Trojaner-Board - Your computer remains infected by virus!... security center alert popup

Hallo,
ich habe folgendes Problem und bin nach mehreren Abstürzen mittlerweile der Verzweiflung nah.
Es hat angefangen mit einem Security Center Alert. Ich bin misstrauisch geworden und hab versucht das Problem selber irgendwie in den Griff zu bekommen. Hab das das Microsoft Windows -Tool zum Entfenen bösartiger Software installiert und den CCleaner. War irgendwie nicht meine beste Idee, da mein Rechner hinterher erstmal gar nicht mehr gestartet ist. Hab ich dann aber mit der Windows CD nochmal beheben können. Hat aber leider am Problem nichts geändert.
Ich denke ich muss auf professionelle Hilfe setzen. Hab in mehreren Foren gesucht und mir den Spyware Doctor und AdAware runtergeladen. Der Doctor läuft gerade noch durch. Ich werd euch jetzt mal mein Hijack logfile posten. Vielleicht kann ja wer helfen?

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:14:25, on 09.12.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Intel\WiFi\bin\S24EvMon.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\DWRCS.EXE

C:\Programme\Intel\WiFi\bin\EvtEng.exe

C:\Programme\Intel\Intel Matrix Storage Manager\iaantmon.exe

C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe

C:\Programme\McAfee\Common Framework\FrameworkService.exe

C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe

C:\Programme\McAfee\Common Framework\naPrdMgr.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\mdm.exe

C:\WINDOWS\system32\mfevtps.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe

C:\Programme\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\WINDOWS\system32\SearchIndexer.exe

C:\Programme\McAfee\VirusScan Enterprise\Mcshield.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Programme\McAfee\VirusScan Enterprise\mfeann.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\DWRCST.exe

C:\WINDOWS\msa.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programme\Synaptics\SynTP\SynTPEnh.exe

C:\Addon\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe

C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe

C:\Addon\Fujitsu\Application Panel\QuickTouch.exe

C:\Programme\Fujitsu\BtnHnd\BtnHnd.exe

C:\AddOn\Fujitsu\PSUtility\TrayManager.exe

C:\Program Files\Fujitsu\SSUtility\FJSSDMN.exe

C:\Programme\Intel\Intel Matrix Storage Manager\iaanotif.exe

C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe

C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe

C:\Programme\McAfee\Common Framework\udaterui.exe

C:\Programme\McAfee\VirusScan Enterprise\SHSTAT.EXE

C:\Programme\McAfee\Common Framework\McTray.exe

C:\WINDOWS\system32\Initdsk.exe

C:\Programme\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\MRT.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Dokumente und Einstellungen\TKI\qxcaip.exe

C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe

C:\Programme\TrueCrypt\TrueCrypt.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\msfont.exe

C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe

C:\WINDOWS\System32\alg.exe

C:\Programme\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe

C:\Programme\iPod\bin\iPodService.exe

C:\Programme\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Dokumente und Einstellungen\XXX\BYeRoj.exe

C:\WINDOWS\system32\cmd.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\WINDOWS\*iexplore.exe

C:\DOKUME~1\XXX\LOKALE~1\Temp\d.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Spyware Doctor\pctsAuxs.exe

C:\Programme\Spyware Doctor\pctsSvc.exe

C:\Programme\Spyware Doctor\pctsTray.exe

C:\Programme\Spyware Doctor\pctsGui.exe

C:\Programme\Internet Explorer\iexplore.exe

C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe

C:\Dokumente und Einstellungen\XXX\Eigene Dateien\Ad-Aware_262.exe

C:\DOKUME~1\XXX\LOKALE~1\Temp\mia12.tmp\Ad-AwareAE_Trial.exe

C:\Programme\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programme\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Programme\McAfee\VirusScan Enterprise\scriptsn.dll

O2 - BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programme\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programme\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\Spyware Doctor\BDT\PCTBrowserDefender.dll

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [IndicatorUtility] C:\Addon\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe

O4 - HKLM\..\Run: [LoadFUJ02E3] C:\Programme\Fujitsu\FUJ02E3\FUJ02E3.exe

O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\Addon\Fujitsu\Application Panel\QuickTouch.exe

O4 - HKLM\..\Run: [LoadBtnHnd] C:\Programme\Fujitsu\BtnHnd\BtnHnd.exe

O4 - HKLM\..\Run: [PSUtility] C:\AddOn\Fujitsu\PSUtility\TrayManager.exe

O4 - HKLM\..\Run: [SSUtility] C:\Program Files\Fujitsu\SSUtility\FJSSDMN.exe

O4 - HKLM\..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programme\Intel\WiFi\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [IntelWireless] "C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [Desktop Initialisation] C:\WINDOWS\system32\Initdsk.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Java Quick Start] C:\Dokumente und Einstellungen\XXX\jusched.exe

O4 - HKLM\..\Run: [DameWare MRC Agent] C:\WINDOWS\system32\DWRCST.exe

O4 - HKLM\..\Run: [ISTray] "C:\Programme\Spyware Doctor\pctsTray.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [qxcaip] C:\Dokumente und Einstellungen\TKI\qxcaip.exe

O4 - HKCU\..\Run: [NeoChronos] C:\DOKUME~1\TKI\LOKALE~1\Temp\d.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: TrueCrypt.lnk = C:\Programme\TrueCrypt\TrueCrypt.exe

O4 - Global Startup: Bluetooth Manager.lnk = ?

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1253213511640

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O20 - Winlogon Notify: FJWSEL - C:\WINDOWS\SYSTEM32\FJWSWNP.dll

O20 - Winlogon Notify: PSUTY - C:\WINDOWS\SYSTEM32\PSUWNP.dll

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe

O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\system32\DWRCS.EXE

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Programme\Intel\WiFi\bin\EvtEng.exe

O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Programme\Intel\Intel Matrix Storage Manager\iaantmon.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe

O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Programme\McAfee\VirusScan Enterprise\EngineServer.exe

O23 - Service: McAfee Framework-Dienst (McAfeeFramework) - McAfee, Inc. - C:\Programme\McAfee\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Programme\McAfee\VirusScan Enterprise\Mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Programme\McAfee\VirusScan Enterprise\VsTskMgr.exe

O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Programme\Gemeinsame Dateien\Intel\WirelessCommon\RegSrvc.exe

O23 - Service: Intel(R) PROSet/Wireless WiFi Service (S24EventMonitor) - Intel(R) Corporation - C:\Programme\Intel\WiFi\bin\S24EvMon.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe
 

--

End of file - 12821 bytes

Vielen Dank für Deine schnelle Antwort chris!

Wenn ich das richtig verstanden habe, arbeite ich jetzt nach und nach Deinenpost ab, ja?

Und was mache ich mit dem Spyware Doctor? Hat den Trojan.FakeAlert gefunden.

Hier schon mal der virustotal Report der beiden files:

Code:

Die Datei wurde bereits analysiert: C:\WINDOWS\SYSTEM32\FJWSWNP.dll

MD5: 93f26c2fd47992edac6933127b7e65b1 

First received: 2009.02.16 01:09:27 UTC 

Datum 2009.12.03 11:43:42 UTC [>6D] 

Ergebnisse 0/40 

Permalink: analisis/5b54e22873f2f33eaa99cc48c1c5415bdf9adf11435a3e5c7ef75045908854da-1259840622 
 

Datei FJWSWNP.dll empfangen 2009.12.03 11:43:42 (UTC)

Status: Beendet 
 

Ergebnis: 0/40 (0.00%)

 Filter Drucken der Ergebnisse  Antivirus Version letzte aktualisierung Ergebnis 

a-squared 4.5.0.43 2009.12.03 - 

AhnLab-V3 5.0.0.2 2009.12.03 - 

AntiVir 7.9.1.92 2009.12.03 - 

Antiy-AVL 2.0.3.7 2009.12.03 - 

Authentium 5.2.0.5 2009.12.02 - 

Avast 4.8.1351.0 2009.12.03 - 

AVG 8.5.0.426 2009.12.03 - 

BitDefender 7.2 2009.12.03 - 

CAT-QuickHeal 10.00 2009.12.03 - 

ClamAV 0.94.1 2009.12.03 - 

Comodo 3103 2009.12.01 - 

DrWeb 5.0.0.12182 2009.12.03 - 

eSafe 7.0.17.0 2009.12.02 - 

eTrust-Vet 35.1.7154 2009.12.03 - 

F-Prot 4.5.1.85 2009.12.02 - 

F-Secure 9.0.15370.0 2009.12.03 - 

Fortinet 4.0.14.0 2009.12.03 - 

GData 19 2009.12.03 - 

Ikarus T3.1.1.74.0 2009.12.03 - 

Jiangmin 13.0.900 2009.12.02 - 

K7AntiVirus 7.10.910 2009.12.02 - 

Kaspersky 7.0.0.125 2009.12.03 - 

McAfee 5819 2009.12.01 - 

McAfee+Artemis 5819 2009.12.01 - 

McAfee-GW-Edition 6.8.5 2009.12.03 - 

Microsoft 1.5302 2009.12.03 - 

NOD32 4657 2009.12.03 - 

Norman 6.03.02 2009.12.02 - 

nProtect 2009.1.8.0 2009.12.03 - 

Panda 10.0.2.2 2009.12.03 - 

PCTools 7.0.3.5 2009.12.03 - 

Rising 22.24.03.05 2009.12.03 - 

Sophos 4.48.0 2009.12.03 - 

Sunbelt 3.2.1858.2 2009.12.03 - 

Symantec 1.4.4.12 2009.12.03 - 

TheHacker 6.5.0.2.083 2009.12.01 - 

TrendMicro 9.100.0.1001 2009.12.03 - 

VBA32 3.12.12.0 2009.12.03 - 

ViRobot 2009.12.3.2070 2009.12.03 - 

VirusBuster 5.0.21.0 2009.12.02 - 

weitere Informationen 

File size: 32768 bytes 

MD5   : 93f26c2fd47992edac6933127b7e65b1 

SHA1  : b881f9c5576b2a53c8f365203304de1e6268c60a 

SHA256: 5b54e22873f2f33eaa99cc48c1c5415bdf9adf11435a3e5c7ef75045908854da 

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x35E8

timedatestamp.....: 0x44A37707 (Thu Jun 29 08:45:27 2006)

machinetype.......: 0x14C (Intel I386)
 

( 5 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x2732 0x3000 5.42 30b5574aa26cac15b8bbe3bb3ccb3a47

.rdata 0x4000 0xBCF 0x1000 4.02 a4a539f01c561bec4b6d80ac84b23b0f

.data 0x5000 0x958 0x1000 0.94 f0f5604bbf5101513bce42061eb560a6

.rsrc 0x6000 0x3F8 0x1000 1.04 21d6b122ba6c9c15c70fd3d64ec70f50

.reloc 0x7000 0x610 0x1000 1.77 204ceacd77f611915f15099272b57e08
 

( 0 imports )
 
 

( 0 exports )

 

TrID  : File type identification

Win32 Executable Generic (42.3%)

Win32 Dynamic Link Library (generic) (37.6%)

Generic Win/DOS Executable (9.9%)

DOS Executable Generic (9.9%)

Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) 

ssdeep: 384:sm1YpjNfhuNBrgruAFNly3+ajEbGx66zmlHG1YvkBu:sXHfscNly3+W5/zSsBu 

PEiD  : Armadillo v1.xx - v2.xx 

RDS   : NSRL Reference Data Set

- 
 
 

Die Datei wurde bereits analysiert: PSUWNP.dll

MD5: 0d78ecac13f959817155ab324e8d67e4 

First received: 2008.03.02 14:27:53 UTC 

Datum 2009.12.03 11:43:53 UTC [>6D] 

Ergebnisse 0/41 

Permalink: analisis/ac501072e33919e6c7e1c3b3f5c38674bf333d3f1470f0939a3a6ba0ffba0cd8-1259840633 
 

Datei PSUWNP.dll empfangen 2009.12.03 11:43:53 (UTC)

Status: Beendet 
 

Ergebnis: 0/41 (0.00%)

 Filter Drucken der Ergebnisse  Antivirus Version letzte aktualisierung Ergebnis 

a-squared 4.5.0.43 2009.12.03 - 

AhnLab-V3 5.0.0.2 2009.12.03 - 

AntiVir 7.9.1.92 2009.12.03 - 

Antiy-AVL 2.0.3.7 2009.12.03 - 

Authentium 5.2.0.5 2009.12.02 - 

Avast 4.8.1351.0 2009.12.03 - 

AVG 8.5.0.426 2009.12.03 - 

BitDefender 7.2 2009.12.03 - 

CAT-QuickHeal 10.00 2009.12.03 - 

ClamAV 0.94.1 2009.12.03 - 

Comodo 3103 2009.12.01 - 

DrWeb 5.0.0.12182 2009.12.03 - 

eSafe 7.0.17.0 2009.12.02 - 

eTrust-Vet 35.1.7154 2009.12.03 - 

F-Prot 4.5.1.85 2009.12.02 - 

F-Secure 9.0.15370.0 2009.12.03 - 

Fortinet 4.0.14.0 2009.12.03 - 

GData 19 2009.12.03 - 

Ikarus T3.1.1.74.0 2009.12.03 - 

Jiangmin 13.0.900 2009.12.02 - 

K7AntiVirus 7.10.910 2009.12.02 - 

Kaspersky 7.0.0.125 2009.12.03 - 

McAfee 5819 2009.12.01 - 

McAfee+Artemis 5819 2009.12.01 - 

McAfee-GW-Edition 6.8.5 2009.12.03 - 

Microsoft 1.5302 2009.12.03 - 

NOD32 4657 2009.12.03 - 

Norman 6.03.02 2009.12.02 - 

nProtect 2009.1.8.0 2009.12.03 - 

Panda 10.0.2.2 2009.12.03 - 

PCTools 7.0.3.5 2009.12.03 - 

Prevx 3.0 2009.12.03 - 

Rising 22.24.03.05 2009.12.03 - 

Sophos 4.48.0 2009.12.03 - 

Sunbelt 3.2.1858.2 2009.12.03 - 

Symantec 1.4.4.12 2009.12.03 - 

TheHacker 6.5.0.2.083 2009.12.01 - 

TrendMicro 9.100.0.1001 2009.12.03 - 

VBA32 3.12.12.0 2009.12.03 - 

ViRobot 2009.12.3.2070 2009.12.03 - 

VirusBuster 5.0.21.0 2009.12.02 - 

weitere Informationen 

File size: 32768 bytes 

MD5   : 0d78ecac13f959817155ab324e8d67e4 

SHA1  : 61ebbd94f32a6ea8e2933bb0ede440facdf49f12 

SHA256: ac501072e33919e6c7e1c3b3f5c38674bf333d3f1470f0939a3a6ba0ffba0cd8 

PEInfo: PE Structure information
 

( base data )

entrypointaddress.: 0x3748

timedatestamp.....: 0x447FF121 (Fri Jun 2 10:04:49 2006)

machinetype.......: 0x14C (Intel I386)
 

( 5 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x28B2 0x3000 5.52 1d72393461a5c29b649aacf6194c2028

.rdata 0x4000 0xBFE 0x1000 4.08 fb29ec56454507c01c7ccd37dcb58baa

.data 0x5000 0xB30 0x1000 1.39 e44cb967d0cc6ff83f8488b179fdf88c

.rsrc 0x6000 0x3F8 0x1000 1.06 9f50036f12e10440fe045d3656690f5f

.reloc 0x7000 0x646 0x1000 1.91 ea9bc5c6e2329f52eed9097a2530f31c
 

( 6 imports )
 

> advapi32.dll: RegSetValueExW, RegFlushKey, RegCloseKey, RegCreateKeyExW, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, AddAccessAllowedAce, InitializeAcl, GetSidSubAuthority, InitializeSid, GetSidLengthRequired

> gdi32.dll: GetStockObject

> kernel32.dll: CreateMutexW, UnmapViewOfFile, MapViewOfFile, OpenFileMappingW, SetEvent, lstrcpyW, CreateEventW, CreateFileMappingW, LocalAlloc, DisableThreadLibraryCalls, Sleep, lstrcpynW, lstrcmpiW, LocalFree, lstrlenW, WaitForSingleObject, ReleaseMutex, GetLastError, CloseHandle, SetLastError, InterlockedDecrement, lstrlenA, ResetEvent

> msvcrt.dll: wcslen, _adjust_fdiv, malloc, _initterm, free, _onexit, __dllonexit, __1type_info@@UAE@XZ, _beginthread, iswdigit, wcsncmp, swprintf, vswprintf, _CxxThrowException, _wtoi, __3@YAXPAX@Z, __CxxFrameHandler, __2@YAPAXI@Z

> setupapi.dll: CM_Request_Device_EjectW, CM_Query_And_Remove_SubTreeW, SetupDiGetDeviceRegistryPropertyW, SetupDiGetClassDevsW, SetupDiClassGuidsFromNameExW, SetupDiSetClassInstallParamsW, SetupDiGetClassDevsExW, SetupDiGetDeviceInfoListDetailW, SetupDiEnumDeviceInfo, CM_Get_DevNode_Status, SetupDiCallClassInstaller, SetupDiGetDeviceInstallParamsW, SetupDiDestroyDeviceInfoList

> user32.dll: RegisterWindowMessageW, wsprintfW, DefWindowProcW, CreateWindowExW, RegisterClassW, LoadCursorW, GetSystemMetrics
 

( 1 exports )
 

> Lock, Logoff, Logon, Shutdown, StartShell, Startup, Unlock 

TrID  : File type identification

42.3% (.EXE) Win32 Executable Generic (8527/13/3)

37.6% (.DLL) Win32 Dynamic Link Library (generic) (7583/30/2)

9.9% (.EXE) Generic Win/DOS Executable (2002/3)

9.9% (.EXE) DOS Executable Generic (2000/1)

0.0% (.CEL) Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 

ssdeep: 384:Xt1Rcpef29veh5Ml9DqFrgrPQPNYKO8bux66zmleHvnU+bKxiEvBK3:XFcDxeXMlIVNYKg/zSvxiE 

PEiD  : Armadillo v1.xx - v2.xx 

CWSandbox: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=0d78ecac13f959817155ab324e8d67e4 

RDS   : NSRL Reference Data Set

-