"Warning, Dangerous Spyware" auf dem Desktop

Querfrage

-------------
Hier das Ergebnis für C:\WINDOWS\system32\frmwrk32.exe



Datei a.exe empfangen 2008.12.29 23:04:51 (CET)
Status: Beendet

Ergebnis: 3/38 (7.89%)
Filter Drucken der Ergebnisse
Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.0.0.73 2008.12.29 -
AhnLab-V3 2008.12.25.0 2008.12.29 -
AntiVir 7.9.0.45 2008.12.29 -
Authentium 5.1.0.4 2008.12.29 -
Avast 4.8.1281.0 2008.12.29 -
AVG 8.0.0.199 2008.12.29 -
BitDefender 7.2 2008.12.29 -
CAT-QuickHeal 10.00 2008.12.27 -
ClamAV 0.94.1 2008.12.29 -
Comodo 837 2008.12.29 -
DrWeb 4.44.0.09170 2008.12.29 -
eSafe 7.0.17.0 2008.12.28 Suspicious File
eTrust-Vet 31.6.6280 2008.12.29 -
Ewido 4.0 2008.12.29 -
F-Prot 4.4.4.56 2008.12.29 -
F-Secure 8.0.14470.0 2008.12.29 -
Fortinet 3.117.0.0 2008.12.29 -
GData 19 2008.12.29 -
Ikarus T3.1.1.45.0 2008.12.29 -
K7AntiVirus 7.10.569 2008.12.29 -
Kaspersky 7.0.0.125 2008.12.29 -
McAfee 5478 2008.12.29 -
McAfee+Artemis 5478 2008.12.29 -
Microsoft 1.4205 2008.12.29 -
NOD32 3722 2008.12.29 -
Panda 9.0.0.4 2008.12.29 -
PCTools 4.4.2.0 2008.12.29 -
Prevx1 V2 2008.12.29 Cloaked Malware
Rising 21.10.02.00 2008.12.29 -
SecureWeb-Gateway 6.7.6 2008.12.29 -
Sophos 4.37.0 2008.12.29 -
Sunbelt 3.2.1809.2 2008.12.22 -
Symantec 10 2008.12.29 -
TheHacker 6.3.1.4.201 2008.12.28 -
TrendMicro 8.700.0.1004 2008.12.29 -
VBA32 3.12.8.10 2008.12.28 suspected of Malware-Cryptor.Win32.General.4
ViRobot 2008.12.29.1538 2008.12.29 -
VirusBuster 4.5.11.0 2008.12.29 -
weitere Informationen
File size: 31744 bytes
MD5...: 4656a7c8d2d8f8df4b868e75a4e0cd90
SHA1..: 5c6e2a2a639329ef8f0f4697acd318a2f87bc4b9
SHA256: 9aae29c41c7907e050a74b3843fde2c37e5033a857572c253e1cd69064acabf6
SHA512: 2726fa31ceb00c1a7936f622e2cc16ba21ea4b1673ee48900ffc2af1f6e9497b
599f52f9b42289ec70b3f0bc3dbe14697c390399bde13271578daf98196d0bb5

ssdeep: 768:GrTJZUVIQixP+TpD+kIGed2ea3X/S1LgX/EX/oozJt:2JWqZwTF+wed2ZPS1
LgP6Jt

PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x406b5c
timedatestamp.....: 0x47d004a4 (Thu Mar 06 14:50:12 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6613 0x6800 7.73 16599cb1b57e4c064f7e73bac8dc1c73
.data 0x8000 0x3451 0xc00 5.56 f9ef77a0fbfea1b76de0fb2415fbc70e
.rsrc 0xc000 0x3c0 0x400 3.29 b79507791004e67dfd4a4f94d589248e

( 4 imports )
> GDI32.dll: SetMapMode, SelectObject, SelectClipRgn, SetROP2, SaveDC, BitBlt, SetTextAlign, SetBkColor, Ellipse, StartDocA, EndDoc, GetStockObject, SetBkMode, CreateFontIndirectA
> KERNEL32.dll: HeapCreate, GetCurrentThreadId, GetCPInfo, GetStringTypeW, GetTimeFormatA, GetConsoleMode, IsValidLocale, VirtualFree, GetProcAddress, GetCurrentThread, SetEnvironmentVariableA, GetFileAttributesA, LocalFree, GetOEMCP, GetNumberFormatA, FormatMessageA, GetVersionExA, GetACP, GetEnvironmentStringsW, GetCurrentDirectoryA, WaitForMultipleObjects, ExitThread
> ADVAPI32.dll: RegOpenKeyExA, GetSidSubAuthority, EqualSid, OpenSCManagerA, AllocateAndInitializeSid, RegOpenKeyA, QueryServiceStatus, LookupPrivilegeValueA, InitializeAcl, IsValidSid, RegCreateKeyExA, OpenProcessToken, LookupAccountNameA, GetSidSubAuthorityCount
> MSVCRT.dll: strtoul, __setusermatherr, _strnicmp, memcmp, _ltow, strcat

( 0 exports )

Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=C8A06D96001D812D7CCF00BADB3110005F49D63F

----------