| |
| |||||||
Log-Analyse und Auswertung: Trojaner - spyware - log file hijackWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
29.08.2008, 12:59
| #1 |
 |  Trojaner - spyware - log file hijack Hallo, ich habe ein Problem mit einem Virus - Spyware. Plötzlich hatte ich eine Security Toolbar im Browser und werde ständig von einem POP Up Fenster genervt, das mir eine Antivirus Software verkaufen will. Das Internet und andere Anwendungen sind extrem langsam geworden. Das System spricht von dem Virus W32.Myzor.FK@f. Habe mir schon einige Beiträge angesehen und ein HijackThis Protokoll erstellt: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:25:15, on 28.08.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Applications\iebtm.exe C:\Windows\System32\rundll32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Windows\system32\ctfmon.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\WAV\wav.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Applications\wcm.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\ubpr01.exe C:\Program Files\Applications\iebtmm.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Applications\wcs.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://internetsearchservice.com R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://internetsearchservice.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://internetsearchservice.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://internetsearchservice.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://internetsearchservice.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://internetsearchservice.com/ie6.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://internetsearchservice.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://internetsearchservice.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://internetsearchservice.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {0BD44AB1-76A7-4E05-92F4-4B065FE72BD6} - C:\Program Files\Applications\iebt.dll O2 - BHO: 120237 helper - {176D799E-6C8C-4D1A-8024-044D96A035E2} - C:\Windows\system32\120237\120237.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O3 - Toolbar: Internet Service - {3BEBF2FE-7248-40E2-9752-8163EB6C4038} - C:\Program Files\Applications\iebr.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Antivirus] C:\Program Files\WAV\wav.exe O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [wblogon] C:\Windows\System32\ubpr01.exe O4 - HKCU\..\Run: [Antivirus] C:\Program Files\WAV\wav.exe O4 - HKLM\..\Policies\Explorer\Run: [smile] C:\Program Files\Applications\wcs.exe O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Program Files\Applications\iebtm.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = ? O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iexplorerfiles.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iexplorerfiles.com/redirect.php (file missing) O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O10 - Broken Internet access because of LSP provider 'c:\windows\system32\pnrpnsp.dll' missing O13 - Gopher Prefix: O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 5662 bytes Was muss ich tun, um das Biest wegzubekommen ? Gruß |
|
29.08.2008, 13:15
| #2 | ||
| | Trojaner - spyware - log file hijack Hallo und
__________________ Lade diese Datein bitte bei Virustotal.com hoch und poste das log. Zitat:
Zitat:
http://www.trojaner-board.de/51187-a...i-malware.html Runter. Mach das Update und dann mach bei dem Programm ein Hacken bei Komplett Scan durchführen,danach lässt du alle funde löschen. Dann anschließend ein neues Frisches HijackThis logfile. Edit: Kein Wunder mach noch ein SP3 Update du hast noch SP1 drauf.
__________________ |
|
29.08.2008, 14:04
| #3 |
| | Trojaner - spyware - log file hijack Hi, vielen Dank bereits vorab.
__________________Bin da vielleicht etwas "grün" ... Was heiß "fixxen" ? Und für Virus Total.com: jede Datei einzeln hochladen ? Und dann auf "Senden" gehen? Wird das Logfile dann einzeln erstellt ? Und dann posten ? Gruß |
|
29.08.2008, 14:11
| #4 |
| | Trojaner - spyware - log file hijack Hallo, dies ist das Erebnis von Antivirus. Datei ubpr01.exe empfangen 2008.08.29 14:25:25 (CET) Status: Beendet Ergebnis: 14/34 (41.18%) Filter Drucken der Ergebnisse Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 TR/BHO.Gen Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.28 Win32:Trojan-gen {Other} AVG 8.0.0.161 2008.08.29 BHO.FHO BitDefender 7.2 2008.08.29 - CAT-QuickHeal 9.50 2008.08.26 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 Suspicious File eTrust-Vet 31.6.6056 2008.08.29 - Ewido 4.0 2008.08.29 - F-Prot 4.4.4.56 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 Adware/E404 GData 19 2008.08.29 - Ikarus T3.1.1.34.0 2008.08.29 Trojan.BHO K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 not-a-virus:AdWare.Win32.E404.hq McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 TrojanDropper:Win32/Nonaco.A NOD32v2 3398 2008.08.29 Win32/BHO.NGT Panda 9.0.0.4 2008.08.29 Suspicious file PCTools 4.4.2.0 2008.08.28 - Prevx1 V2 2008.08.29 Malicious Software Rising 20.59.41.00 2008.08.29 AdWare.Win32.Agent.bvn Sophos 4.33.0 2008.08.29 - Sunbelt 3.1.1592.1 2008.08.29 - Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 PAK_Generic.001 VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.29.1355 2008.08.29 - VirusBuster 4.5.11.0 2008.08.28 - Webwasher-Gateway 6.6.2 2008.08.29 Trojan.BHO.Gen weitere Informationen File size: 27648 bytes MD5...: d6d658023ec07dddc506bc174752cdce SHA1..: 4266e61f399d75c25918b59f1262638f2cd92161 SHA256: 78458ac578b660ee0c274e54526e2809783ac01e0a733cd5014b34c86142dad2 SHA512: 3ba726ed154ff2e630b5eacb04daa53ca542271eec48b56e1913eb9b40cac66a 428f299fa71b39d831b63c45aa67042cfcf32364560dd4e91a408c33d4e897d0 PEiD..: - TrID..: File type identification UPX compressed Win32 Executable (39.5%) Win32 EXE Yoda's Crypter (34.3%) Win32 Executable Generic (11.0%) Win32 Dynamic Link Library (generic) (9.8%) Generic Win/DOS Executable (2.5%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x411fd0 timedatestamp.....: 0x48b3e213 (Tue Aug 26 10:59:31 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 UPX0 0x1000 0xb000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e UPX1 0xc000 0x7000 0x6200 7.84 171efacc7989f2c9ef1e904a64a31285 .rsrc 0x13000 0x1000 0x600 2.99 0270a113de691c8b844175afebf5439c ( 6 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess > ADVAPI32.dll: RegEnumKeyA > MSVCRT.dll: exit > ole32.dll: CoInitialize > SHLWAPI.dll: SHSetValueA > USER32.dll: GetForegroundWindow ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=5217E4B1002288D96CEB003B4F1A4C00B769B33A ThreatExpert info: http://www.threatexpert.com/report.aspx?md5=d6d658023ec07dddc506bc174752cdce packers (Kaspersky): PE_Patch.UPX, UPX packers (F-Prot): UPX packers (Avast): UPX |
|
29.08.2008, 14:11
| #5 | ||||
| | Trojaner - spyware - log file hijackZitat:
bei virustotal.com jede datei einzelnt hochladen,und ja das Logfile wird einzelt erstellt. Fixxen kannst du so einfach hinter z:b Zitat:
Zitat:
Zitat:
1. Die gennanten Datein Hochladen bei virustotal.com und alle logfiles posten. 2.Die genannten Datein Fixxen bei HijackThis 3.Malwarebytes downloaden installen und update ausführen danach Komplett Scan (Anleitung steht im ersten Post) 4.Neuen HijackThis Logfile machen 5.SEHR WICHTIG Alles Updates machen bis SP3 unter Systemsteuerung Windows Updates,ansonsten lebst du nur noch mit Viren :P 6.Nochmal ein Neues HijackThis logfile posten. Kopier bitte alle Logfiles die du hochgeladen hast in einem post damit mann die übersicht nicht verliert und schreib die Logs in einem Zitat
__________________ LG StormBird Google ist dein bester Freund |
|
29.08.2008, 14:37
| #6 |
| | Trojaner - spyware - log file hijack Okay, das mit den Haken kriege ich hin. Habe ich auch größtenteils schon gemacht. Bis auf in zwei Fällen: R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Internet Explorer Search R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = Internet Explorer Search Denn: im Hi Jack steht hier statt "Internet Explorer Search" am Ende immer "internetsearchservice/ie6.html" oder macht das keinen Unterschied ? Dann, wenn alle Häkchen gsetzt, schätze ich, gehe ich auf das Feld "Fix checked" ? Das Logfile von Virustotal habe ich ja bereits gepostet - reicht das aus ? Gruß |
|
29.08.2008, 14:41
| #7 | |
| | Trojaner - spyware - log file hijack Habe da glaub ich dahinter /ie6.html vergessen zu kopieren jop danach gehste einfach auf das Feld Fix Checked. Das mit virustotal du hast nur eine datei gepostet das ist diese fett gedruckte: Zitat:
__________________ LG StormBird Google ist dein bester Freund |
|
29.08.2008, 14:47
| #8 |
| | Trojaner - spyware - log file hijack So, hier schon mal das neue HiJack Logfile, die Daten von Antivirus kommen auch gleich ... Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:46:40, on 29.08.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe C:\Program Files\Applications\iebtm.exe C:\Windows\System32\rundll32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\WAV\wav.exe C:\Program Files\Applications\iebtmm.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Applications\wcm.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\System32\ubpr01.exe C:\Windows\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE C:\Program Files\Applications\wcs.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {0BD44AB1-76A7-4E05-92F4-4B065FE72BD6} - C:\Program Files\Applications\iebt.dll O2 - BHO: 120237 helper - {176D799E-6C8C-4D1A-8024-044D96A035E2} - C:\Windows\system32\120237\120237.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O3 - Toolbar: Internet Service - {3BEBF2FE-7248-40E2-9752-8163EB6C4038} - C:\Program Files\Applications\iebr.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Antivirus] C:\Program Files\WAV\wav.exe O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [wblogon] C:\Windows\System32\ubpr01.exe O4 - HKCU\..\Run: [Antivirus] C:\Program Files\WAV\wav.exe O4 - HKLM\..\Policies\Explorer\Run: [smile] C:\Program Files\Applications\wcs.exe O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Program Files\Applications\iebtm.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = ? O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iexplorerfiles.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iexplorerfiles.com/redirect.php (file missing) O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O10 - Broken Internet access because of LSP provider 'c:\windows\system32\pnrpnsp.dll' missing O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 4626 bytes |
|
29.08.2008, 14:53
| #9 | |
| | Trojaner - spyware - log file hijack Das haste vergessen zu fixxen mach das bitte auch: Zitat:
__________________ LG StormBird Google ist dein bester Freund |
|
29.08.2008, 15:18
| #10 |
| | Trojaner - spyware - log file hijack So, habe die Virustotal Logfiles - ist aber ne Menge Info ... daher in zwei NACHRICHTEN . die anderen beiden datieen habe ich grad gefixxt C:\Program Files\Applications\wcm.exe C:\Windows\System32\ubpr01.exe O2 - BHO: (no name) - {0BD44AB1-76A7-4E05-92F4-4B065FE72BD6} - C:\Program Files\Applications\iebt.dll O2 - BHO: 120237 helper - {176D799E-6C8C-4D1A-8024-044D96A035E2} - C:\Windows\system32\120237\120237.dll O3 - Toolbar: Internet Service - {3BEBF2FE-7248-40E2-9752-8163EB6C4038} - C:\Program Files\Applications\iebr.dll O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [Antivirus] C:\Program Files\WAV\wav.exe O4 - HKCU\..\Run: [wblogon] C:\Windows\System32\ubpr01.exe O4 - HKCU\..\Run: [Antivirus] C:\Program Files\WAV\wav.exe O4 - HKLM\..\Policies\Explorer\Run: [smile] C:\Program Files\Applications\wcs.exe O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Program Files\Applications\iebtm.exeO4 - HKLM\..\Policies\Explorer\Run: [start] C:\Program Files\Applications\iebtm.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe Datei wcm.exe empfangen 2008.08.29 15:05:14 (CET) Status: Beendet Ergebnis: 3/36 (8.33%) Filter Drucken der Ergebnisse Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 - Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.28 - AVG 8.0.0.161 2008.08.29 - BitDefender 7.2 2008.08.29 - CAT-QuickHeal 9.50 2008.08.26 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 - eTrust-Vet 31.6.6056 2008.08.29 - Ewido 4.0 2008.08.29 - F-Prot 4.4.4.56 2008.08.29 - F-Secure 7.60.13501.0 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 - GData 19 2008.08.29 - Ikarus T3.1.1.34.0 2008.08.29 Trojan-Downloader.Win32.Zlob.glx K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 - McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 - NOD32v2 3399 2008.08.29 Win32/TrojanDownloader.Zlob.CJW Norman 5.80.02 2008.08.28 - Panda 9.0.0.4 2008.08.29 - PCTools 4.4.2.0 2008.08.29 - Prevx1 V2 2008.08.29 Malware Dropper Rising 20.59.41.00 2008.08.29 - Sophos 4.33.0 2008.08.29 - Sunbelt 3.1.1592.1 2008.08.29 - Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 - VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.29.1355 2008.08.29 - VirusBuster 4.5.11.0 2008.08.28 - Webwasher-Gateway 6.6.2 2008.08.29 - weitere Informationen File size: 6656 bytes MD5...: 6f8329ed3cbc88eb3dcfde959afc0c31 SHA1..: e6ec2de4cb6c42c9efe98d9fc8900a555467a084 SHA256: cf232af59497f794605f5add70e756a0f0e72d6177b36ffc8eabc8a90b235aa0 SHA512: 7fcc8729d11b7bcac28e78cbef3632542125af4d903504f5ad556d6c9cf02044 6426f8d619117a5981f4809586705cc5aad797de50df5f427aa6473198e2611f PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x4012e1 timedatestamp.....: 0x48b5a7a4 (Wed Aug 27 19:14:44 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xfac 0x1000 6.17 f927050de27b321f38624bbb9a15e029 .rdata 0x2000 0x3de 0x400 4.77 54653b35fc7a4ca8d2e30ee094f63b87 .data 0x3000 0x258 0x200 0.18 d1c3b5c39dc58a046aadf7f29818ca74 ( 3 imports ) > KERNEL32.dll: GetFileAttributesA, lstrcatA, GetProcAddress, OpenMutexA, WideCharToMultiByte, GetModuleHandleA, CloseHandle, SuspendThread, lstrcpyA, OpenEventA, GetCurrentThread, ExitProcess, CreateEventA, Process32First, LoadLibraryA, CreateToolhelp32Snapshot, CompareStringA, RtlUnwind > USER32.dll: FindWindowW > ADVAPI32.dll: RegCloseKey ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=BE36401F00A7EA431AD50076EFC31A00532EBC7C ACHTUNG: VirusTotal ist ein kostenloser Dienst bereitgestellt von Hispasec Sistemas. Es gibt keine Garantie zur Verfügbarkeit sowie Fortbestehen der Dienstleistung. Obwohl die Erkennungsrate meherer Antivirus-Engines besser ist als nur durch ein Produkt, garantieren die Ergebnisse des Scans nicht die Harmlosigkeit einer Datei. Gegenwärtig gibt es keine Lösung, welche eine Erkennungsrate aller Viren und Malware zu 100% bietet. Datei ubpr01.exe empfangen 2008.08.29 14:25:25 (CET) Status: Beendet Ergebnis: 14/34 (41.18%) Filter Drucken der Ergebnisse Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 TR/BHO.Gen Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.28 Win32:Trojan-gen {Other} AVG 8.0.0.161 2008.08.29 BHO.FHO BitDefender 7.2 2008.08.29 - CAT-QuickHeal 9.50 2008.08.26 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 Suspicious File eTrust-Vet 31.6.6056 2008.08.29 - Ewido 4.0 2008.08.29 - F-Prot 4.4.4.56 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 Adware/E404 GData 19 2008.08.29 - Ikarus T3.1.1.34.0 2008.08.29 Trojan.BHO K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 not-a-virus:AdWare.Win32.E404.hq McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 TrojanDropper:Win32/Nonaco.A NOD32v2 3398 2008.08.29 Win32/BHO.NGT Panda 9.0.0.4 2008.08.29 Suspicious file PCTools 4.4.2.0 2008.08.28 - Prevx1 V2 2008.08.29 Malicious Software Rising 20.59.41.00 2008.08.29 AdWare.Win32.Agent.bvn Sophos 4.33.0 2008.08.29 - Sunbelt 3.1.1592.1 2008.08.29 - Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 PAK_Generic.001 VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.29.1355 2008.08.29 - VirusBuster 4.5.11.0 2008.08.28 - Webwasher-Gateway 6.6.2 2008.08.29 Trojan.BHO.Gen weitere Informationen File size: 27648 bytes MD5...: d6d658023ec07dddc506bc174752cdce SHA1..: 4266e61f399d75c25918b59f1262638f2cd92161 SHA256: 78458ac578b660ee0c274e54526e2809783ac01e0a733cd5014b34c86142dad2 SHA512: 3ba726ed154ff2e630b5eacb04daa53ca542271eec48b56e1913eb9b40cac66a 428f299fa71b39d831b63c45aa67042cfcf32364560dd4e91a408c33d4e897d0 PEiD..: - TrID..: File type identification UPX compressed Win32 Executable (39.5%) Win32 EXE Yoda's Crypter (34.3%) Win32 Executable Generic (11.0%) Win32 Dynamic Link Library (generic) (9.8%) Generic Win/DOS Executable (2.5%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x411fd0 timedatestamp.....: 0x48b3e213 (Tue Aug 26 10:59:31 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 UPX0 0x1000 0xb000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e UPX1 0xc000 0x7000 0x6200 7.84 171efacc7989f2c9ef1e904a64a31285 .rsrc 0x13000 0x1000 0x600 2.99 0270a113de691c8b844175afebf5439c ( 6 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess > ADVAPI32.dll: RegEnumKeyA > MSVCRT.dll: exit > ole32.dll: CoInitialize > SHLWAPI.dll: SHSetValueA > USER32.dll: GetForegroundWindow ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=5217E4B1002288D96CEB003B4F1A4C00B769B33A ThreatExpert info: http://www.threatexpert.com/report.aspx?md5=d6d658023ec07dddc506bc174752cdce packers (Kaspersky): PE_Patch.UPX, UPX packers (F-Prot): UPX packers (Avast): UPX Datei iebt.dll empfangen 2008.08.29 15:50:04 (CET) Status: Beendet Ergebnis: 11/35 (31.43%) Filter Drucken der Ergebnisse Email: Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 TR/Zlob.reu Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.29 - AVG 8.0.0.161 2008.08.29 Downloader.Zlob BitDefender 7.2 2008.08.29 Trojan.Zlob.2.Gen CAT-QuickHeal 9.50 2008.08.29 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 Suspicious File eTrust-Vet 31.6.6056 2008.08.29 - Ewido 4.0 2008.08.29 - F-Prot 4.4.4.56 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 - GData 19 2008.08.29 Trojan-Downloader.Win32.Zlob.xej Ikarus T3.1.1.34.0 2008.08.29 - K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 Trojan-Downloader.Win32.Zlob.xej McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 TrojanDownloader:Win32/Zlob.gen!BZ NOD32v2 3399 2008.08.29 Win32/TrojanDownloader.Zlob.CJW Norman 5.80.02 2008.08.28 - Panda 9.0.0.4 2008.08.29 - PCTools 4.4.2.0 2008.08.29 - Prevx1 V2 2008.08.29 Malware Dropper Rising 20.59.41.00 2008.08.29 - Sophos 4.33.0 2008.08.29 - Sunbelt 3.1.1592.1 2008.08.29 - Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 PAK_Generic.001 VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.29.1355 2008.08.29 - VirusBuster 4.5.11.0 2008.08.29 - Webwasher-Gateway 6.6.2 2008.08.29 Trojan.Zlob.reu weitere Informationen File size: 7680 bytes MD5...: 3bc60ee63176fdff5298cd333da951d2 SHA1..: 73d3cce9e43880b6721a5ae7bd52a19ba077460c SHA256: f8f3ecc71bf3e6c6fb4519bc3d56200cffa0796eb274fbd39f7a0b3b8d2e67be SHA512: 2b4f4e62c65d6a12e0589995e0b9fcbf00b5121e10333973fb9fbcdc1fe2e1f9 6ef4e3474fa214ce7a445dcf8d6331e85f3e1c627de24884426176d2049b3b4e PEiD..: - TrID..: File type identification UPX compressed Win32 Executable (39.5%) Win32 EXE Yoda's Crypter (34.3%) Win32 Executable Generic (11.0%) Win32 Dynamic Link Library (generic) (9.8%) Generic Win/DOS Executable (2.5%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x100085e0 timedatestamp.....: 0x48b5a7cf (Wed Aug 27 19:15:27 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 UPX0 0x1000 0x6000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e UPX1 0x7000 0x2000 0x1800 7.73 f57c5944d3539f0f7bc0e516fd47d11c UPX2 0x9000 0x1000 0x200 3.72 e998a870ef3867e52270cf6728b73462 ( 4 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree > ADVAPI32.dll: RegCloseKey > OLEAUT32.dll: - > USER32.dll: wsprintfW ( 3 exports ) DllCanUnloadNow, DllGetClassObject, DllRegisterServer Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=A734EF0000210E781E2A00B78698C4009E40B68F packers (Kaspersky): PE_Patch.UPX, UPX packers (F-Prot): UPX Datei 120237.dll empfangen 2008.08.29 09:39:26 (CET) Status: Beendet Ergebnis: 16/35 (45.71%) Filter Drucken der Ergebnisse Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 TR/BHO.Gen Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.28 Win32:Trojan-gen {Other} AVG 8.0.0.161 2008.08.29 BHO.FHK BitDefender 7.2 2008.08.29 - CAT-QuickHeal 9.50 2008.08.26 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 Suspicious File eTrust-Vet 31.6.6055 2008.08.29 Win32/Puper!generic Ewido 4.0 2008.08.28 - F-Prot 4.4.4.56 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 PossibleThreat GData 19 2008.08.29 Win32:Trojan-gen Ikarus T3.1.1.34.0 2008.08.29 Virus.Win32.E404.H K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 not-a-virus:AdWare.Win32.E404.ht McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 TrojanDownloader:Win32/Nonaco.F NOD32v2 3397 2008.08.28 Win32/BHO.NGT Norman 5.80.02 2008.08.28 - Panda 9.0.0.4 2008.08.29 Suspicious file PCTools 4.4.2.0 2008.08.28 - Prevx1 V2 2008.08.29 Malware Downloader Rising 20.59.40.00 2008.08.29 AdWare.Win32.Agent.bvn Sophos 4.33.0 2008.08.29 - Sunbelt 3.1.1592.1 2008.08.29 - Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 PAK_Generic.001 VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.28.1353 2008.08.28 - VirusBuster 4.5.11.0 2008.08.28 - Webwasher-Gateway 6.6.2 2008.08.29 Trojan.BHO.Gen weitere Informationen File size: 15360 bytes MD5...: 079c6c4e9b868c2945da5bb39fb8c2fb SHA1..: bed0d6f0c4c2816d4c2fccefd6f6784a6aa173cf SHA256: 9a023906cd302dea3eea8c654aa93ca8fa0b35719c62444e4f96eccf7973ab19 SHA512: 8d6a770dcc3bbecf1eac868072b790fd6c1192e78e229502ac51b74c415ee0aa c62e3142b4773b77175c1d54fbd461c072bdcad80e2b57199f74a89249f72b72 PEiD..: - TrID..: File type identification UPX compressed Win32 Executable (39.5%) Win32 EXE Yoda's Crypter (34.3%) Win32 Executable Generic (11.0%) Win32 Dynamic Link Library (generic) (9.8%) Generic Win/DOS Executable (2.5%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1000b420 timedatestamp.....: 0x48b3e20a (Tue Aug 26 10:59:22 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 UPX0 0x1000 0x8000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e UPX1 0x9000 0x3000 0x2600 7.83 03886f4c2d372f3cc50f27c9e3edf580 .rsrc 0xc000 0x2000 0x1200 4.44 751608a19313f0ecd6ccad1bb60c7893 ( 12 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree > ATL.DLL: - > MSVCP60.dll: __0_Winit@std@@QAE@XZ > MSVCRT.dll: time > ole32.dll: CoCreateGuid > OLEAUT32.dll: - > RPCRT4.dll: UuidToStringA > SHLWAPI.dll: SHGetValueA > urlmon.dll: ObtainUserAgentString > USER32.dll: IsWindow > WININET.dll: InternetCrackUrlA > WS2_32.dll: - ( 4 exports ) DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=F939F05A004686ED3C3600F6756C920089AC1A6C ThreatExpert info: http://www.threatexpert.com/report.aspx?md5=079c6c4e9b868c2945da5bb39fb8c2fb packers (Kaspersky): PE_Patch.UPX, UPX packers (F-Prot): UPX Datei iebr.dll empfangen 2008.08.29 15:53:22 (CET) Status: Beendet Ergebnis: 7/36 (19.45%) Filter Drucken der Ergebnisse Email: Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 - Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.29 - AVG 8.0.0.161 2008.08.29 Downloader.Zlob.ABGJ BitDefender 7.2 2008.08.29 Trojan.Zlob.2.Gen CAT-QuickHeal 9.50 2008.08.29 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 - eTrust-Vet 31.6.6056 2008.08.29 Win32/Puper!generic Ewido 4.0 2008.08.29 - F-Prot 4.4.4.56 2008.08.29 - F-Secure 7.60.13501.0 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 - GData 19 2008.08.29 - Ikarus T3.1.1.34.0 2008.08.29 Trojan-Downloader.Win32.Zlob.ax K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 - McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 TrojanDownloader:Win32/Zlob.gen!BK NOD32v2 3399 2008.08.29 Win32/TrojanDownloader.Zlob.CJW Norman 5.80.02 2008.08.28 - Panda 9.0.0.4 2008.08.29 - PCTools 4.4.2.0 2008.08.29 - Prevx1 V2 2008.08.29 Malware Dropper Rising 20.59.41.00 2008.08.29 - Sophos 4.33.0 2008.08.29 - Sunbelt 3.1.1592.1 2008.08.29 - Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 - VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.29.1355 2008.08.29 - VirusBuster 4.5.11.0 2008.08.29 - Webwasher-Gateway 6.6.2 2008.08.29 - weitere Informationen File size: 88576 bytes MD5...: d741468de9c9cb8ccdee892d53613c58 SHA1..: a8d24e172684eb6459429fcb3e9f8657a5fab535 SHA256: 8c27c2a0e21a46ddb6d68f978c00f0c93277d215a00123c0221b78a267bfa636 SHA512: 4ebf817af3a4df52134a2ef64da52749dd0c871c80af41847139e228e1a224c8 38f4fe8a8dab5faf7f6f169744c077381d92a4c53b6d6a6d059a82e80d216451 PEiD..: - TrID..: File type identification Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x10003698 timedatestamp.....: 0x48b5a803 (Wed Aug 27 19:16:19 2008) machinetype.......: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x342c 0x3600 5.94 722f70dc4f296ed1f5fb45d41d68b521 .rdata 0x5000 0xe41 0x1000 4.88 f8ed5982cf0a066a2137b304f5d41382 .data 0x6000 0x4d8 0x200 0.51 9ec0ca3e10f4901ed45aba2c4e1a701b .rsrc 0x7000 0x103b8 0x10400 3.73 a8e454beeaf058e2e2b72249c968812b .reloc 0x18000 0x8d4 0xa00 4.89 5af1b44ec0e09e9fe3d041db6c440084 ( 7 imports ) > KERNEL32.dll: GetModuleFileNameA, lstrcpyA, LoadLibraryA, lstrcatA, lstrlenA, lstrcmpA, SuspendThread, GetVersion, OutputDebugStringA, GetModuleHandleA, GetProcAddress, OpenMutexA, SetLastError, GetLastError, GetModuleFileNameW, GetModuleHandleW, GetFileAttributesW, GetFileAttributesA, LoadLibraryW, GetCurrentThread, CloseHandle, CompareStringA, CreateToolhelp32Snapshot, Process32First, RtlUnwind > USER32.dll: GetWindowLongA, RegisterClassA, CharLowerA, EndPaint, DestroyWindow, LoadBitmapA, FindWindowW, GetClientRect, SendMessageA, BeginPaint, SetWindowLongA, UnregisterClassA, wsprintfW, CreateWindowExA, ShowWindow, GetClassInfoA, IsWindow, CallWindowProcA > GDI32.dll: CreateFontA, DeleteObject, SelectObject, CreateCompatibleDC, DeleteDC > ADVAPI32.dll: RegOpenKeyExA, RegCloseKey, RegEnumKeyA, RegOpenKeyA, RegDeleteValueA, RegCreateKeyExA, RegDeleteKeyA, RegSetValueExA > ole32.dll: CoCreateInstance, CoUninitialize, CoInitialize > OLEAUT32.dll: -, - > MSIMG32.dll: TransparentBlt ( 4 exports ) DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=890571D4003034865A7601093CEF8B00E1994BE6 |
|
29.08.2008, 15:19
| #11 |
| | Trojaner - spyware - log file hijack Antivirus Logfile Teil II Datei AppleSyncNotifier.exe empfangen 2008.08.29 15:55:17 (CET) Status: Beendet Ergebnis: 0/35 (0%) Filter Drucken der Ergebnisse Email: Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 - Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.29 - AVG 8.0.0.161 2008.08.29 - BitDefender 7.2 2008.08.29 - CAT-QuickHeal 9.50 2008.08.29 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 - eTrust-Vet 31.6.6056 2008.08.29 - Ewido 4.0 2008.08.29 - F-Prot 4.4.4.56 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 - GData 19 2008.08.29 - Ikarus T3.1.1.34.0 2008.08.29 - K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 - McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 - NOD32v2 3399 2008.08.29 - Norman 5.80.02 2008.08.28 - Panda 9.0.0.4 2008.08.29 - PCTools 4.4.2.0 2008.08.29 - Prevx1 V2 2008.08.29 - Rising 20.59.41.00 2008.08.29 - Sophos 4.33.0 2008.08.29 - Sunbelt 3.1.1592.1 2008.08.29 - Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 - VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.29.1355 2008.08.29 - VirusBuster 4.5.11.0 2008.08.29 - Webwasher-Gateway 6.6.2 2008.08.29 - weitere Informationen File size: 116040 bytes MD5...: 0bbc0204478194e404df71b7a3e3fc22 SHA1..: a540fc8fe10fad1dcbf8f98b6213cc298e0376c6 SHA256: 5cebfe5a8894b9c8cbe1c114164964189a438a980d608691c0d1dcf2725edf19 SHA512: bd7d4415d37a5916f63c14736ee3593d8cfc6441f499c864fb7e9f30c01cc25c bcd46cb972d8199ffd180916b5fd941e49d79d7654debbcbdfae84f6153c0aba PEiD..: - TrID..: File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x4096f3 timedatestamp.....: 0x485ce105 (Sat Jun 21 11:07:49 2008) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x9a9d 0xa000 6.33 cadbaa632b76c5df4e741dcb259752a8 .rdata 0xb000 0x5008 0x6000 4.23 0c6b17888660f5f0db34d4400739dfd9 .data 0x11000 0xb94 0x1000 2.29 1ad923ef303961d4c0930e1b65fc083a .rsrc 0x12000 0x878c 0x9000 5.93 bd936be4cd30c2dcf64653501056d620 ( 11 imports ) > Secur32.dll: GetUserNameExW > RPCRT4.dll: UuidCreate, UuidToStringW, RpcStringFreeW > KERNEL32.dll: CloseHandle, LoadLibraryW, GetLastError, GetUserDefaultLCID, FreeLibrary, WaitForSingleObject, lstrcmpiW, DeleteCriticalSection, InitializeCriticalSection, lstrlenW, InterlockedIncrement, CreateThread, InterlockedDecrement, WaitForMultipleObjects, MultiByteToWideChar, LeaveCriticalSection, CreateEventW, SetEvent, GetCurrentThreadId, RaiseException, GetModuleHandleW, LoadLibraryExW, EnterCriticalSection, GetModuleFileNameW, SetLastError, GetCurrentProcess, FlushInstructionCache, LocalFree, FormatMessageW, ReadDirectoryChangesW, ResetEvent, ResumeThread, TerminateThread, FindResourceExW, OutputDebugStringW, GetFileAttributesExW, SetFilePointer, FlushFileBuffers, SizeofResource, OpenMutexW, CreateMutexW, GetProcAddress, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoA, Sleep, HeapSize, HeapReAlloc, HeapDestroy, VirtualAlloc, VirtualFree, IsProcessorFeaturePresent, LoadLibraryA, HeapAlloc, GetProcessHeap, HeapFree, InterlockedCompareExchange, GetThreadLocale, GetLocaleInfoA, GetACP, InterlockedExchange, GetVersionExA, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, CreateFileW, FindResourceW, LoadResource, LockResource, WriteFile, CreateProcessW > USER32.dll: IsWindow, SetForegroundWindow, GetCursorPos, DestroyMenu, LoadMenuW, LoadIconW, RegisterWindowMessageW, UnregisterClassA, MonitorFromPoint, GetSubMenu, EnableMenuItem, TrackPopupMenu, CallWindowProcW, DefWindowProcW, GetWindowLongW, SetTimer, KillTimer, wsprintfW, PostMessageW, GetMonitorInfoW, LoadCursorW, GetClassInfoExW, SetWindowLongW, RegisterClassExW, CreateWindowExW, CharNextW, PeekMessageW, GetMessageW, TranslateMessage, DispatchMessageW, PostQuitMessage, DestroyWindow, LoadStringW > ADVAPI32.dll: RegNotifyChangeKeyValue, GetUserNameW, RegEnumKeyExW, RegQueryInfoKeyW, RegDeleteKeyW, RegDeleteValueW, RegSetValueExW, RegCreateKeyExW, RegCloseKey, RegQueryValueExW, RegOpenKeyExW > SHELL32.dll: SHGetFolderPathW, SHGetSpecialFolderPathW, Shell_NotifyIconW, ShellExecuteW, SHCreateDirectoryExW > ole32.dll: CoCreateInstance, CoUninitialize, CoInitialize, CoTaskMemFree, CoTaskMemRealloc, CoTaskMemAlloc > OLEAUT32.dll: -, -, -, -, -, -, - > SHLWAPI.dll: PathFileExistsW, PathRemoveFileSpecW, PathAppendW > MSVCP80.dll: _find_first_of@_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QBEIPB_WI@Z, _npos@_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@2IB, __0_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAE@ABV01@@Z, _replace@_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z, __$_8_WU_$char_traits@_W@std@@V_$allocator@_W@1@@std@@YA_NABV_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@0@0@Z, _reserve@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEXI@Z, __$_H_WU_$char_traits@_W@std@@V_$allocator@_W@1@@std@@YA_AV_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@0@ABV10@0@Z, _begin@_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAE_AV_$_String_iterator@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@2@XZ, _end@_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAE_AV_$_String_iterator@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@2@XZ, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ID@Z, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@IAEX_NI@Z, __6_$basic_ostream@_WU_$char_traits@_W@std@@@std@@QAEAAV01@H@Z, _sputc@_$basic_streambuf@_WU_$char_traits@_W@std@@@std@@QAEG_W@Z, _length@_$char_traits@_W@std@@SAIPB_W@Z, __6_$basic_ostream@_WU_$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z, _endl@std@@YAAAV_$basic_ostream@_WU_$char_traits@_W@std@@@1@AAV21@@Z, __0_$basic_ostringstream@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAE@H@Z, _str@_$basic_ostringstream@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QBE_AV_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@2@XZ, ___D_$basic_ostringstream@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAEXXZ, __Unlock@_$basic_streambuf@_WU_$char_traits@_W@std@@@std@@QAEXXZ, _uncaught_exception@std@@YA_NXZ, __Osfx@_$basic_ostream@_WU_$char_traits@_W@std@@@std@@QAEXXZ, __$_H_WU_$char_traits@_W@std@@V_$allocator@_W@1@@std@@YA_AV_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@0@ABV10@PB_W@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@PBD@Z, __1_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAE@XZ, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __Y_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAEAAV01@PB_W@Z, __4_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z, __0_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAE@PB_W@Z, __0_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAE@PB_WI@Z, __$_9_WU_$char_traits@_W@std@@V_$allocator@_W@1@@std@@YA_NABV_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@0@PB_W@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@ABV01@@Z, _flush@_$basic_ostream@_WU_$char_traits@_W@std@@@std@@QAEAAV12@XZ, __0_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAE@XZ, __4_$basic_string@_WU_$char_traits@_W@std@@V_$allocator@_W@2@@std@@QAEAAV01@PB_W@Z, _sputn@_$basic_streambuf@_WU_$char_traits@_W@std@@@std@@QAEHPB_WH@Z, __Lock@_$basic_streambuf@_WU_$char_traits@_W@std@@@std@@QAEXXZ, _setstate@_$basic_ios@_WU_$char_traits@_W@std@@@std@@QAEXH_N@Z > MSVCR80.dll: _time64, swprintf_s, _ftime64_s, wcslen, wcsftime, _localtime64_s, wcsstr, _unlock, __dllonexit, _encode_pointer, _lock, _onexit, _decode_pointer, _terminate@@YAXXZ, _amsg_exit, __getmainargs, _cexit, _exit, _XcptFilter, _ismbblead, exit, _acmdln, _initterm, _initterm_e, _configthreadlocale, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler4_common, _crt_debugger_hook, __type_info_dtor_internal_method@type_info@@QAEXXZ, _invoke_watson, _controlfp_s, __CxxFrameHandler3, _CxxThrowException, __3@YAXPAX@Z, memcpy, __1exception@std@@UAE@XZ, _what@exception@std@@UBEPBDXZ, _invalid_parameter_noinfo, __0exception@std@@QAE@XZ, _wtoi, __2@YAPAXI@Z, wcscpy_s, __0exception@std@@QAE@ABQBD@Z, __0exception@std@@QAE@ABV01@@Z, wcsncpy_s, memset, _recalloc, memcpy_s, ___V@YAXPAX@Z, malloc, memmove_s, free ( 0 exports ) Datei wav.exe empfangen 2008.08.29 15:58:03 (CET) Status: Beendet Ergebnis: 12/36 (33.34%) Filter Drucken der Ergebnisse Email: Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 TR/Fake.UltimaAV.bh Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.29 - AVG 8.0.0.161 2008.08.29 FakeAlert.AO BitDefender 7.2 2008.08.29 MemScan:Trojan.Fakeav.AD CAT-QuickHeal 9.50 2008.08.29 (Suspicious) - DNAScan ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 - eTrust-Vet 31.6.6055 2008.08.29 Win32/FakeAVE!generic Ewido 4.0 2008.08.29 - F-Prot 4.4.4.56 2008.08.29 - F-Secure 7.60.13501.0 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 - GData 19 2008.08.29 - Ikarus T3.1.1.34.0 2008.08.29 Generic.Trojan.Fakeav.AD K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 - McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 - NOD32v2 3399 2008.08.29 - Norman 5.80.02 2008.08.28 AntiVirus2008.EA Panda 9.0.0.4 2008.08.29 Suspicious file PCTools 4.4.2.0 2008.08.29 - Prevx1 V2 2008.08.29 Suspicious Rising 20.59.41.00 2008.08.29 - Sophos 4.33.0 2008.08.29 - Sunbelt 3.1.1592.1 2008.08.29 VIPRE.Suspicious Symantec 10 2008.08.29 AntiVirus2008 TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 - VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.29.1355 2008.08.29 - VirusBuster 4.5.11.0 2008.08.29 - Webwasher-Gateway 6.6.2 2008.08.29 Trojan.Fake.UltimaAV.bh weitere Informationen File size: 419328 bytes MD5...: 295d4f01cb2954868e397b46eba8c8d8 SHA1..: adbdc063f6b6c1840c7221f27ca9903d16c70d5c SHA256: 46cdb8c3987721bba29fb7fd15fb63f0463a2a163190e5a863a8b914a096c675 SHA512: 9cf9db5cd1379b4c6c7d3117cb85e4b6cc08b28751471fe069d18dff08f4a231 b3a871cd792540c8c4e9ee9171ee637587f93a14e6ba91e347ad8d12524a2bd8 PEiD..: ASProtect v1.23 RC1 TrID..: File type identification Win32 Executable Generic (68.0%) Generic Win/DOS Executable (15.9%) DOS Executable Generic (15.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x401000 timedatestamp.....: 0x48b56b5f (Wed Aug 27 14:57:35 2008) machinetype.......: 0x14c (I386) ( 7 sections ) name viradd virsiz rawdsiz ntrpy md5 0x1000 0x32000 0x19800 8.00 76eb892c041d508a4b339fcc79ce9a87 0x33000 0xc000 0x4a00 7.99 f2b684420021f384fdd5c97211bfa5d2 0x3f000 0xa000 0x1200 7.97 d11c1fa618a6ef2ebada15e4db10e32d .rsrc 0x49000 0x23000 0x11400 7.89 4b92be353c35362d95a430134ec240d1 0x6c000 0x1000 0x200 7.59 9dceb781cb197dcc22a4a032822d9e67 .uigYGSD 0x6d000 0x35000 0x34c00 7.71 2375cb2bb866ce522f66514d4df9fd2a .adata 0xa2000 0x1000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e ( 15 imports ) > kernel32.dll: GetProcAddress, GetModuleHandleA, LoadLibraryA > shlwapi.dll: SHDeleteKeyA > user32.dll: PostThreadMessageA > gdi32.dll: ScaleViewportExtEx > comdlg32.dll: GetFileTitleA > winspool.drv: ClosePrinter > advapi32.dll: LookupPrivilegeValueA > shell32.dll: Shell_NotifyIconA > comctl32.dll: - > oledlg.dll: - > ole32.dll: CoFreeUnusedLibraries > olepro32.dll: - > oleaut32.dll: - > oleaut32.dll: VariantChangeTypeEx > kernel32.dll: RaiseException ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=64F2F52A00CE7A21664B06D91C4A0000B4DB28E6 packers (Kaspersky): PE_Patch packers (F-Prot): Aspack Datei wcs.exe empfangen 2008.08.29 16:00:09 (CET) Status: Beendet Ergebnis: 17/36 (47.23%) Filter Drucken der Ergebnisse Email: Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 TR/Drop.Zlob.ret.2 Authentium 5.1.0.4 2008.08.29 W32/FakeAlert.O.gen!Eldorado Avast 4.8.1195.0 2008.08.29 - AVG 8.0.0.161 2008.08.29 - BitDefender 7.2 2008.08.29 Trojan.Downloader.Zlob.ABRP CAT-QuickHeal 9.50 2008.08.29 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 Suspicious File eTrust-Vet 31.6.6056 2008.08.29 Win32/Moiling!generic Ewido 4.0 2008.08.29 - F-Prot 4.4.4.56 2008.08.29 W32/FakeAlert.O.gen!Eldorado F-Secure 7.60.13501.0 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 - GData 19 2008.08.29 - Ikarus T3.1.1.34.0 2008.08.29 Trojan-Downloader.Zlob.ABRP K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 - McAfee 5372 2008.08.28 Generic FakeAlert Microsoft 1.3807 2008.08.25 TrojanDownloader:Win32/Zlob.gen!BZ NOD32v2 3399 2008.08.29 Win32/TrojanDownloader.Zlob.CJW Norman 5.80.02 2008.08.28 W32/Zlob.gen115 Panda 9.0.0.4 2008.08.29 Suspicious file PCTools 4.4.2.0 2008.08.29 - Prevx1 V2 2008.08.29 Malware Dropper Rising 20.59.41.00 2008.08.29 - Sophos 4.33.0 2008.08.29 Troj/Zlob-ALO Sunbelt 3.1.1592.1 2008.08.29 Trojan-Downloader.Zlob.Media-Codec Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 PAK_Generic.001 VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.29.1355 2008.08.29 - VirusBuster 4.5.11.0 2008.08.29 - Webwasher-Gateway 6.6.2 2008.08.29 Trojan.Drop.Zlob.ret.2 weitere Informationen File size: 15360 bytes MD5...: 7a1e3a73a9537be1a8c5bcb3958bdb56 SHA1..: cd4eefd1e8c7d217055926c752aa7da0c0892e60 SHA256: 5cf382efac633b71c8f1fd84af992cb32513d2a66df6f7152e4755a91e0f691e SHA512: e2164b58cc99746b90407b0b251cd5b137dac811ee7a17797fd560a4b14e02f8 a1bb1e5ede10f1f0ee059173d12a73ba9a61f0777877aa7fd44108ec569de235 PEiD..: - TrID..: File type identification UPX compressed Win32 Executable (39.5%) Win32 EXE Yoda's Crypter (34.3%) Win32 Executable Generic (11.0%) Win32 Dynamic Link Library (generic) (9.8%) Generic Win/DOS Executable (2.5%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x40dd00 timedatestamp.....: 0x48b5a7a6 (Wed Aug 27 19:14:46 2008) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 UPX0 0x1000 0xa000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e UPX1 0xb000 0x3000 0x3000 7.79 83ad9faaf6a8dd0f90e3bae2e88da5e9 .rsrc 0xe000 0x1000 0x800 2.62 0a735635679df542bd6d057d14c94c80 ( 7 imports ) > KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess > ADVAPI32.dll: RegCloseKey > ole32.dll: CoInitialize > OLEAUT32.dll: - > SHELL32.dll: SHGetFolderPathA > USER32.dll: LoadIconA > WININET.dll: HttpQueryInfoA ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=F86591AF001BDB873CD0003EBEB0830079B57240 packers (Kaspersky): PE_Patch.UPX, UPX C:\Program Files\Applications\iebtm.exe Datei ES08082900138-000019_trojan_Win32 empfangen 2008.08.29 08:20:09 (CET) Status: Beendet Ergebnis: 10/35 (28.57%) Filter Drucken der Ergebnisse Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.28 TR/Zlob.reu Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.28 - AVG 8.0.0.161 2008.08.29 - BitDefender 7.2 2008.08.29 - CAT-QuickHeal 9.50 2008.08.26 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.28 - eSafe 7.0.17.0 2008.08.28 Suspicious File eTrust-Vet 31.6.6055 2008.08.29 Win32/Puper!generic Ewido 4.0 2008.08.28 - F-Prot 4.4.4.56 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 - GData 19 2008.08.29 - Ikarus T3.1.1.34.0 2008.08.29 - K7AntiVirus 7.10.428 2008.08.25 - Kaspersky 7.0.0.125 2008.08.29 - McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 TrojanDownloader:Win32/Zlob.gen!BZ NOD32v2 3397 2008.08.28 Win32/TrojanDownloader.Zlob.CJW Norman 5.80.02 2008.08.28 - Panda 9.0.0.4 2008.08.29 - PCTools 4.4.2.0 2008.08.28 Trojan.Popuper Prevx1 V2 2008.08.29 Malware Dropper Rising 20.59.31.00 2008.08.28 - Sophos 4.33.0 2008.08.29 Troj/Zlob-ALO Sunbelt 3.1.1592.1 2008.08.29 - Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 PAK_Generic.001 VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.28.1353 2008.08.28 - VirusBuster 4.5.11.0 2008.08.28 - Webwasher-Gateway 6.6.2 2008.08.28 Trojan.Zlob.reu weitere Informationen File size: 27136 bytes MD5...: 5af61cefa77ac3987cdce580ce9bf435 SHA1..: 85b1f9fcd2f8c3036e623b87947bacbdc328a589 SHA256: f4fc9cf8c4dc762f615fb8e150c71b9db399baea1cdbaa778f95b7a26d3bc544 SHA512: ba15c5bf7f61861593f31a7c8c52afe2bb3e8a55b77267e0e17c033d80e5fcfc e839bd96aa18262dbe3770bfb7183156997ad8a72d041e0b8e024f7b4b0a8ee6 PEiD..: - TrID..: File type identification UPX compressed Win32 Executable (39.5%) Win32 EXE Yoda's Crypter (34.3%) Win32 Executable Generic (11.0%) Win32 Dynamic Link Library (generic) (9.8%) Generic Win/DOS Executable (2.5%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x401034 timedatestamp.....: 0x48b5a7d2 (Wed Aug 27 19:15:30 2008) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x1ede 0x2000 5.95 605d87c4ca5cc565ff751e7bce2bf921 .rdata 0x3000 0xdb2 0xe00 5.50 c6774dc0c893bb0469db229d4d55c218 .data 0x4000 0x578 0x200 1.12 3176074ef11ba2dd8f2190e4fa5c10c7 .rsrc 0x5000 0x34c0 0x3600 6.67 814134791d65572e01f9aa9c247a15ce ( 5 imports ) > KERNEL32.dll: CloseHandle, Sleep, WaitForSingleObject, CreateFileA, FreeLibrary, LoadLibraryExA, GetProcAddress, DeleteFileA, GetLastError, CreateEventA, WideCharToMultiByte, OpenEventA, ExitThread, GetModuleFileNameA, lstrcpyA, GetCurrentThread, lstrcatA, OpenMutexA, SuspendThread, GetFileAttributesA, GetModuleHandleA, LoadResource, FindResourceA, ExitProcess, Process32First, LoadLibraryA, CreateToolhelp32Snapshot, CompareStringA, lstrcmpA, lstrlenA, SetEvent, LoadLibraryW, ResetEvent, WaitForMultipleObjects, CreateThread, WriteFile > USER32.dll: TranslateMessage, wsprintfA, DispatchMessageA, SetThreadDesktop, ShowWindow, PeekMessageA, CreateWindowExA, FindWindowW, CreateDesktopA, MsgWaitForMultipleObjects, DestroyWindow > ADVAPI32.dll: RegCloseKey, RegOpenKeyA, RegQueryValueExA, RegOpenKeyExA, RegEnumKeyA, RegDeleteKeyA, RegCreateKeyExA, RegNotifyChangeKeyValue > ole32.dll: CoInitialize, CoUninitialize > SHELL32.dll: SHGetFolderPathA ( 0 exports ) Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=A49884E700EA2F9D6AF6009472F88B002D2299B7 packers (F-Prot): UPX Datei xaudio.exe_ empfangen 2008.08.29 16:08:34 (CET) Status: Beendet Ergebnis: 0/35 (0%) Filter Drucken der Ergebnisse Email: Antivirus Version letzte aktualisierung Ergebnis AhnLab-V3 2008.8.29.0 2008.08.29 - AntiVir 7.8.1.23 2008.08.29 - Authentium 5.1.0.4 2008.08.29 - Avast 4.8.1195.0 2008.08.29 - AVG 8.0.0.161 2008.08.29 - BitDefender 7.2 2008.08.29 - CAT-QuickHeal 9.50 2008.08.29 - ClamAV 0.93.1 2008.08.29 - DrWeb 4.44.0.09170 2008.08.29 - eSafe 7.0.17.0 2008.08.28 - eTrust-Vet 31.6.6056 2008.08.29 - Ewido 4.0 2008.08.29 - F-Prot 4.4.4.56 2008.08.29 - Fortinet 3.14.0.0 2008.08.29 - GData 19 2008.08.29 - Ikarus T3.1.1.34.0 2008.08.29 - K7AntiVirus 7.10.431 2008.08.29 - Kaspersky 7.0.0.125 2008.08.29 - McAfee 5372 2008.08.28 - Microsoft 1.3807 2008.08.25 - NOD32v2 3399 2008.08.29 - Norman 5.80.02 2008.08.28 - Panda 9.0.0.4 2008.08.29 - PCTools 4.4.2.0 2008.08.29 - Prevx1 V2 2008.08.29 - Rising 20.59.41.00 2008.08.29 - Sophos 4.33.0 2008.08.29 - Sunbelt 3.1.1592.1 2008.08.29 - Symantec 10 2008.08.29 - TheHacker 6.3.0.6.064 2008.08.27 - TrendMicro 8.700.0.1004 2008.08.29 - VBA32 3.12.8.4 2008.08.29 - ViRobot 2008.8.29.1355 2008.08.29 - VirusBuster 4.5.11.0 2008.08.29 - Webwasher-Gateway 6.6.2 2008.08.29 - weitere Informationen File size: 386560 bytes MD5...: 28dc5d626e036a75a572556f0a6eb1f6 SHA1..: dd64c1673984c5121bfbc0a8dd162b54ee7cc10e SHA256: 9ae635c08b87ad85a552ade0af8ba10dc258e0defe133a2a74efcd43b7a38a98 SHA512: ba4c95678ec56db108f04cc04a0e0e941432ea2689b3b907c1994506709a62f8 cba10dbb61d7709fb8b9b1396e317920d13ac56e4b6e54078d96e2009de5688a PEiD..: - TrID..: File type identification Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%) PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x408bdb timedatestamp.....: 0x44d3e8b7 (Sat Aug 05 00:39:19 2006) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x14b28 0x14c00 6.80 aafe89a87d42aa93f4a0324b53840475 .rdata 0x16000 0x47846 0x47a00 7.56 6c007d5d100a39cbd45ecfc7a7feb04d .data 0x5e000 0x76c4 0x1800 3.60 90b4909db1ada91a08978d5ec3c70f1e .rsrc 0x66000 0x378 0x400 2.88 0ae06dca8f1768ca7146e1565e232091 ( 4 imports ) > KERNEL32.dll: FormatMessageA, lstrlenA, LocalFree, GetModuleFileNameA, GetVersionExA, QueryPerformanceFrequency, WaitForSingleObject, CreateEventA, CreateFileA, ResetEvent, WaitForMultipleObjects, DeviceIoControl, GetLastError, CancelIo, CloseHandle, Sleep, SetEvent, FlushFileBuffers, WriteConsoleW, HeapFree, HeapAlloc, ExitThread, ResumeThread, CreateThread, GetProcAddress, GetModuleHandleA, ExitProcess, GetCommandLineA, GetProcessHeap, HeapDestroy, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, RaiseException, WriteFile, GetStdHandle, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, LoadLibraryA, InitializeCriticalSection, GetCPInfo, GetACP, GetOEMCP, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RtlUnwind, HeapSize, SetFilePointer, GetConsoleCP, GetConsoleMode, MultiByteToWideChar, GetLocaleInfoA, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, SetStdHandle, WriteConsoleA, GetConsoleOutputCP > ADVAPI32.dll: SetSecurityDescriptorDacl, SetServiceStatus, DeregisterEventSource, StartServiceCtrlDispatcherA, RegisterServiceCtrlHandlerA, OpenServiceA, ControlService, QueryServiceStatus, DeleteService, OpenSCManagerA, CreateServiceA, CloseServiceHandle, RegisterEventSourceA, ReportEventA, InitializeSecurityDescriptor > AVRT.dll: AvSetMmThreadCharacteristicsA, AvRevertMmThreadCharacteristics > ole32.dll: CoTaskMemFree, CoInitializeEx, CoUninitialize, CoCreateInstance ( 0 exports ) |
|
29.08.2008, 15:28
| #12 | |
| | Trojaner - spyware - log file hijack Du hast einen Zlob auf deinem Rechner,das kommt davon wenn mann keine Updates hast weil du hast noch SP1 und es gibt schon SP3! Fixxe unbedingt folgende Sachen: Zitat:
__________________ LG StormBird Google ist dein bester Freund |
|
29.08.2008, 15:45
| #13 |
| | Trojaner - spyware - log file hijack Was ist ein ZLOT ? Wie kann ich denn C:\Program Files\Applications\wcm.exe C:\Windows\System32\ubpr01.exe fixxen - die werden in Hi Jack gar nicht angezeigt ? Hier das neue Logfile (ohne die beiden o.g. Positionen): Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:43:27, on 29.08.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Windows\system32\Dwm.exe C:\Windows\System32\rundll32.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Applications\iebtmm.exe C:\Program Files\Steam\Steam.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Applications\wcm.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE C:\Program Files\Applications\iebtm.exe C:\Program Files\Applications\wcs.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {0BD44AB1-76A7-4E05-92F4-4B065FE72BD6} - C:\Program Files\Applications\iebt.dll O2 - BHO: 120237 helper - {176D799E-6C8C-4D1A-8024-044D96A035E2} - C:\Windows\system32\120237\120237.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKLM\..\Policies\Explorer\Run: [start] C:\Program Files\Applications\iebtm.exe O4 - HKLM\..\Policies\Explorer\Run: [smile] C:\Program Files\Applications\wcs.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = ? O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iexplorerfiles.com/redirect.php (file missing) O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.iexplorerfiles.com/redirect.php (file missing) O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O10 - Broken Internet access because of LSP provider 'c:\windows\system32\pnrpnsp.dll' missing O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe -- End of file - 4270 bytes |
|
29.08.2008, 15:55
| #14 |
| | Trojaner - spyware - log file hijack Puhh... du kriegst immer wieder neue dateien drauf naja dann gehen wa härter vor. http://www.trojaner-board.de/51187-a...i-malware.html Dann Malwarebytes installen updates machen,und ein hacken auf Komplett Scan und anschließend alle funde löschen. Danach Gehst du in den Abgesicherten Modus! Downloadest dir Smitfraudfix Anleitung steht da und führst alles aus wie es da steht. http://siri.urz.free.fr/Fix/SmitfraudFix_De.php Danach ein neues Frisches HijackThis Logfile
__________________ LG StormBird Google ist dein bester Freund |
|
29.08.2008, 16:03
| #15 |
| | Trojaner - spyware - log file hijack ok - scan läuft. wie aktiviere ich den abgesicherten modus  |
|
| Themen zu Trojaner - spyware - log file hijack |
| add-on, antivirus, bho, browser, dll, drivers, excel, explorer, extrem langsam, file, hijack, hijackthis, internet, internet explorer, langsam, log, log file, pop up fenster, problem, rundll, security, software, spyware, system, toolbars, trojaner, virus, vista, windows, windows\system32\drivers, wmp |
Linear-Darstellung
