| psychoaki | 02.12.2008 11:52 |
ok, ich habe es dann nun doch auf virustotal checken lassen. hier kommt der report Code:
File hadl.dll received on 12.02.2008 10:17:30 (CET)
Current status: finished
Result: 22/37 (59.46%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.12.2.0 2008.12.02 Win-AppCare/Hiderun.356352
AntiVir 7.9.0.36 2008.12.02 RKIT/DVD.Settec.DLL
Authentium 5.1.0.4 2008.12.02 -
Avast 4.8.1281.0 2008.12.01 Win32:Trojan-gen {Other}
AVG 8.0.0.199 2008.12.02 BackDoor.Generic7.NJR
BitDefender 7.2 2008.12.02 Spyware.Dvd.Settec.DLL
CAT-QuickHeal 10.00 2008.12.02 -
ClamAV 0.94.1 2008.12.02 -
DrWeb 4.44.0.09170 2008.12.02 -
eSafe 7.0.17.0 2008.11.30 -
eTrust-Vet 31.6.6238 2008.12.02 -
Ewido 4.0 2008.12.01 Rootkit.Settec
F-Prot 4.4.4.56 2008.12.01 -
F-Secure 8.0.14332.0 2008.12.02 Rootkit:W32/Settec.A
Fortinet 3.117.0.0 2008.12.02 Misc/Settec
GData 19 2008.12.02 Spyware.Dvd.Settec.DLL
Ikarus T3.1.1.45.0 2008.12.02 Virus.Win32.Trojan
K7AntiVirus 7.10.539 2008.12.01 Trojan.Win32.Malware.1
Kaspersky 7.0.0.125 2008.12.02 -
McAfee 5451 2008.12.01 potentially unwanted program Settec
McAfee+Artemis 5451 2008.12.01 potentially unwanted program Settec
Microsoft 1.4104 2008.12.02 Program:Win32/Settec
NOD32 3656 2008.12.02 Win32/Rootkit.Settec
Norman 5.80.02 2008.12.01 -
Panda 9.0.0.4 2008.12.02 Application/Settec.A
PCTools 4.4.2.0 2008.12.01 Rootkit.Inject.B
Prevx1 V2 2008.12.02 -
Rising 21.06.10.00 2008.12.02 -
SecureWeb-Gateway 6.7.6 2008.12.02 Rootkit.DVD.Settec.DLL
Sophos 4.36.0 2008.12.02 -
Sunbelt 3.1.1832.2 2008.12.01 Settec
Symantec 10 2008.12.02 SecurityRisk.Settec
TheHacker 6.3.1.2.171 2008.12.02 -
TrendMicro 8.700.0.1004 2008.12.02 -
VBA32 3.12.8.9 2008.12.01 Win32.Rootkit.Settec
ViRobot 2008.12.2.1496 2008.12.02 -
VirusBuster 4.5.11.0 2008.12.01 Rootkit.Inject.B
Additional information
File size: 356352 bytes
MD5...: 9b845d8fc0b7e9f7ac5659ca6ba7e079
SHA1..: 936c0547ca085dec303fdd6320b4636fe52557a2
SHA256: 8e192642411275fb957b4f3017b993dfbbf74e5f7447eb3688860e9894d179f7
SHA512: b7b032ff416ed148a3bd8dd01eb283543d7fd8e1b4ec7a0bd7f0ed348abc967d
78c2c14e20d8c2918b652d36f098366ce59f5a97d3931101e91ebabb16c66456
ssdeep: 1536:eDDZeRuB2pxtTtv1M/BnfbbT8wQ9JGOoQWdSb9ma:eDDw9onTbT9Q9JGOoQ
WdS5r
PEiD..: Armadillo v1.xx - v2.xx
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x10004a59
timedatestamp.....: 0x43658975 (Mon Oct 31 03:03:17 2005)
machinetype.......: 0x14c (I386)
( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xa6fa 0xb000 6.43 e06bee78e7cef23c60df5b1c73f661ef
.rdata 0xc000 0x21b7 0x3000 3.97 1dff1b67443746a9faaa1e44aa4ae1e0
.data 0xf000 0x564c 0x4000 2.56 d20c3cb91c0cdafeaf8fa62ca5728236
Shared 0x15000 0x40980 0x41000 0.00 db2e0a12d13d552ee33e601e5dd2c54a
.rsrc 0x56000 0x328 0x1000 0.83 3b5ea0ac2780bca99ad3ab6e2b2eda0f
.reloc 0x57000 0x1918 0x2000 3.88 fe2f9ed1328576b1098ee44c20f8591f
( 3 imports )
> KERNEL32.dll: FreeLibrary, GetProcAddress, LoadLibraryA, GetCurrentProcess, VirtualProtect, FlushInstructionCache, SetLastError, GetStdHandle, GetVersionExA, CloseHandle, Module32First, CreateToolhelp32Snapshot, Process32Next, Process32First, GetUserDefaultLangID, SetEvent, Sleep, CreateThread, GetCurrentProcessId, WideCharToMultiByte, TerminateThread, GetModuleHandleA, GetSystemDirectoryA, ResetEvent, WaitForSingleObject, GetLastError, DeviceIoControl, CreateEventA, CreateFileA, GetModuleFileNameA, DisableThreadLibraryCalls, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, MultiByteToWideChar, RtlUnwind, GetCommandLineA, GetVersion, HeapFree, HeapAlloc, GetCurrentThreadId, TlsSetValue, TlsAlloc, TlsFree, TlsGetValue, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, ReadFile, SetFilePointer, ExitProcess, TerminateProcess, SetHandleCount, GetFileType, GetStartupInfoA, DeleteCriticalSection, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, WriteFile, VirtualAlloc, HeapReAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadCodePtr, SetStdHandle, FlushFileBuffers, InterlockedDecrement, InterlockedIncrement, GetCPInfo, GetACP, GetOEMCP, SetEndOfFile
> USER32.dll: wsprintfA, FindWindowA, SendMessageA, UnhookWindowsHookEx, SetWindowsHookExA, CallNextHookEx
> VERSION.dll: GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
( 5 exports )
__InjectDllAll, __RemoveDllAll, __SetProtectedProcess, __StartProtect, __StopProtect
CWSandbox info: hxxp://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=9b845d8fc0b7e9f7ac5659ca6ba7e079
Und die mstoc.exe, die aber von virustotal einen neuen namen erhielt Code:
File efsysadu.exe received on 12.02.2008 10:47:51 (CET)
Current status: finished
Result: 23/37 (62.16%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
AhnLab-V3 2008.12.2.0 2008.12.02 Win-AppCare/Hiderun.827392
AntiVir 7.9.0.36 2008.12.02 RKIT/DVD.Settec.1
Authentium 5.1.0.4 2008.12.02 -
Avast 4.8.1281.0 2008.12.01 Win32:Trojan-gen {Other}
AVG 8.0.0.199 2008.12.02 BackDoor.Generic7.MRM
BitDefender 7.2 2008.12.02 Spyware.Dvd.Settec.DLL
CAT-QuickHeal 10.00 2008.12.02 -
ClamAV 0.94.1 2008.12.02 Trojan.Rootkit.Settec
DrWeb 4.44.0.09170 2008.12.02 Trojan.Inject.239
eSafe 7.0.17.0 2008.11.30 -
eTrust-Vet 31.6.6238 2008.12.02 -
Ewido 4.0 2008.12.01 Rootkit.Settec
F-Prot 4.4.4.56 2008.12.01 -
F-Secure 8.0.14332.0 2008.12.02 Rootkit:W32/Settec.A
Fortinet 3.117.0.0 2008.12.02 Misc/Settec
GData 19 2008.12.02 Spyware.Dvd.Settec.DLL
Ikarus T3.1.1.45.0 2008.12.02 Virus.Win32.Trojan
K7AntiVirus 7.10.539 2008.12.01 -
Kaspersky 7.0.0.125 2008.12.02 -
McAfee 5451 2008.12.01 potentially unwanted program Settec
McAfee+Artemis 5451 2008.12.01 potentially unwanted program Settec
Microsoft 1.4104 2008.12.02 Program:Win32/Settec
NOD32 3656 2008.12.02 Win32/Rootkit.Settec
Norman 5.80.02 2008.12.01 -
Panda 9.0.0.4 2008.12.02 Application/Settec.A
PCTools 4.4.2.0 2008.12.01 Rootkit.Inject.A
Prevx1 V2 2008.12.02 -
Rising 21.06.12.00 2008.12.02 -
SecureWeb-Gateway 6.7.6 2008.12.02 Rootkit.DVD.Settec.DLL
Sophos 4.36.0 2008.12.02 -
Sunbelt 3.1.1832.2 2008.12.01 Settec
Symantec 10 2008.12.02 SecurityRisk.Settec
TheHacker 6.3.1.2.171 2008.12.02 -
TrendMicro 8.700.0.1004 2008.12.02 -
VBA32 3.12.8.9 2008.12.01 Win32.Rootkit.Settec
ViRobot 2008.12.2.1496 2008.12.02 -
VirusBuster 4.5.11.0 2008.12.01 Rootkit.Inject.A
Additional information
File size: 827392 bytes
MD5...: 4e7797f813c10cb172b3f219638c8114
SHA1..: 4b7e5d37875d48d1cf5a82ad1ba77fd93e8bc971
SHA256: 96668bab6c3a7ef994650782011f7234b9ba17238c9e5b105405a1de9bcfe663
SHA512: d1dc0e8c7aae003d5f9c470d889c45278fd50c8a66cb08937db15f78f1654404
03ce20e886e71957680ac75b1f28f1bc6f8706aa9e4988b3970645d14ed08e65
ssdeep: 3072:DK1YsgB+lXj+M+jr5dXWdBqJHoZl8ZhX7/YZpZDDw9onTbT9Q9JGOoQWdS5
rHqfN:DK1YF+lXSfvtZhX7loPT9QrH
PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (54.6%)
Win32 Executable MS Visual C++ (generic) (24.0%)
Windows Screen Saver (8.3%)
Win32 Executable Generic (5.4%)
Win32 Dynamic Link Library (generic) (4.8%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x405b83
timedatestamp.....: 0x4365899b (Mon Oct 31 03:03:55 2005)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x18e52 0x19000 6.59 03220af00ecce1224eb0d4aaf49c6014
.rdata 0x1a000 0x52e0 0x6000 4.32 c5c5b4f0fe0df661b02d64496055b4c4
.data 0x20000 0x7adc 0x4000 2.56 4af1be3d81d9080ad4f5d9a792a5e25e
.rsrc 0x28000 0xa59f0 0xa6000 1.48 5bee4178837d16cd92dfbe71b3032c35
( 9 imports )
> VERSION.dll: GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
> WINMM.dll: mciSendCommandA
> KERNEL32.dll: GetFullPathNameA, LocalAlloc, InitializeCriticalSection, TlsAlloc, DeleteCriticalSection, GlobalHandle, TlsFree, LeaveCriticalSection, GlobalReAlloc, EnterCriticalSection, TlsSetValue, LocalReAlloc, TlsGetValue, GlobalFlags, WritePrivateProfileStringA, GetProcessVersion, SetErrorMode, FileTimeToSystemTime, FileTimeToLocalFileTime, GetCPInfo, GetOEMCP, RtlUnwind, GetStartupInfoA, GetCommandLineA, ExitProcess, TerminateProcess, HeapFree, HeapAlloc, RaiseException, HeapReAlloc, HeapSize, GetACP, GetVolumeInformationA, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetEnvironmentVariableA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, SetUnhandledExceptionFilter, IsBadReadPtr, IsBadCodePtr, SetStdHandle, CompareStringA, CompareStringW, SetEnvironmentVariableA, MoveFileA, CloseHandle, ReleaseMutex, GetLastError, SetEndOfFile, UnlockFile, LockFile, FlushFileBuffers, SetFilePointer, ReadFile, DuplicateHandle, MulDiv, SetLastError, GetVersion, lstrcatA, GlobalGetAtomNameA, GlobalAddAtomA, GlobalFindAtomA, lstrcpyA, FindFirstFileA, FindClose, lstrcpynA, GetFileTime, GetFileSize, GetFileAttributesA, LocalFree, lstrlenA, InterlockedDecrement, InterlockedIncrement, GlobalUnlock, GlobalFree, CreateMutexA, GlobalLock, GlobalAlloc, GlobalDeleteAtom, GetProcAddress, lstrcmpA, lstrcmpiA, GetCurrentThread, GetCurrentThreadId, CreateEventA, WaitForSingleObject, GetLogicalDrives, WideCharToMultiByte, MultiByteToWideChar, GetComputerNameA, FreeLibrary, GetCurrentProcess, SystemTimeToFileTime, SetFileTime, CreateProcessA, FindResourceA, LoadResource, LockResource, SizeofResource, WriteFile, LoadLibraryA, SetFileAttributesA, DeleteFileA, GetSystemTime, GetVersionExA, GetWindowsDirectoryA, GetModuleFileNameA, GetTempPathA, GetCurrentProcessId, GetDriveTypeA, CreateFileA, DeviceIoControl, GetModuleHandleA, GetTimeZoneInformation
> USER32.dll: GetCapture, GetTopWindow, CopyRect, AdjustWindowRectEx, SetFocus, GetSysColor, MapWindowPoints, SendDlgItemMessageA, UpdateWindow, IsDialogMessageA, SetWindowTextA, ShowWindow, ClientToScreen, GetDC, ReleaseDC, BeginPaint, EndPaint, TabbedTextOutA, DrawTextA, GrayStringA, CharUpperA, LoadCursorA, GetClassNameA, PtInRect, GetSysColorBrush, LoadStringA, DestroyMenu, WinHelpA, GetSubMenu, GetMenuItemID, GetWindowTextA, GetDlgCtrlID, CreateWindowExA, GetClassLongA, SetPropA, UnhookWindowsHookEx, GetPropA, CallWindowProcA, RemovePropA, DefWindowProcA, GetMessageTime, GetMessagePos, GetForegroundWindow, SetForegroundWindow, GetWindow, SetWindowLongA, SetWindowPos, RegisterWindowMessageA, SystemParametersInfoA, GetWindowPlacement, GetWindowRect, EndDialog, UnregisterClassA, IsWindow, DestroyWindow, GetDlgItem, GetMenuCheckMarkDimensions, GetMenuState, ModifyMenuA, SetMenuItemBitmaps, CheckMenuItem, EnableMenuItem, GetFocus, GetNextDlgTabItem, GetMessageA, TranslateMessage, DispatchMessageA, GetActiveWindow, GetKeyState, CallNextHookEx, ValidateRect, IsWindowVisible, PeekMessageA, GetCursorPos, SetWindowsHookExA, GetParent, GetLastActivePopup, IsWindowEnabled, GetWindowLongA, MessageBoxA, SetCursor, PostMessageA, FindWindowA, EnableWindow, KillTimer, SetTimer, IsIconic, GetSystemMetrics, GetClientRect, wsprintfA, GetClassInfoA, DrawIcon, SendMessageA, PostQuitMessage, RegisterClassA, GetMenuItemCount, GetMenu, LoadIconA, CreateDialogIndirectParamA, LoadBitmapA, SetActiveWindow
> GDI32.dll: GetClipBox, SetTextColor, SetBkColor, GetObjectA, DeleteDC, SaveDC, RestoreDC, SelectObject, GetStockObject, SetMapMode, SetViewportOrgEx, OffsetViewportOrgEx, SetViewportExtEx, ScaleViewportExtEx, SetWindowExtEx, ScaleWindowExtEx, DeleteObject, GetDeviceCaps, PtVisible, RectVisible, TextOutA, ExtTextOutA, Escape, CreateBitmap
> comdlg32.dll: GetFileTitleA
> WINSPOOL.DRV: OpenPrinterA, ClosePrinter, DocumentPropertiesA
> ADVAPI32.dll: RegCreateKeyExA, RegCloseKey, RegCreateKeyA, RegSetValueExA, RegOpenKeyExA
> COMCTL32.dll: -
( 0 exports )
ThreatExpert info: hxxp://www.threatexpert.com/report.aspx?md5=4e7797f813c10cb172b3f219638c8114
CWSandbox info: hxxp://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=4e7797f813c10cb172b3f219638c8114
Bin wirklich alles andere als ein Experte, aber es sieht nicht gut aus, oder? |
