Bitte um Hilfe bei einem Trojaner.

manib213

So nun , der Trojaner nennt sich Win32.Agent.pz.
Und der Pfad ist: C:\Windows\system32\wsnpoem\
Habe mit Virus Total überprüfen lassen:

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.6.11.0 2008.06.11 -
AntiVir 7.8.0.55 2008.06.11 -
Authentium 5.1.0.4 2008.06.11 -
Avast 4.8.1195.0 2008.06.11 -
AVG 7.5.0.516 2008.06.11 -
BitDefender 7.2 2008.06.11 -
CAT-QuickHeal 9.50 2008.06.11 -
ClamAV 0.92.1 2008.06.11 -
DrWeb 4.44.0.09170 2008.06.11 -
eSafe 7.0.15.0 2008.06.11 -
eTrust-Vet 31.6.5865 2008.06.11 -
Ewido 4.0 2008.06.11 -
F-Prot 4.4.4.56 2008.06.10 -
F-Secure 6.70.13260.0 2008.06.11 -
Fortinet 3.14.0.0 2008.06.11 -
GData 2.0.7306.1023 2008.06.11 -
Ikarus T3.1.1.26.0 2008.06.11 -
Kaspersky 7.0.0.125 2008.06.11 -
McAfee 5315 2008.06.11 -
Microsoft 1.3604 2008.06.11 -
NOD32v2 3178 2008.06.11 -
Norman 5.80.02 2008.06.11 -
Panda 9.0.0.4 2008.06.11 -
Prevx1 V2 2008.06.11 -
Rising 20.48.22.00 2008.06.11 -
Sophos 4.30.0 2008.06.11 -
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.11 -
TheHacker 6.2.92.342 2008.06.11 -
VBA32 3.12.6.7 2008.06.10 -
VirusBuster 4.3.26:9 2008.06.11 -
Webwasher-Gateway 6.6.2 2008.06.11 -
weitere Informationen
File size: 24576 bytes
MD5...: a9a35b074a07f4605c10ecf1e675468f
SHA1..: 6a59b6b3a3f0eaa84fedce76eb8f6218308cb747
SHA256: e446c88928d6c5f207ed61f95ad3caa36fef81f94bf8a8f6e802d80871285f2b
SHA512: 0c125f282401f78dd24be5b29c194b7fe3fc5dae087cc59456d3b36a8d291f47
a655b9428b7d4dd97100f553a580de7e797581f8fd645ab62571544e1cf1ff2b
PEiD..: Armadillo v1.71
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x402808
timedatestamp.....: 0x42805234 (Tue May 10 06:18:28 2005)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x19ac 0x2000 5.24 280d1600ed878540c7c61a18759a9521
.rdata 0x3000 0xa76 0x1000 3.74 1d3b42a63b045f75e605f9c1a0310e94
.data 0x4000 0x114 0x1000 0.39 9fad1af157b4f1c4571d2fe98cc7f81a
.rsrc 0x5000 0x5c8 0x1000 1.35 4d7ec5d6d067da2bb499dd7d3d7c8017

( 6 imports )
> RPCRT4.dll: NdrServerInitializeNew, RpcRaiseException, RpcMgmtStopServerListening, RpcServerListen, RpcServerUnregisterIf, RpcServerRegisterIf, RpcServerUseProtseqEpA, NdrServerCall2
> MSVCRT.dll: _controlfp, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, _acmdln, _XcptFilter, _exit, printf, __getmainargs, free, malloc, _except_handler3, _mbsicmp, exit
> KERNEL32.dll: GetStartupInfoA, GetModuleHandleA, lstrcmpiA, LoadLibraryA, GetProcAddress, FreeLibrary, LocalAlloc, LocalFree, lstrcpyA, GlobalFree, GlobalAlloc, GetLastError, GetVersionExA, CloseHandle, WaitForSingleObject, CreateEventA, CreateThread, Sleep, SetEvent, lstrcatA, lstrlenA, GetModuleFileNameA
> USER32.dll: LoadCursorA, DispatchMessageA, TranslateMessage, GetMessageA, CreateWindowExA, PostMessageA, DefWindowProcA, DestroyWindow, PostQuitMessage, RegisterClassA, LoadIconA, FindWindowA, LoadStringA
> WINSPOOL.DRV: FindClosePrinterChangeNotification, FindFirstPrinterChangeNotification, OpenPrinterA, ClosePrinter, EnumPrintersA
> ADVAPI32.dll: QueryServiceStatus, RegDeleteValueA, RegQueryValueExA, ChangeServiceConfigA, ControlService, RegDeleteKeyA, OpenSCManagerA, OpenServiceA, CloseServiceHandle, DeleteService, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA, RegCreateKeyExA, RegSetValueExA, RegOpenKeyExA, RegEnumValueA, RegCloseKey






Das war das Ergebnis.