Anbei die Analyse von der o.g. Datei. Kann leider nicht alles folgerichtig interpretieren; dennoch ergibt sich daraus eine nicht unerhebliche Gefahr. Am besten wäre es die HDD komplett zu löschen und das OS neu aufzuspielen. Oder?
Mit bestem Dank,
H.Hahner
Datei dzxukhfu.exe empfangen 2008.06.30 12:39:03 (CET)
Status: Beendet
Ergebnis: 5/33 (15.15%)
Filter Drucken der Ergebnisse
Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.6.27.1 2008.06.30 -
AntiVir 7.8.0.59 2008.06.30 -
Authentium 5.1.0.4 2008.06.29 -
Avast 4.8.1195.0 2008.06.28 Win32:Roodro
AVG 7.5.0.516 2008.06.29 -
BitDefender 7.2 2008.06.30 -
CAT-QuickHeal 9.50 2008.06.28 Win32.Trojan.Obfuscated.aqn.3
ClamAV 0.93.1 2008.06.30 -
DrWeb 4.44.0.09170 2008.06.30 -
eSafe 7.0.17.0 2008.06.29 -
eTrust-Vet 31.6.5914 2008.06.30 -
Ewido 4.0 2008.06.27 -
F-Prot 4.4.4.56 2008.06.29 -
F-Secure 7.60.13501.0 2008.06.26 -
Fortinet 3.14.0.0 2008.06.30 -
GData 2.0.7306.1023 2008.06.30 Win32:Roodro
Ikarus T3.1.1.26.0 2008.06.30 -
Kaspersky 7.0.0.125 2008.06.30 -
McAfee 5327 2008.06.27 -
Microsoft 1.3704 2008.06.30 Trojan:Win32/Skintrim.B
NOD32v2 3226 2008.06.30 -
Norman 5.80.02 2008.06.27 -
Panda 9.0.0.4 2008.06.29 Suspicious file
Prevx1 V2 2008.06.30 -
Rising 20.51.02.00 2008.06.30 -
Sophos 4.30.0 2008.06.30 -
Sunbelt 3.0.1176.1 2008.06.26 -
Symantec 10 2008.06.30 -
TheHacker 6.2.96.364 2008.06.28 -
TrendMicro 8.700.0.1004 2008.06.30 -
VBA32 3.12.6.8 2008.06.30 -
VirusBuster 4.5.11.0 2008.06.30 -
Webwasher-Gateway 6.6.2 2008.06.30 -
weitere Informationen
File size: 331776 bytes
MD5...: 28c3179afa8a4c826bf1e7479dd26bae
SHA1..: b68672751bf497649d3dd682c54ae70e07d140e9
SHA256: 47564bba5de2a9e242df71d5ade7442f107369a611943008a1937c44a0b162dd
SHA512: d4e643d34c0d45af0eb80ceb0b1b9bedfbec52960997052d42f0cc3eb49151f3
38d3c2a22a30a3dc6ce80271e29417f9cc0819bb3ac3b5da496df274ae09e076
PEiD..: -
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x401057
timedatestamp.....: 0x45beb9c4 (Tue Jan 30 03:21:40 2007)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x495bc 0x4a000 7.78 9c0fcb2b703539b571e3a0cae237d654
.rdata 0x4b000 0x10f2 0x2000 3.56 3e2621b7e4d16cf14ac36f7794da874c
.data 0x4d000 0x3628 0x4000 3.11 c07e49bbddb833d01bdec1a075a4169d
( 11 imports )
> KERNEL32.dll: GlobalFindAtomA, WritePrivateProfileStructA, SetFileTime, GetComputerNameW, GetPrivateProfileSectionW, EnumDateFormatsW, GetFileType, GetAtomNameA, CreateWaitableTimerA, GetSystemInfo, IsProcessorFeaturePresent, lstrcmpiA, GetFullPathNameA, LocalFileTimeToFileTime, SwitchToFiber, VirtualUnlock, SetCommMask, IsDBCSLeadByteEx, lstrcmpA, GetTempPathW, WritePrivateProfileSectionA, IsBadStringPtrA, PrepareTape, MultiByteToWideChar, WriteFile, EnumSystemCodePagesW, FormatMessageW, CancelIo, VirtualQuery, GetVersion, ConnectNamedPipe, _lopen, ReadConsoleOutputA, GlobalAddAtomA, ReleaseSemaphore, VirtualProtect, GetVersionExA, MoveFileExA, ClearCommBreak, OutputDebugStringA, GlobalReAlloc, DuplicateHandle, LocalAlloc, GetSystemDirectoryW, RemoveDirectoryA, CloseHandle, GetModuleFileNameW, EndUpdateResourceA, FormatMessageA, _lread, LoadLibraryExW, SetConsoleMode, GlobalAddAtomW, CompareStringA, FlushConsoleInputBuffer, DeleteCriticalSection, LoadResource, SetThreadPriorityBoost, VirtualAllocEx, RaiseException, GetProfileStringA, GetSystemTimeAdjustment, GetEnvironmentVariableW, EnumCalendarInfoA, SetSystemTime, ReadConsoleInputW, GetCommandLineA, lstrlenA, EnumResourceLanguagesW, ExitProcess
> USER32.dll: MonitorFromWindow, ScrollWindowEx, MsgWaitForMultipleObjectsEx, DestroyCursor, UnregisterHotKey, SetWindowTextW, SetParent
> GDI32.dll: SetMapperFlags, CreatePalette, GetCurrentPositionEx, PolyBezier, GetTextMetricsA, SetViewportExtEx
> comdlg32.dll: GetSaveFileNameW, FindTextA, ChooseColorA
> ADVAPI32.dll: SetKernelObjectSecurity, ReportEventW, RegOpenKeyA, LookupPrivilegeNameA, GetExplicitEntriesFromAclW, RegUnLoadKeyA, AllocateAndInitializeSid, InitiateSystemShutdownW, QueryServiceConfigW, CryptVerifySignatureW, StartServiceCtrlDispatcherW, OpenSCManagerA, MakeSelfRelativeSD, DeleteAce, RegQueryInfoKeyW, StartServiceCtrlDispatcherA, CryptVerifySignatureA, GetSecurityDescriptorControl, CryptExportKey, BuildTrusteeWithNameW, GetSecurityDescriptorSacl, ObjectDeleteAuditAlarmW, LookupAccountSidW
> SHELL32.dll: SHFileOperationA, ExtractIconExW, Shell_NotifyIconA, DragAcceptFiles
> ole32.dll: CoCreateInstanceEx, OleCreateFromData, ProgIDFromCLSID, StgSetTimes, OleConvertIStorageToOLESTREAM, CoLockObjectExternal, CoGetObject
> OLEAUT32.dll: -, -, -, -, -, -, -, -
> COMCTL32.dll: ImageList_DragShowNolock
> SHLWAPI.dll: StrRChrW, PathIsDirectoryA, UrlGetPartA, PathFindNextComponentW, StrTrimW, SHSetValueA, PathFindFileNameW, PathRemoveBackslashA
> SETUPAPI.dll: SetupDiDestroyDeviceInfoList, SetupFindFirstLineW, SetupDiOpenDeviceInfoW, SetupIterateCabinetA, SetupInstallServicesFromInfSectionA, SetupDiGetClassDevsExW, SetupDiDeleteDeviceInfo
GarfTermy
