Aureate

LittleJo

Hallo zusammen,

seit einiger Zeit meldet mein Avira Antivirus, dass ein sehr altes Programm (cuteFTP) eine Dropper enthalten soll. Kennt jemand das Problem? Ich poste mal das Ergebnis von virustotal.com. Falls Ihr noch das HJ-Log braucht, kann ich auch jederzeit posten. Das Programm ist schon "uralt" - kann auch ein Fehlalarm sein - hoffentlich!?

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.12.19.3 2008.12.19 -
AntiVir 7.9.0.45 2008.12.19 DR/Aureate.A.51
Authentium 5.1.0.4 2008.12.18 -
Avast 4.8.1281.0 2008.12.18 Win32:Spyware-gen
AVG 8.0.0.199 2008.12.18 -
BitDefender 7.2 2008.12.19 Adware.Aureate.C
CAT-QuickHeal 10.00 2008.12.19 -
ClamAV 0.94.1 2008.12.19 -
Comodo 780 2008.12.19 -
DrWeb 4.44.0.09170 2008.12.19 Adware.Aureate
eSafe 7.0.17.0 2008.12.18 -
eTrust-Vet 31.6.6268 2008.12.18 -
Ewido 4.0 2008.12.18 -
F-Prot 4.4.4.56 2008.12.18 -
F-Secure 8.0.14332.0 2008.12.19 AdWare.Win32.Aureate.a
Fortinet 3.117.0.0 2008.12.19 Adware/Aureate
GData 19 2008.12.19 Adware.Aureate.C
Ikarus T3.1.1.45.0 2008.12.19 Downloader.Aureate.A.51
K7AntiVirus 7.10.557 2008.12.18 not-a-virus:AdWare.Win32.Aureate.a
Kaspersky 7.0.0.125 2008.12.19 not-a-virus:AdWare.Win32.Aureate.a
McAfee 5468 2008.12.18 -
McAfee+Artemis 5468 2008.12.18 -
Microsoft 1.4205 2008.12.19 Spyware:Win32/Aureate
NOD32 3704 2008.12.18 -
Norman 5.80.02 2008.12.18 -
Panda 9.0.0.4 2008.12.19 Adware/Aureate-Radiate
PCTools 4.4.2.0 2008.12.18 -
Prevx1 V2 2008.12.19 -
Rising 21.08.41.00 2008.12.19 -
SecureWeb-Gateway 6.7.6 2008.12.19 Trojan.Dropper.Aureate.A.51
Sophos 4.37.0 2008.12.19 Aureate
Sunbelt 3.2.1801.2 2008.12.11 AdWare.Win32.Aureate.a
Symantec 10 2008.12.19 -
TheHacker 6.3.1.4.191 2008.12.17 -
TrendMicro 8.700.0.1004 2008.12.19 -
VBA32 3.12.8.10 2008.12.18 -
ViRobot 2008.12.19.1527 2008.12.19 Adware.Aureate.1597266
VirusBuster 4.5.11.0 2008.12.18 -
weitere Informationen
File size: 1597266 bytes
MD5...: b0e01c901f2ebfc6ac359d6f906d088b
SHA1..: 66bc7b26c00f884224bb43cf08314e2c074ebb25
SHA256: 7535db4472102f7cfc568c3dd7884fcfadc54a496c70e5694039cb55f65d4fe9
SHA512: 26020891b6d35133b6e54cb1818440f218f0749cc78b42afa33d9cf41ce022c8
d50dfffea89b473d290d13d6e5ff646443c9dc3f2cf9481ce6c2d7b6a19866a3
ssdeep: 49152:XtKwGXAXL3XcKE3yf24lHUujSulz4O1XwZg/RM:9ZsY33E3J4xUuelO+0R
M
PEiD..: Wise Installer Stub
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4021af
timedatestamp.....: 0x36bb6bb8 (Fri Feb 05 22:07:52 1999)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2008 0x2200 6.08 1dd294ddfbe857e8f3e09a314f588157
.rdata 0x4000 0x769 0x800 4.71 a20d7e4893611dadd9d08cba1293cfae
.data 0x5000 0x404 0x400 3.42 81f5280b241b569ce3fc6a5e82d54ce8
.rsrc 0x6000 0x640 0x800 2.90 711f8a395d2cdc7d48f55cb0e9400d4b

( 4 imports )
> KERNEL32.dll: GetCommandLineA, SetErrorMode, GetModuleHandleA, MulDiv, GetTempFileNameA, GetModuleFileNameA, lstrlenA, _lclose, lstrcpyA, FormatMessageA, lstrcatA, GetLastError, _lwrite, _llseek, GlobalUnlock, GlobalFree, GlobalAlloc, _lopen, GetProcAddress, _lcreat, LoadLibraryA, GetVersionExA, FreeLibrary, OpenFile, ExitProcess, GetCurrentProcess, WinExec, GetTempPathA, _lread, LocalFree, GetWindowsDirectoryA, GlobalLock
> USER32.dll: GetDC, DrawTextA, EndPaint, InvalidateRect, PostQuitMessage, SendMessageA, DefWindowProcA, GetClientRect, CreateWindowExA, BeginPaint, ReleaseDC, SetWindowPos, ShowWindow, UpdateWindow, SetTimer, LoadIconA, RegisterClassA, MessageBoxA, ExitWindowsEx, LoadCursorA
> GDI32.dll: DeleteObject, PatBlt, CreateSolidBrush, GetDeviceCaps, SetTextColor, SetBkMode, TextOutA, StretchDIBits, CreateFontA, SelectObject, SelectPalette, CreatePalette, RealizePalette, GetStockObject
> ADVAPI32.dll: AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken

( 2 exports )
_MainWndProc@16, _StubFileWrite@12
CWSandbox info: <a href='http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=b0e01c901f2ebfc6ac359d6f906d088b' target='_blank'>http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=b0e01c901f2ebfc6ac359d6f906d088b</a>