
Build 1111 of 18.10.2005
Mainprogram 6.32.00.50 of 13.10.2005
VDF file 6.32.0.104 (-1) of 20.10.2005
 

This program is for PERSONAL USE only.
Any other use is PROHIBITED.
Informations regarding commercial versions of AntiVir may be obtained from:
www.hbedv.com.
 

Scanning for 233046 virus strains and unwanted programs.
 
Licensed for:  AntiVir Personal Edition
Serial number: 0000149991-WURGE-0001
 
Please enter the workstation and
contact name with phone number in this form:
 
Name        ___________________________________________
 
Street      ___________________________________________
 
Town        ___________________________________________
 
Phone/Fax   ___________________________________________
 
Email       ___________________________________________
 
Platform:        Windows NT Workstation
Windows version: 5.1 Build 2600 ()
Username:        Steven Coremans
Computername:    STEVEN
Processor:       Pentium
Working memory:  261616 KB free
 
Version information:
 AVWIN.DLL      : 6.32.00.50     561192  19.10.2005  16:48:52
 AVEWIN32.DLL   : 6.32.0.57      954880  20.10.2005  19:48:44
 AVGNT.EXE      : 6.32.00.02     180327  19.10.2005  16:48:52
 AVGUARD.EXE    : 6.32.00.12     208424  19.10.2005  16:48:52
 GUARDMSG.DLL   : 6.30.00.02      94248  01.02.2005  11:24:10
 AVGCMSG.DLL    : 6.32.00.01     295029  19.10.2005  16:48:52
 AVGNTDW.SYS    : 6.31.00.01      32896  29.04.2005  08:07:16
 AVPACK32.DLL   : 6.32.00.02     319528  19.10.2005  16:48:52
 AVGETVER.DLL   : 6.30.00.00      24576  28.01.2005  18:10:20
 AVSHLEXT.DLL   : 6.30.00.01      40960  28.01.2005  18:10:22
 AVSched32.EXE  : 6.32.00.01     110632  21.09.2005  11:14:42
 AVSched32.DLL  : 6.30.00.00     122880  01.02.2005  11:24:10
 AVREG.DLL      : 6.31.00.05      41000  13.09.2005  11:19:36
 AVRep.DLL      : 6.32.00.100    1433640  20.10.2005  19:48:50
 INETUPD.EXE    : 6.32.00.52     262203  19.10.2005  16:48:52
 INETUPD.DLL    : 6.32.00.52     143360  19.10.2005  16:48:52
 CTL3D32.DLL    : 2.31.000        27136  07.09.2001  14:00:00
 MFC42.DLL      : 6.00.8665.0     995383  07.09.2001  14:00:00
 MSVCRT.DLL     : 7.0.2600.0 (xpclient.010817-1148
 MSVCRT.DLL     : 7.0.2600.0 (xp     322560  07.09.2001  14:00:00
 CTL3DV2.DLL    : 2.31.000        27632  15.08.1996  00:00:00
 
Configuration file:
 
 Name of configuration file: C:\Program Files\AVPersonal\AVWIN.INI
 Name of report file:        C:\Program Files\AVPersonal\LOGFILES\AVWIN.LOG
 Start path:                 C:\Program Files\AVPersonal
 Command line:               /ah /bask /ns
 Start mode:                 Selected drives
 
 Mode of report file:
 [ ] Do not create report
 [X] Overwrite report
 [ ] Append new report
 
 Data in report file:
 [X] Infected files
 [ ] Infected files with paths
 [ ] All scanned files
 [ ] Full information
 
 Abridge report file:
 [ ] Abridge report file
 
 Warnings in report:
 [X] Access denied/file locked
 [X] Wrong file size in directory
 [X] Wrong creation time in directory
 [ ] COM file is too large
 [X] Invalid start address
 [X] Invalid EXE header
 [X] Possibly damaged
 
 Summary report:
 [X] Create summary report
     Output file: AVWIN.ACT
     Maximum number of entries: 100
 
 Where to search:
 [X] Memory
 [X] Boot record of selected drives
 [ ] Report unknown boot sectors
 [ ] All files
 [X] Program files
     Extensions:  .386 .?HT* .ACM .ADE .ADP .ANI .APP .ASD .ASF .ASP .ASX .AWX .AX .BAS .BAT .BIN .BOO .CDF .CHM .CLASS .CMD .CNV .COM .CPL .CRT .CSH .DLL .DLO .DO? .DRV .EMF .EML .EXE* .FLT .FOT .HLP .HT* .INF .INI .INS .ISP .J2K .JAR .JFF .JFI .JFIF .JIF .JMH .JNG .JP2 .JPE .JPEG .JPG .JS* .JSE .LNK .MD? .MDB .MOD .MS? .NWS .OBJ .OCX .OLB .OSD .OV? .PCD .PDR .PGM .PHP .PIF .PKG .PL* .PNG .POT .PPS .PPT .PRG .RAR .REG .RPL .RTF .SBF .SCR .SCRIPT .SCT .SH .SHA .SHB .SHS .SHTM* .SPL .SWF .SYS .TLB .TMP .TSP .TTF .URL .VB? .VCS .VLM .VXD .VXO .WIZ .WLL .WMD .WMS .WMZ .WPC .WSC .WSF .WSH .WWK .XL? .XML .ZIP 
 
 Response in case of a detection:
 [X] Repair with prompt
 [ ] Repair without prompt
 [ ] Delete with prompt
 [ ] Delete without prompt
 [ ] Write in report file only
 [X] Acoustic alarm
 
 Response in case of destroyed files:
 [X] Delete with prompt
 [ ] Delete without prompt
 [ ] Ignore
 
 Response in case of destroyed files:
 [X] No change
 [ ] Current system time
 [ ] Correct date
 
 Drag&drop settings:
 [X] Scan subdirectories
 
 Profile settings:
 [X] Scan subdirectories
 
 Archive options
 [X] Search archive
 [X] All archive types
 
 Miscellaneous options:
 Temporary path: %TEMP% -> C:\DOCUME~1\STEVEN~1\LOCALS~1\Temp
 [X] Overwrite infected files
 [ ] Detect idle time
 [X] Allow interruptions of scan
 [X] Load AVWin®/NT Guard on System start
 
 General settings:
 [X] Save options on exiting AntiVir
 Priority: medium
 
 Drives:
 A: Floppy drive
 C: Hard disk
 D: Hard disk
 E: Hard disk
 F: Floppy drive
 G: Floppy drive
 H: Floppy drive
 I: Floppy drive
 J: CD-ROM
 K: CD-ROM
 
Start of scan:  donderdag 20 oktober 2005  19:49
 
Memory test                          OK
Master boot record of hard disk HD0   OK
Master boot record of hard disk HD1   OK
Master boot record of hard disk HD2   
      The record could not be read!
      Error code: 0x0015
Master boot record of hard disk HD3   
      The record could not be read!
      Error code: 0x0015
Master boot record of hard disk HD4   
      The record could not be read!
      Error code: 0x0015
Master boot record of hard disk HD5   
      The record could not be read!
      Error code: 0x0015
Boot record of drive C:            OK
Boot record of drive D:            OK
Boot record of drive E:            OK
 
Drive: C:
Volume ID: Lokaal Station  Serial No.: 4CCF-8BC4
      Access denied! Error during file opening!
      Error code: 0x0002
C:\
  
      WARNING! Access error/file locked!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery
  AlexaRelated.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite.zip
  ArchiveType: ZIP
      NOTE! No files to extract.
  BackWeblite1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite10.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite11.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite12.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite13.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite14.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite15.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite16.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite17.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite18.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite19.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite2.zip
  ArchiveType: ZIP
      NOTE! No files to extract.
  BackWeblite20.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite21.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite22.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite23.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite24.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite25.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite26.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite27.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite28.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite29.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite3.zip
  ArchiveType: ZIP
      NOTE! No files to extract.
  BackWeblite30.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite31.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite32.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite33.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite34.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite35.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite36.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite37.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite38.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite39.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite4.zip
  ArchiveType: ZIP
      NOTE! No files to extract.
  BackWeblite40.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite41.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite42.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite43.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite44.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite45.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite46.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite47.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite48.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite49.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite5.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite50.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite51.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite52.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite53.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite54.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite55.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite56.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite57.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite58.zip
  ArchiveType: ZIP
      NOTE! No files to extract.
  BackWeblite59.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite6.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite60.zip
  ArchiveType: ZIP
      NOTE! No files to extract.
  BackWeblite61.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite62.zip
  ArchiveType: ZIP
      NOTE! No files to extract.
  BackWeblite63.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite64.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite7.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite8.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  BackWeblite9.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINDashBar.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator1.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator10.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator11.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator12.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator13.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator14.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator15.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator2.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator3.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator4.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator5.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator6.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator7.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator8.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  GAINGator9.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
C:\Documents and Settings\Steven Coremans\Local Settings\Application Data\IM\Identities\{6CD8C5D4-15BF-42AB-85B9-2F3DB9B671D6}\Message Store\Attachments
  ATT34F.eml
  ArchiveType: MIME
    --> file0.mim
        ArchiveType: MIME
      --> file0.mim
          NOTE! Bad header
  ATT543.eml
  ArchiveType: MIME
    --> file0.mim
        ArchiveType: MIME
      --> file0.mim
          NOTE! Bad header
C:\Program Files\Hitman Pro\quarantine
  2005-06-29_10-01-58.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  2005-10-01_17-41-26.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  2005-10-05_17-23-07.zip
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
C:\Program Files\Macromedia\Flash MX 2004\Players\Debug
  Install Flash Player 7 OSX.hqx
  ArchiveType: BinHex (Mac)
      NOTE! No files to extract.
  Install Flash Player 7.hqx
  ArchiveType: BinHex (Mac)
      NOTE! No files to extract.
C:\Program Files\Macromedia\Flash MX 2004\Players\Release
  Install Flash Player 7 OSX.hqx
  ArchiveType: BinHex (Mac)
      NOTE! No files to extract.
  Install Flash Player 7.hqx
  ArchiveType: BinHex (Mac)
      NOTE! No files to extract.
C:\RECYCLER\NPROTECT
  00042758.CAB
  ArchiveType: CAB (Microsoft)
    --> gtrawbm.fil
        [DETECTION] Contains a signature of the (dangerous) backdoor program BDS/Agent.AY Backdoor server programs
  00042830.ZIP
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  00042834.ZIP
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  00042836.ZIP
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  00042840.ZIP
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
  00042842.ZIP
  ArchiveType: ZIP
      NOTE! The whole archive is password protected
Error! Could not change directory: System Volume Information
C:\WINDOWS\system32\config
  default
      Access denied! Error during file opening!
      Error code: 0x000D
      WARNING! Access error/file locked!
  SAM
      Access denied! Error during file opening!
      Error code: 0x000D
      WARNING! Access error/file locked!
  SECURITY
      Access denied! Error during file opening!
      Error code: 0x000D
      WARNING! Access error/file locked!
  software
      Access denied! Error during file opening!
      Error code: 0x000D
      WARNING! Access error/file locked!
  system
      Access denied! Error during file opening!
      Error code: 0x000D
      WARNING! Access error/file locked!
 
Drive: D:
Volume ID:   Serial No.: 6C45-4D3D
Error! Could not change directory: System Volume Information
 
Drive: E:
Volume ID:   Serial No.: F84D-BD64
Error! Could not change directory: System Volume Information
 
End of scan:  donderdag 20 oktober 2005  20:13
Time taken:         23:28 min
 

4353 directories were scanned
105605 files were scanned
   6 warning messages were issued
   0 files were deleted
   0 files were repaired
   1 detection

Heeft iemand enig idee hoe we dit kunnen oplossen/verwijderen?

Er staat ook iets in van BDS Agent backdoor, maar via de tool van de norton site vinden we hier ook niets van.

We zijn ten einde raad :( ???

Reeds gedaan:

- TISP verwijderd (via search is er niets meer te vinden op de hdd's)
- Hitman pro laten runnen --> geen problemen
- Hijack this laten lopen --> log inorde

Kan iemand ons verder helpen?

Alvast bedankt,
dêsh'
E

Exit

Legacy Member
rechtermuisklik op prullenbak en kies empty norton recycled bin ... die bds backdoor zit in de prullenbak van norton ...

de rest dat ik in die log zie is backweblite (geen blackweb ..) ... en die zit in de backup map van spybot om het terug te zetten ...

dus wat is er mis? maak prullenbak leeg en wis de backup van spybot ...
Het archief is een bevroren moment uit een vorige versie van dit forum, met andere regels en andere bazen. Deze posts weerspiegelen op geen enkele manier onze huidige ideeën, waarden of wereldbeelden en zijn op sommige plaatsen gecensureerd wegens ontoelaatbaar. Veel zijn in een andere tijdsgeest gemaakt, al dan niet ironisch - zoals in het ironische subforum Off-Topic - en zouden op dit moment niet meer gepost (mogen) worden. Toch bieden we dit archief nog graag aan als informatiedatabank en naslagwerk. Lees er hier meer over of start een gesprek met anderen.
Terug
Bovenaan