Es ist dir überlassen. Ich versuche ungern Leuten zu helfen die sich nicht helfen lassen.
Wenn du weißt um was es sich handelt und was Sache ist dann gut.
"When opened, Nachi.A.1 copies itself as C:\%SystemDIR%\Wins\Dllhost.exe. It makes a copy of C:\%Systemdir%\Dllcache\Tftpd.exe, named C:\%System%\Wins\svchost.exe.
It makes the following registry subkey:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic e RpcPatch RpcTftpd
It sets the service:
Service Name: RpcTftpd
Service Display Name: Network Connections Sharing
Service Binary: %System%\wins\svchost.exe
This service is manually started.
Service Name: RpcPatch
Service Display Name: WINS Client
Service Binary: %System%\wins\dllhost.exe
This service is automatically started.
It terminates "Msblast" process and deletes the file C:\%SystemDIR%\msblast.exe.
Then it chooses IP addresses in two modes: The worm uses the infected computer's IP A.B.0.0, or it composes an IP address out of encoded ones. After choosing the start address, it uses a class B network. It sends a CMP reply or PING, to verify if the chosen IP address corresponds to an active computer on the network.
It starts the TFTP Server on the attacked computer and downloads Dllhost.exe and Svchost.exe on it. When the update is downloaded and run, the worm restarts the computer, to install the correction routine.
It verifies the system date. In the year 2004, the worm deletes the file C:\%SystemDIR%\Wins\Dllhost.exe and the services RpcPatch and RpcTftpd, and removes the registry entries:
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\RpcPatch
* HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\RpcTftpd
"
Denk' mal an deine Mitmenschen.
Grüße
Es war nur ein dllhost.exe worm?