Trojan Keylogger Win 32 Fung

Partynixe21

Hi Leute,

also ich saß jetzt an meinem PC, alles war normal, bis plötzlich die Meldung im Windows Firewall Fenster aufging "Ihr computer wurde von Trojan Keylogger Win 32 angegriffen" kam. So nun weiß ich igrnedwie nich t weiter.. ICh bin ne ziemlich null auf diesem gebiet, muss ich zugeben. Auf alle fälle hab ich in nem älteren beitrag von dieser seite hier gelesen, dass ich bei VirusTotal den Pfad C:\WINDOWS\system32\drivers\svchost.exe analysieren lasse.
Das hab ich gemacht. Hier das Ergebnis.:

Datei svchost.exe empfangen 2008.10.31 16:39:18 (CET)
Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt
Ergebnis: 7/36 (19.45%)

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.10.30.1 2008.10.31 -
AntiVir 7.9.0.10 2008.10.31 -
Authentium 5.1.0.4 2008.10.31 W32/Malware!OC-based
Avast 4.8.1248.0 2008.10.31 -
AVG 8.0.0.161 2008.10.31 Win32/Cryptor
BitDefender 7.2 2008.10.31 -
CAT-QuickHeal 9.50 2008.10.31 -
ClamAV 0.94.1 2008.10.31 -
DrWeb 4.44.0.09170 2008.10.31 -
eSafe 7.0.17.0 2008.10.30 -
eTrust-Vet 31.6.6184 2008.10.31 -
Ewido 4.0 2008.10.31 -
F-Prot 4.4.4.56 2008.10.30 W32/Malware!OC-based
F-Secure 8.0.14332.0 2008.10.31 -
Fortinet 3.117.0.0 2008.10.31 -
GData 19 2008.10.31 -
Ikarus T3.1.1.44.0 2008.10.31 -
K7AntiVirus 7.10.513 2008.10.31 -
Kaspersky 7.0.0.125 2008.10.31 -
McAfee 5419 2008.10.31 -
Microsoft 1.4005 2008.10.31 TrojanDownloader:Win32/Small.IQ
NOD32 3573 2008.10.31 a variant of Win32/Kryptik.BA
Norman 5.80.02 2008.10.30 -
Panda 9.0.0.4 2008.10.30 -
PCTools 4.4.2.0 2008.10.31 -
Prevx1 V2 2008.10.31 Cloaked Malware
Rising 21.01.42.00 2008.10.31 -
SecureWeb-Gateway 6.7.6 2008.10.31 -
Sophos 4.35.0 2008.10.31 Mal/EncPk-CZ
Sunbelt 3.1.1767.2 2008.10.31 -
Symantec 10 2008.10.31 -
TheHacker 6.3.1.1.135 2008.10.31 -
TrendMicro 8.700.0.1004 2008.10.31 -
VBA32 3.12.8.9 2008.10.30 -
ViRobot 2008.10.31.1446 2008.10.31 -
VirusBuster 4.5.11.0 2008.10.31 -

File size: 35840 bytes
MD5...: d4d30d54d3268b43a2f0a79a48b9f0c5
SHA1..: c039e06dc20362f1b46616ca7bd0d8f201441343
SHA256: bbccde95c949727c68c8f1136eec46923651436d48fc55a0666eab00ca996541
SHA512: fe724e46f58f6bf0dc4748dc2c6d17c8778a67f8635a7dd24197851aeeda84d6
9437a3a1a6be16c67b534ed40f6d682423556b371753bfcbbbea1435b2f8ad06
PEiD..: -
TrID..: File type identification
Win32 Dynamic Link Library (generic) (65.2%)
Generic Win/DOS Executable (17.2%)
DOS Executable Generic (17.2%)
VXD Driver (0.2%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4011b9
timedatestamp.....: 0x4831ddd1 (Mon May 19 20:06:41 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xb71 0xc00 3.83 5b712b8f58b737b038037bded0464af9
.rdata 0x2000 0xf1d 0x1000 5.17 0445c9d3a9c22952d2db2ae6e041ec6a
.data 0x3000 0x1f9ef 0x6600 6.64 421b8738938930f743f4b0ef19217ec4
.reloc 0x23000 0x1e3 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x24000 0x22e 0x400 0.00 0f343b0931126a20f133d67c2b018a3b

( 9 imports )
> COMCTL32.DLL: ImageList_GetDragImage, ImageList_Create, ImageList_Merge, ImageList_GetImageRect, ImageList_Remove, ImageList_DragShowNolock, ImageList_Copy, ImageList_GetImageCount, ImageList_AddMasked, ImageList_AddIcon, ImageList_DragEnter, ImageList_DrawIndirect, ImageList_DragLeave, ImageList_LoadImageA, ImageList_DrawEx, ImageList_ReplaceIcon, ImageList_EndDrag
> COMCTL32.DLL: ImageList_DragEnter, ImageList_GetImageCount, ImageList_AddMasked, ImageList_AddIcon, ImageList_Replace, ImageList_GetDragImage, ImageList_DrawEx, ImageList_LoadImageA, ImageList_EndDrag, ImageList_GetImageRect, ImageList_Merge, ImageList_DragLeave, ImageList_GetIconSize, ImageList_Create
> GDI32.DLL: DeleteDC, AddFontResourceA, AddFontResourceExW, RestoreDC, GetCurrentPositionEx, GetPixel, CreateSolidBrush, AddFontResourceTracking, AddFontResourceExA, AbortPath, CloseFigure
> GDI32.DLL: GetPixel, GetClipBox, GetCurrentPositionEx, AddFontResourceW, GetBrushOrgEx, GetDCOrgEx, CancelDC, ExcludeClipRect, CloseMetaFile, DeleteObject, SetTextColor
> ADVAPI32.DLL: RegQueryValueExW, RegDeleteValueW, RegOpenKeyA, RegQueryInfoKeyA, RegReplaceKeyA, RegEnumKeyW, RegOpenKeyW, RegLoadKeyA, RegEnumKeyA, RegCreateKeyExW, RegQueryInfoKeyW, RegFlushKey, RegEnumKeyExA
> KERNEL32.DLL: CopyFileExA, GetCPInfo, GetCommandLineA, CreateDirectoryA, GlobalFree, ExitThread, DeleteFileW, OpenFileMappingA, GetComputerNameA, GetFileTime, CopyFileExW, FindFirstFileA, ReadConsoleA, GetStdHandle
> USER32.DLL: EndDialog, LoadCursorA, DrawTextA, GetMenu, AppendMenuA, GetDlgItem, AlignRects, GetWindowTextA, IsWindow, DrawTextW, DialogBoxParamW, GetDC, LoadMenuA, CalcMenuBar, AppendMenuW, CopyImage, CopyRect, CopyIcon, GetWindowTextLengthA
> COMCTL32.DLL: ImageList_LoadImageA, ImageList_GetImageCount, ImageList_Destroy, ImageList_AddMasked, ImageList_GetIconSize, ImageList_Merge, InitCommonControls, ImageList_DragShowNolock, ImageList_ReplaceIcon, ImageList_DragLeave, ImageList_LoadImageW, ImageList_LoadImage
> GDI32.DLL: AddFontResourceExW, AddFontResourceA, GetPixel, DeleteDC, GetBitmapBits, SetTextColor, CloseFigure, AddFontResourceTracking, GetDCOrgEx, GetCurrentPositionEx, AddFontMemResourceEx, AbortPath, ClearBitmapAttributes, CreateSolidBrush, GetClipBox, CloseMetaFile, ExcludeClipRect, GetPixel, AddFontResourceExA



so nun kommt mein problem, was bedeutet das?? is mei rechner vol infiziert un was mach ich nun??

Kann mir jmd weiterhelfen??? wäre voll lieb... Ich weiß nämlich ne weiter...

Danke schonmal im Voraus