Trojaner o.ä.?

Internet Internet Sicherheit
1

Hallo Experten!!!

gestern ist mir im FTP-Bereich, wo mein Forum liegt ein Ordner aufgefallen, den ich noch nie gesehen habe.
Er ist bezeichent mit:933f402ff4afe15b14c03eb3
Der Inhalt ist eine einzige Textdatei Namens: msxml4-KB927978-enu
Ich hab sie mal mit dem Editor geöffnet. Sie ist riesengross und scheint lauter Daten über meinen Rechner zu enthalten.Hier mal ein kl Auszug:

=== Verbose logging started: 15.11.2006 17:37:21 Build type: SHIP UNICODE 3.01.4000.2435 Calling process: C:\WINDOWS\system32\msiexec.exe ===
MSI © (C0:AC) [17:37:21:046]: Resetting cached policy values
MSI © (C0:AC) [17:37:21:046]: Machine policy value ‚Debug‘ is 0
MSI © (C0:AC) [17:37:21:046]: ******* RunEngine:
******* Product: c:\933f402ff4afe15b14c03eb3\msxml.msi
******* Action:
******* CommandLine: **********
MSI © (C0:AC) [17:37:21:046]: Client-side and UI is none or basic: Running entire install on the server.
MSI © (C0:AC) [17:37:21:046]: Grabbed execution mutex.
MSI © (C0:AC) [17:37:21:125]: Cloaking enabled.
MSI © (C0:AC) [17:37:21:125]: Attempting to enable all disabled priveleges before calling Install on Server
MSI © (C0:AC) [17:37:21:140]: Incrementing counter to disable shutdown. Counter after increment: 0
MSI (s) (84:84) [17:37:21:140]: Grabbed execution mutex.
MSI (s) (84:F0) [17:37:21:140]: Resetting cached policy values
MSI (s) (84:F0) [17:37:21:140]: Machine policy value ‚Debug‘ is 0
MSI (s) (84:F0) [17:37:21:140]: ******* RunEngine:
******* Product: c:\933f402ff4afe15b14c03eb3\msxml.msi
******* Action:
******* CommandLine: **********
MSI (s) (84:F0) [17:37:21:171]: Machine policy value ‚DisableUserInstalls‘ is 0
MSI (s) (84:F0) [17:37:21:187]: File will have security applied from OpCode.
MSI (s) (84:F0) [17:37:21:218]: SOFTWARE RESTRICTION POLICY: Verifying package --> ‚c:\933f402ff4afe15b14c03eb3\msxml.msi‘ against software restriction policy
MSI (s) (84:F0) [17:37:21:218]: SOFTWARE RESTRICTION POLICY: c:\933f402ff4afe15b14c03eb3\msxml.msi has a digital signature
MSI (s) (84:F0) [17:37:21:437]: SOFTWARE RESTRICTION POLICY: c:\933f402ff4afe15b14c03eb3\msxml.msi is permitted to run at the ‚unrestricted‘ authorization level.
MSI (s) (84:F0) [17:37:21:437]: End dialog not enabled
MSI (s) (84:F0) [17:37:21:437]: Original package ==> c:\933f402ff4afe15b14c03eb3\msxml.msi
MSI (s) (84:F0) [17:37:21:437]: Package we’re running from ==> c:\WINDOWS\Installer\eaec23.msi
MSI (s) (84:F0) [17:37:21:531]: APPCOMPAT: looking for appcompat database entry with ProductCode ‚{37477865-A3F1-4772-AD43-AAFC6BCFF99F}‘.
MSI (s) (84:F0) [17:37:21:546]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (84:F0) [17:37:21:609]: MSCOREE not loaded loading copy from system32
MSI (s) (84:F0) [17:37:21:687]: Machine policy value ‚TransformsSecure‘ is 0
MSI (s) (84:F0) [17:37:21:687]: User policy value ‚TransformsAtSource‘ is 0
MSI (s) (84:F0) [17:37:21:687]: Machine policy value ‚DisablePatch‘ is 0
MSI (s) (84:F0) [17:37:21:687]: Machine policy value ‚AllowLockdownPatch‘ is 0
MSI (s) (84:F0) [17:37:21:687]: Machine policy value ‚DisableLUAPatching‘ is 0
MSI (s) (84:F0) [17:37:21:687]: Machine policy value ‚DisableFlyWeightPatching‘ is 0
MSI (s) (84:F0) [17:37:21:687]: APPCOMPAT: looking for appcompat database entry with ProductCode ‚{37477865-A3F1-4772-AD43-AAFC6BCFF99F}‘.
MSI (s) (84:F0) [17:37:21:687]: APPCOMPAT: no matching ProductCode found in database.
MSI (s) (84:F0) [17:37:21:687]: Transforms are not secure.
MSI (s) (84:F0) [17:37:21:687]: Command Line: REBOOT=ReallySuppress CURRENTDIRECTORY=c:\933f402ff4afe15b14c03eb3 CLIENTUILEVEL=3 CLIENTPROCESSID=1728
MSI (s) (84:F0) [17:37:21:687]: PROPERTY CHANGE: Adding PackageCode property. Its value is ‚{2B27DCD9-53FA-4885-B6CD-698623819F4C}‘.
MSI (s) (84:F0) [17:37:21:687]: Product Code passed to Engine.Initialize: ‚‘
MSI (s) (84:F0) [17:37:21:687]: Product Code from property table before transforms: ‚{37477865-A3F1-4772-AD43-AAFC6BCFF99F}‘
MSI (s) (84:F0) [17:37:21:687]: Product Code from property table after transforms: ‚{37477865-A3F1-4772-AD43-AAFC6BCFF99F}‘
MSI (s) (84:F0) [17:37:21:687]: Product not registered: beginning first-time install
MSI (s) (84:F0) [17:37:21:687]: PROPERTY CHANGE: Adding ProductState property. Its value is ‚-1‘.
MSI (s) (84:F0) [17:37:21:687]: Entering CMsiConfigurationManager::SetLastUsedSource.
MSI (s) (84:F0) [17:37:21:703]: User policy value ‚SearchOrder‘ is ‚nmu‘
MSI (s) (84:F0) [17:37:21:703]: Adding new sources is allowed.
MSI (s) (84:F0) [17:37:21:703]: PROPERTY CHANGE: Adding PackagecodeChanging property. Its value is ‚1‘.
MSI (s) (84:F0) [17:37:21:703]: Package name extracted from package path: ‚msxml.msi‘
MSI (s) (84:F0) [17:37:21:703]: Package to be registered: ‚msxml.msi‘
MSI (s) (84:F0) [17:37:21:703]: Note: 1: 2729
MSI (s) (84:F0) [17:37:21:718]: Note: 1: 2729
MSI (s) (84:F0) [17:37:21:718]: Note: 1: 2262 2: AdminProperties 3: -2147287038
MSI (s) (84:F0) [17:37:21:718]: Machine policy value ‚DisableMsi‘ is 0
MSI (s) (84:F0) [17:37:21:718]: Machine policy value ‚AlwaysInstallElevated‘ is 0
MSI (s) (84:F0) [17:37:21:718]: User policy value ‚AlwaysInstallElevated‘ is 0
MSI (s) (84:F0) [17:37:21:718]: Product installation will be elevated because user is admin and product is being installed per-machine.
MSI (s) (84:F0) [17:37:21:718]: Running product ‚{37477865-A3F1-4772-AD43-AAFC6BCFF99F}‘ with elevated privileges: Product is assigned.
MSI (s) (84:F0) [17:37:21:718]: PROPERTY CHANGE: Adding REBOOT property. Its value is ‚ReallySuppress‘.
MSI (s) (84:F0) [17:37:21:718]: PROPERTY CHANGE: Adding CURRENTDIRECTORY property. Its value is ‚c:\933f402ff4afe15b14c03eb3‘.
MSI (s) (84:F0) [17:37:21:718]: PROPERTY CHANGE: Adding CLIENTUILEVEL property. Its value is ‚3‘.
MSI (s) (84:F0) [17:37:21:718]: PROPERTY CHANGE: Adding CLIENTPROCESSID property. Its value is ‚1728‘.
MSI (s) (84:F0) [17:37:21:718]: TRANSFORMS property is now:
MSI (s) (84:F0) [17:37:21:718]: PROPERTY CHANGE: Adding VersionDatabase property. Its value is ‚200‘.
MSI (s) (84:F0) [17:37:21:718]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Anwendungsdaten
MSI (s) (84:F0) [17:37:21:718]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Favoriten
MSI (s) (84:F0) [17:37:21:718]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Netzwerkumgebung
MSI (s) (84:F0) [17:37:21:718]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Eigene Dateien
MSI (s) (84:F0) [17:37:21:734]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Druckumgebung
MSI (s) (84:F0) [17:37:21:734]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Recent
MSI (s) (84:F0) [17:37:21:734]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\SendTo
MSI (s) (84:F0) [17:37:21:734]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Vorlagen
MSI (s) (84:F0) [17:37:21:734]: SHELL32::SHGetFolderPath returned: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten
MSI (s) (84:F0) [17:37:21:734]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten
MSI (s) (84:F0) [17:37:21:734]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Eigene Dateien\Eigene Bilder
MSI (s) (84:F0) [17:37:21:765]: SHELL32::SHGetFolderPath returned: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Verwaltung
MSI (s) (84:F0) [17:37:21:765]: SHELL32::SHGetFolderPath returned: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
MSI (s) (84:F0) [17:37:21:765]: SHELL32::SHGetFolderPath returned: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme
MSI (s) (84:F0) [17:37:21:765]: SHELL32::SHGetFolderPath returned: C:\Dokumente und Einstellungen\All Users\Startmenü
MSI (s) (84:F0) [17:37:21:765]: SHELL32::SHGetFolderPath returned: C:\Dokumente und Einstellungen\All Users\Desktop
MSI (s) (84:F0) [17:37:21:781]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Startmenü\Programme\Verwaltung
MSI (s) (84:F0) [17:37:21:781]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Startmenü\Programme\Autostart
MSI (s) (84:F0) [17:37:21:781]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Startmenü\Programme
MSI (s) (84:F0) [17:37:21:781]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Startmenü
MSI (s) (84:F0) [17:37:21:781]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\system32\config\systemprofile\Desktop
MSI (s) (84:F0) [17:37:21:781]: SHELL32::SHGetFolderPath returned: C:\Dokumente und Einstellungen\All Users\Vorlagen
MSI (s) (84:F0) [17:37:21:781]: SHELL32::SHGetFolderPath returned: C:\WINDOWS\Fonts
MSI (s) (84:F0) [17:37:21:812]: Note: 1: 2898 2: MS Sans Serif 3: MS Sans Serif 4: 0 5: 16
MSI (s) (84:F0) [17:37:21:812]: PROPERTY CHANGE: Adding Privileged property. Its value is ‚1‘.
MSI (s) (84:F0) [17:37:21:812]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (84:F0) [17:37:21:812]: PROPERTY CHANGE: Adding USERNAME property. Its value is ‚Bernd‘.
MSI (s) (84:F0) [17:37:21:812]: Note: 1: 1402 2: HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info 3: 2
MSI (s) (84:F0) [17:37:21:812]: PROPERTY CHANGE: Adding DATABASE property. Its value is ‚c:\WINDOWS\Installer\eaec23.msi‘.
MSI (s) (84:F0) [17:37:21:812]: PROPERTY CHANGE: Adding OriginalDatabase property. Its value is ‚c:\933f402ff4afe15b14c03eb3\msxml.msi‘.
MSI (s) (84:F0) [17:37:21:812]: Note: 1: 2205 2: 3: PatchPackage
MSI (s) (84:F0) [17:37:21:812]: Machine policy value ‚DisableRollback‘ is 0
MSI (s) (84:F0) [17:37:21:812]: User policy value ‚DisableRollback‘ is 0
MSI (s) (84:F0) [17:37:21:812]: PROPERTY CHANGE: Adding UILevel property. Its value is ‚2‘.
=== Logging started: 15.11.2006 17:37:21 ===
MSI (s) (84:F0) [17:37:21:812]: PROPERTY CHANGE: Adding ACTION property. Its value is ‚INSTALL‘.
MSI (s) (84:F0) [17:37:21:812]: Doing action: INSTALL
MSI (s) (84:F0) [17:37:21:812]: Running ExecuteSequence
MSI (s) (84:F0) [17:37:21:812]: Doing action: DesktopFolder.4576A2F1_959E_4BCA_94A9_596523761901
Action start 17:37:21: INSTALL.

Könnte mir jemand sagen was das ist?
Der Ordner kommt mir so vor als gehöre er dort nicht hin.

Gruss,
Bernd

2

Hi!

Keine Sorge - war nur ein Windows-Update; irgendwo mittendrin im Text müßte ein

Property(S): Manufacturer = Microsoft Corporation
Property(S): ProductVersion = 6.00.3890.0
Property(S): ProductLanguage = 1033

oder ähnliches vorkommen

Grüße,
Tomh

3

Hi Tomh,

dank Dir für die Nachricht!
Aber seltsam wie der Ordner zu Strato in meinen ftp-Bereich kommt!!! :-/

Ich denke man kann ihn dort löschen?

Gruss,
Bernd

[Bei dieser Antwort wurde das Vollzitat nachträglich automatisiert entfernt]

4

Hi!

Ich denke man kann ihn dort löschen?

Ich hab’s gemacht und das ganze System läuft seit 3 Tagen noch immer :smile:

Es ist ein Log vom Windows Update KB927977 - sogar lt. Microsoft kann man’s löschen …

Grüße,
Tomh