Internetverbindung steht - kein Browser läuft!

shakuru

Hallo Sunny!

Danke erstmal für die schnelle Hilfe.
Virus Total hat mir folgenden Bericht erstellt...

STATUS: FINISHEDComplete scanning result of "virus.exe", received in VirusTotal at 01.01.2007, 17:11:15 (CET).

Antivirus Version Update Result
AntiVir 7.3.0.21 12.31.2006 no virus found
Authentium 4.93.8 12.30.2006 no virus found
Avast 4.7.892.0 12.30.2006 no virus found
AVG 386 01.01.2007 no virus found
BitDefender 7.2 01.01.2007 BehavesLike:Win32.AV-Killer
CAT-QuickHeal 8.00 01.01.2007 no virus found
ClamAV devel-20060426 01.01.2007 no virus found
DrWeb 4.33 12.31.2006 no virus found
eSafe 7.0.14.0 01.01.2007 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.102 12.30.2006 no virus found
eTrust-Vet 30.3.3289 12.29.2006 no virus found
Ewido 4.0 01.01.2007 no virus found
Fortinet 2.82.0.0 01.01.2007 suspicious
F-Prot 3.16f 12.30.2006 no virus found
F-Prot4 4.2.1.29 12.30.2006 no virus found
Ikarus T3.1.0.27 01.01.2007 no virus found
Kaspersky 4.0.2.24 01.01.2007 no virus found
McAfee 4929 12.29.2006 no virus found
Microsoft 1.1904 12.31.2006 no virus found
NOD32v2 1950 01.01.2007 probably a variant of Win32/Agent.NFM
Norman 5.80.02 12.31.2007 W32/Malware
Panda 9.0.0.4 01.01.2007 Suspicious file
Prevx1 V2 01.01.2007 no virus found
Sophos 4.13.0 12.30.2006 no virus found
Sunbelt 2.2.907.0 12.18.2006 no virus found
TheHacker 6.0.3.141 01.01.2007 no virus found
VBA32 3.11.1 01.01.2007 no virus found
VirusBuster 4.3.19:9 01.01.2007 no virus found


Aditional Information
File size: 59392 bytes
MD5: d491fad09392409f1f1735dcb6d8d306
SHA1: fe82422a8f93d5ddd0a74937158a5988d64e9300
packers: UPX
packers: UPX
packers: UPX
norman sandbox: [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* Decompressing UPX.
* File length: 59392 bytes.

[ Changes to filesystem ]
* Creates file C:WINDOWSCOMMANDexplorer.exe.
* Deletes file C: oexistfile.txt.

[ Changes to registry ]
* Creates key "HKLMSoftwareMicrosoftDirectSydr".
* Sets value "dajo"="o_qtj}n_" in key "HKLMSoftwareMicrosoftDirectSydr".
* Creates key "HKLMSystemCurrentControlSetServicesDirectSydr".
* Sets value "ImagePath"="c:sample.exe" in key "HKLMSystemCurrentControlSetServicesDirectSydr".
* Sets value "DisplayName"="DirectX Service" in key "HKLMSystemCurrentControlSetServicesDirectSydr".
* Sets value "secig"="[___{_~____u___________________" in key "HKLMSoftwareMicrosoftDirectSydr".

[ Security issues ]
* Possible backdoor functionality [UNKNOWN] port 3566.

[ Process/window information ]
* Creates a mutex secig.
* Attempts to access service "DirectSydr".
* Creates service "DirectSydr (DirectX Service)" as "c:sample.exe".
* Attemps to open netsh.exe firewall set allowedprogram program = "C:WINDOWSCOMMANDexplorer.exe" name = "Explorer" mode = ENABLE scope = ALL profile = ALL.
* Attemps to open C:WINDOWSCOMMANDexplorer.exe C: oexistfile.txt.


shakuru