Antivirus xp 2008

jabardola · 29.08.2008, 19:44

Hallo allerseits, habe mir genau wie ein paar andere Kollegen hier den getarnten Virus als Virenprogram eingefangen. Konnte mir mit Mühe und Not noch den Servicepack 3 herunterladen. Hier nun meine Skan Daten. Hoffe ich bekomme hier Hilfe denn hier geht fast gar nichts mehr. Achso ich bin kein experte deswegen die Bitte etwas weniger Fachsprache zu benutzen

Danke schon mal im vorraus!!!!! Und nun die Logfiles:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:35:35, on 29.08.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Programme\Spyware Doctor\pctsAuxs.exe
C:\Programme\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\1XConfig.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\MSI\SearchKey\StartKBHook.exe
C:\Programme\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\rhcrrmj0e32r\rhcrrmj0e32r.exe
C:\Programme\Spyware Doctor\pctsTray.exe

Tayk · 29.08.2008, 19:49

Poste noch ein log dein erstes ist nicht vollständig! Da fehlen einträge!

jabardola · 29.08.2008, 19:51

Oh Sorry,
so der nächste Versuch::
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:35:35, on 29.08.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Programme\Spyware Doctor\pctsAuxs.exe
C:\Programme\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\1XConfig.exe
C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\MSI\SearchKey\StartKBHook.exe
C:\Programme\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Programme\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\Programme\rhcrrmj0e32r\rhcrrmj0e32r.exe
C:\Programme\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Messenger\msmsgs.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Programme\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Programme\CASIO\Photo Loader\Plauto.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\pphcvrmj0e32r.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Programme\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Programme\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O2 - BHO: CenterLock module - {18CB1A7B-94CD-4582-8022-ADA16851E44B} - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\services\services.dll
O2 - BHO: msvbcr40 module - {2756BAD7-2F9F-47ef-AE6D-8D39CCEB396F} - C:\WINDOWS\system32\msvbcr40.dll
O2 - BHO: XML module - {500BCA15-57A7-4eaf-8143-8C619470B13D} - C:\WINDOWS\system32\msxml71.dll
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SearchKey] C:\Programme\MSI\SearchKey\StartKBHook.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Programme\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [KTPWare] C:\Programme\Elantech\ktp3.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Programme\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Programme\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [lphcvrmj0e32r] C:\WINDOWS\system32\lphcvrmj0e32r.exe
O4 - HKLM\..\Run: [SMrhcrrmj0e32r] C:\Programme\rhcrrmj0e32r\rhcrrmj0e32r.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKLM\..\Run: [ISTray] "C:\Programme\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [69463140572975313360827921536270] C:\Programme\Antivirus 2009\av2009.exe
O4 - HKCU\..\Run: [s9201] "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SoftLand Ltd\Antivirus 2008 XP\av2008xp.exe" /autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Kodak EasyShare Software.lnk = C:\Programme\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Programme\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Photo Loader resident.lnk = C:\Programme\CASIO\Photo Loader\Plauto.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Programme\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Programme\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Programme\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Programme\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1113238884030
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1220031864705
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe

--
End of file - 9238 bytes

Tayk · 29.08.2008, 20:12

Lade folgende dateien bei VirusTotal - Kostenloser online Viren- und Malwarescanner hoch und poste den vollständigen bericht!

Zitat:

C:\Programme\rhcrrmj0e32r\rhcrrmj0e32r.exe
C:\WINDOWS\system32\pphcvrmj0e32r.exe
C:\Programme\ShoppingReport\Bin\2.5.0\ShoppingRepo rt.dll
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\services\services.dll
C:\WINDOWS\system32\msxml71.dll
C:\WINDOWS\system32\msvbcr40.dll
C:\Programme\MSI\SearchKey\StartKBHook.exe
C:\Programme\Elantech\ktp3.exe
C:\WINDOWS\system32\sysrest32.exe
C:\Programme\Antivirus 2009\av2009.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SoftLand Ltd\Antivirus 2008 XP\av2008xp.exe

jabardola · 29.08.2008, 20:19

File size: 831488 bytes
MD5...: b8a1e1c084bfb3d59e9046d1c53890c8
SHA1..: bb3ea76f6a433fdb94af62642e841ed71ecd4043
SHA256: 0706315b2e5503fe5bf3bd9bca72d6fbe1050d85ed4bfdba8bc27fd644491c43
SHA512: 364388681685c3343f746e8ba506fc5776cfba2cbbe434fa99172303bb47a889
8c7977c83fd6c83784324f17c6c63e1b636c26d2dee9ed5b9db5dcb9a87e9696
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (58.5%)
Clipper DOS Executable (13.8%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.7%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40139a
timedatestamp.....: 0x48b2df63 (Mon Aug 25 16:35:47 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.code 0x1000 0x984660 0x3000 2.96 a62c36efa6c6c065067e32f88476c718
DATA 0x986000 0xb2ce0 0xb3000 7.99 3044d426c25491e297e2b32a24195bd5
.rsrc 0xa39000 0x13000 0x13000 4.69 0f0439064d04fe96e396687d398c1a8a
.idata 0xa4c000 0x7fc 0x1000 1.72 bd63c262d5dfee12e2bfda5c6a371ea7
.pack32 0xa4d000 0x1000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

( 4 imports )
> kernel32.dll: SetThreadPriorityBoost, WriteProcessMemory, SetTapeParameters, GlobalDeleteAtom, GetFileAttributesExA, CompareFileTime, SetThreadLocale, WriteConsoleOutputCharacterA, OpenEventA, GetVersion
> user32.dll: HideCaret, DrawFrameControl, MessageBoxW, DlgDirSelectExW, OpenClipboard, IMPSetIMEW, GetInputState, DrawFocusRect
> shell32.dll: Control_RunDLLAsUserW, DragQueryPoint, StrNCmpIA, DragQueryFileA, PrintersGetCommand_RunDLLA, SHGetSettings, ShellHookProc, Control_RunDLLAsUserW, SHGetSpecialFolderLocation
> gdi32.dll: DeleteMetaFile, GetTextCharset, BRUSHOBJ_hGetColorTransform, CreatePolyPolygonRgn

( 0 exports )

Ist das so korrekt???

jabardola · 29.08.2008, 20:20

AhnLab-V3 2008.8.29.0 2008.08.29 -
AntiVir 7.8.1.23 2008.08.29 TR/XPAntivirus.AJ
Authentium 5.1.0.4 2008.08.29 W32/FakeAV2008.X
Avast 4.8.1195.0 2008.08.29 Win32:Trojan-gen {Other}
AVG 8.0.0.161 2008.08.29 Fake_AntiSpyware.AAO
BitDefender 7.2 2008.08.29 Trojan.XpAntivirus.AJ
CAT-QuickHeal 9.50 2008.08.29 FraudTool.AntivirusXP2008.u (Not a Virus)
ClamAV 0.93.1 2008.08.29 -
DrWeb 4.44.0.09170 2008.08.29 -
eSafe 7.0.17.0 2008.08.28 -
eTrust-Vet 31.6.6056 2008.08.29 Win32/FakeAV.EO
Ewido 4.0 2008.08.29 -
F-Prot 4.4.4.56 2008.08.29 W32/FakeAV2008.X
F-Secure 7.60.13501.0 2008.08.29 FraudTool.Win32.AntivirusXP2008.u
Fortinet 3.14.0.0 2008.08.29 W32/FAKEAV.GN!tr
GData 19 2008.08.29 Win32:Trojan-gen
Ikarus T3.1.1.34.0 2008.08.29 Malware-Cryptor.Win32.Rp
K7AntiVirus 7.10.432 2008.08.29 not-a-virus:FraudTool.Win32.AntivirusXP2008.u
Kaspersky 7.0.0.125 2008.08.29 not-a-virus:FraudTool.Win32.AntivirusXP2008.u
McAfee 5373 2008.08.29 -
Microsoft 1.3807 2008.08.25 -
NOD32v2 3399 2008.08.29 -
Norman 5.80.02 2008.08.29 Antivirus2008.gen3
Panda 9.0.0.4 2008.08.29 Application/AntivirusXP2008
PCTools 4.4.2.0 2008.08.29 -
Prevx1 V2 2008.08.29 Malicious Software
Rising 20.59.41.00 2008.08.29 -
Sophos 4.33.0 2008.08.29 Troj/FakeVir-EZ
Sunbelt 3.1.1592.1 2008.08.29 Antivirus XP 2008 (v)
Symantec 10 2008.08.29 AntiVirusXP2008
TheHacker 6.3.0.6.067 2008.08.29 -
TrendMicro 8.700.0.1004 2008.08.29 TROJ_FAKEAV.GN
ViRobot 2008.8.29.1355 2008.08.29 -
VirusBuster 4.5.11.0 2008.08.29 -
Webwasher-Gateway 6.6.2 2008.08.29 Trojan.XPAntivirus.AJ
weitere Informationen
File size: 831488 bytes
MD5...: b8a1e1c084bfb3d59e9046d1c53890c8
SHA1..: bb3ea76f6a433fdb94af62642e841ed71ecd4043
SHA256: 0706315b2e5503fe5bf3bd9bca72d6fbe1050d85ed4bfdba8bc27fd644491c43
SHA512: 364388681685c3343f746e8ba506fc5776cfba2cbbe434fa99172303bb47a889
8c7977c83fd6c83784324f17c6c63e1b636c26d2dee9ed5b9db5dcb9a87e9696
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (58.5%)
Clipper DOS Executable (13.8%)
Generic Win/DOS Executable (13.7%)
DOS Executable Generic (13.7%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40139a
timedatestamp.....: 0x48b2df63 (Mon Aug 25 16:35:47 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.code 0x1000 0x984660 0x3000 2.96 a62c36efa6c6c065067e32f88476c718
DATA 0x986000 0xb2ce0 0xb3000 7.99 3044d426c25491e297e2b32a24195bd5
.rsrc 0xa39000 0x13000 0x13000 4.69 0f0439064d04fe96e396687d398c1a8a
.idata 0xa4c000 0x7fc 0x1000 1.72 bd63c262d5dfee12e2bfda5c6a371ea7
.pack32 0xa4d000 0x1000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

( 4 imports )
> kernel32.dll: SetThreadPriorityBoost, WriteProcessMemory, SetTapeParameters, GlobalDeleteAtom, GetFileAttributesExA, CompareFileTime, SetThreadLocale, WriteConsoleOutputCharacterA, OpenEventA, GetVersion
> user32.dll: HideCaret, DrawFrameControl, MessageBoxW, DlgDirSelectExW, OpenClipboard, IMPSetIMEW, GetInputState, DrawFocusRect
> shell32.dll: Control_RunDLLAsUserW, DragQueryPoint, StrNCmpIA, DragQueryFileA, PrintersGetCommand_RunDLLA, SHGetSettings, ShellHookProc, Control_RunDLLAsUserW, SHGetSpecialFolderLocation
> gdi32.dll: DeleteMetaFile, GetTextCharset, BRUSHOBJ_hGetColorTransform, CreatePolyPolygonRgn

( 0 exports )

Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=D8AF91F000204F28B0FD0C9BB61508000A178ADA

Antivirus xp 2008

Plagegeister aller Art und deren Bekämpfung: Antivirus xp 2008