| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Drivecleaner/pop ups ohne endeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.06.2007, 16:57
| #1 |
 |  Drivecleaner/pop ups ohne ende Guten tag, Seit geraumer Zeit habe ich das Problem, dass sich Opera innerhalb von 5-10 Minuten Abständen selbst zerschießt! Undzwar kam dies immer, nachdem ich mit einen Pop up mit dem besagten Programm Drivecleaner nicht richtig umgegangen bin. Der Internet Explorer zwingt mich in regelmäßigen Abständen, seiten von diversen Sicherheitsfirmen zu besuchen, unter anderem auch wieder Drivecleaner. Da ich mich hier bereits im Forum ein wenig schlau gemacht hatte und den Versuch mit Smidtfraufix gestartet hatte, dies aber kaum Linderung brachte (alles wieder beim alten, Opera ist immer noch ständig beschädigt) möchte ich geren direkte Hilfe in Anspruch nehmen. Ich würde mich sehr freuen, wenn mir gehollfen werden würde.... Hier das Hijacklogfile: Logfile of HijackThis v1.99.1 Scan saved at 17:45:45, on 25.06.2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ynjraveh.exe C:\WINDOWS\System32\GEARSec.exe C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe C:\Programme\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Programme\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe C:\Programme\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\slserv.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\WINDOWS\system32\svchost.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\sm56hlpr.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe C:\Programme\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\avp.exe C:\WINDOWS\mgrs.exe C:\Programme\Java\jre1.6.0_01\bin\jusched.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\Messenger\msmsgs.exe C:\PROGRAMME\T-ONLINE\WLAN-ACCESS FINDER\TOWLAACF.EXE C:\Programme\ICQ6\ICQ.exe C:\Programme\Gemeinsame Dateien\Marmiko Shared\MWLaMaS.exe C:\WINDOWS\system32\wuauclt.exe C:\DOKUME~1\xantippe\LOKALE~1\Temp\hostlook.exe C:\WINDOWS\avp.exe C:\WINDOWS\avp.exe C:\DOKUME~1\xantippe\LOKALE~1\Temp\16agent.exe C:\WINDOWS\avp.exe C:\DOKUME~1\xantippe\LOKALE~1\Temp\monwin.exe C:\Programme\WinRAR\WinRAR.exe C:\Programme\Internet Explorer\iexplore.exe C:\DOKUME~1\***\LOKALE~1\Temp\Rar$EX06.469\HijackThis.exe R3 - URLSearchHook: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O3 - Toolbar: (no name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programme\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [Verknüpfung mit der High Definition Audio-Eigenschaftenseite] HDAShCut.exe O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe O4 - HKLM\..\Run: [ccApp] "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb05.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [HPHUPD08] C:\Programme\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe O4 - HKLM\..\Run: [HP Software Update] C:\Programme\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe O4 - HKLM\..\Run: [smgr] mgrs.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.6.0_01\bin\jusched.exe O4 - HKLM\..\Run: [Windows Framework] C:\DOKUME~1\xantippe\LOKALE~1\Temp\frmwrk.exe O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\vmsdmnde.dll",realset O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Norton SystemWorks] "C:\Programme\Norton SystemWorks\cfgwiz.exe" /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O4 - HKCU\..\Run: [MSMSGS] "C:\Programme\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [T-Online_Software_6\WLAN-Access Finder] C:\PROGRAMME\T-ONLINE\WLAN-ACCESS FINDER\TOWLAACF.EXE /StartMinimized O4 - HKCU\..\Run: [Yahoo! Pager] C:\Programme\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6\ICQ.exe" silent O4 - HKCU\..\Run: [Performance Center] C:\Programme\Ascentive\Performance Center\ApcMain.exe -m O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Programme\ICQToolbar\toolbaru.dll/SEARCH.HTML O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Mobilen Favoriten erstellen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programme\Microsoft ActiveSync\inetrepl.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe (file missing) O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6\ICQ.exe O9 - Extra button: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: @C:\Programme\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O18 - Protocol: haufereader - (no CLSID) - (no file) O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe O23 - Service: DomainService - - C:\WINDOWS\system32\ynjraveh.exe O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe O23 - Service: Haufe iDesk-Service in C:\Programme\Haufe\iDesk\iDeskService\Zope (HRService) - Unknown owner - C:\Programme\Haufe\iDesk\iDeskService\iDeskService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: T-Online WLAN Adapter Steuerungsdienst (MZCCntrl) - Deutsche Telekom AG, Marmiko IT-Solutions GmbH - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe O23 - Service: Norton AntiVirus Auto-Protect-Dienst (navapsvc) - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Ghost - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton Ghost\Agent\PQV2iSvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Programme\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\GEMEIN~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programme\Gemeinsame Dateien\Symantec Shared\CCPD-LC\symlcsvc.exe |
|
25.06.2007, 18:22
| #2 |
| | Drivecleaner/pop ups ohne ende C:\WINDOWS\system32\ynjraveh.exe
__________________C:\WINDOWS\avp.exe C:\WINDOWS\system32\vmsdmnde.dll C:\DOKUME~1\xantippe\LOKALE~1\Temp\frmwrk.exe C:\DOKUME~1\xantippe\LOKALE~1\Temp\hostlook.exe C:\WINDOWS\mgrs.exe Bitte die obigen rausgeschrieben Pfade bei www.virustotal.com oben rechts in der Ecke in das weiße Feld (nacheinander) einfügen (Copy&Paste) und den "Send" Button betätigen. Auswertungen abwarten und den vollständigen Log abkopieren (pro datei), mit Kopf bitte. der Kopf ist der Teil, wo der dateiname aufgeführt ist. Das ganze bitte in einen Post, du kann das ja in einer Textdatei zwischenspeichern. Du hast mindestens 2 schädliche Dateien auf dem Rechner, überprüfe das bitte alles. |
|
26.06.2007, 19:34
| #3 |
| | Drivecleaner/pop ups ohne ende so, hier die Ergebnisse von Virustotal, hat ewig gedauert, frmwrk ist leider nicht komplett, es fehlen aber nur zwei Untersuchungen:
__________________Complete scanning result of "ynjraveh.exe", received in VirusTotal at 06.26.2007, 16:00:04 (CET). Antivirus Version Update Result AhnLab-V3 2007.6.21.1 06.26.2007 Win-Trojan/Xema.variant AntiVir 7.4.0.34 06.26.2007 TR/Agent.aoy.1 Authentium 4.93.8 06.25.2007 no virus found Avast 4.7.997.0 06.26.2007 no virus found AVG 7.5.0.476 06.26.2007 Generic5.CF BitDefender 7.2 06.26.2007 Trojan.Fotomoto.A CAT-QuickHeal 9.00 06.26.2007 Trojan.Agent.aoy ClamAV devel-20070416 06.26.2007 Trojan.Agent-4880 DrWeb 4.33 06.26.2007 Trojan.EzulaAd eSafe 7.0.15.0 06.26.2007 no virus found eTrust-Vet 30.8.3743 06.26.2007 Win32/Abetear.A Ewido 4.0 06.26.2007 Trojan.Agent.aoy FileAdvisor 1 06.26.2007 no virus found Fortinet 2.91.0.0 06.26.2007 no virus found F-Prot 4.3.2.48 06.25.2007 no virus found F-Secure 6.70.13030.0 06.26.2007 Trojan.Win32.Agent.aoy Ikarus T3.1.1.8 06.26.2007 Trojan.Win32.Agent.aoy Kaspersky 4.0.2.24 06.26.2007 Trojan.Win32.Agent.aoy McAfee 5060 06.25.2007 no virus found Microsoft 1.2701 06.26.2007 Trojan:Win32/Fotomoto.gen!A NOD32v2 2355 06.26.2007 no virus found Norman 5.80.02 06.26.2007 W32/Agent.BSOF Panda 9.0.0.4 06.26.2007 Trj/Downloader.OZB Sophos 4.19.0 06.24.2007 no virus found Sunbelt 2.2.907.0 06.26.2007 no virus found Symantec 10 06.26.2007 Trojan.Vundo TheHacker 6.1.6.137 06.26.2007 Trojan/Agent.aoy VBA32 3.12.0.2 06.25.2007 Trojan.Win32.Agent.aoy VirusBuster 4.3.23:9 06.26.2007 no virus found Webwasher-Gateway 6.0.1 06.26.2007 Trojan.Agent.aoy.1 Aditional Information File size: 122944 bytes MD5: e2ac8251713e095409a53f99122702ed SHA1: 4fa2d00fdeaf2026df4bbd19a4ab4c97978c2731 _______________________________________________ Complete scanning result of "avp.exe", received in VirusTotal at 06.26.2007, 17:42:20 (CET). Antivirus Version Update Result AhnLab-V3 2007.6.27.0 06.26.2007 no virus found AntiVir 7.4.0.34 06.26.2007 TR/Dldr.Alphabet.B.79 Authentium 4.93.8 06.25.2007 no virus found Avast 4.7.997.0 06.26.2007 no virus found AVG 7.5.0.476 06.26.2007 Downloader.Generic4.YQY BitDefender 7.2 06.26.2007 Trojan.Downloader.Alphabet.G CAT-QuickHeal 9.00 06.26.2007 (Suspicious) - DNAScan ClamAV devel-20070416 06.26.2007 no virus found DrWeb 4.33 06.26.2007 Trojan.DownLoader.24178 eSafe 7.0.15.0 06.26.2007 Win32.Alphabet.b eTrust-Vet 30.8.3743 06.26.2007 no virus found Ewido 4.0 06.26.2007 Downloader.Alphabet.b FileAdvisor 1 06.26.2007 no virus found Fortinet 2.91.0.0 06.26.2007 W32/Alphabet.B!tr.dldr F-Prot 4.3.2.48 06.25.2007 no virus found F-Secure 6.70.13030.0 06.26.2007 Trojan-Downloader.Win32.Alphabet.b Ikarus T3.1.1.8 06.26.2007 BehavesLikeWin32.AV-Killer Kaspersky 4.0.2.24 06.26.2007 Trojan-Downloader.Win32.Alphabet.b McAfee 5061 06.26.2007 no virus found Microsoft 1.2701 06.26.2007 no virus found NOD32v2 2355 06.26.2007 a variant of Win32/TrojanDownloader.Alphabet Norman 5.80.02 06.26.2007 W32/DLoader.CXTE Panda 9.0.0.4 06.26.2007 Adware/DriveCleaner Sophos 4.19.0 06.24.2007 no virus found Sunbelt 2.2.907.0 06.26.2007 VIPRE.Suspicious Symantec 10 06.26.2007 Downloader TheHacker 6.1.6.137 06.26.2007 no virus found VBA32 3.12.0.2 06.25.2007 Trojan.DownLoader.24178 VirusBuster 4.3.23:9 06.26.2007 no virus found Webwasher-Gateway 6.0.1 06.26.2007 Trojan.Dldr.Alphabet.B.79 Aditional Information File size: 19456 bytes MD5: 41e41c2cb87b98b80d504ba32cfc6485 SHA1: 37100785f6731d6acd4227dbe840cb54993840a7 packers: PECOMPACT packers: embedded, PecBundle, PECompact Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics. ________________________________________________________ Complete scanning result of "vmsdmnde.dll", received in VirusTotal at 06.26.2007, 18:59:52 (CET). Antivirus Version Update Result AhnLab-V3 2007.6.27.0 06.26.2007 no virus found AntiVir 7.4.0.34 06.26.2007 ADSPY/Agent.DA Authentium 4.93.8 06.25.2007 no virus found Avast 4.7.997.0 06.26.2007 no virus found AVG 7.5.0.476 06.26.2007 Adware Generic2.DVF BitDefender 7.2 06.26.2007 Adware.Virtumonde.GFA CAT-QuickHeal 9.00 06.26.2007 AdWare.Virtumonde.ki (Not a Virus) ClamAV devel-20070416 06.26.2007 Trojan.Vundo-348 DrWeb 4.33 06.26.2007 Trojan.Virtumod eSafe 7.0.15.0 06.26.2007 Suspicious Trojan/Worm eTrust-Vet 30.8.3743 06.26.2007 Win32/Vundo!generic Ewido 4.0 06.26.2007 no virus found FileAdvisor 1 06.26.2007 no virus found Fortinet 2.91.0.0 06.26.2007 Adware/VirtuMonde F-Prot 4.3.2.48 06.25.2007 no virus found F-Secure 6.70.13030.0 06.26.2007 no virus found Ikarus T3.1.1.8 06.26.2007 not-a-virus:AdWare.Win32.Virtumonde.ki Kaspersky 4.0.2.24 06.26.2007 not-a-virus:AdWare.Win32.Virtumonde.ki McAfee 5061 06.26.2007 Vundo Microsoft 1.2701 06.26.2007 no virus found NOD32v2 2355 06.26.2007 Win32/Adware.Virtumonde.KI Norman 5.80.02 06.26.2007 W32/Virtumonde.dam Panda 9.0.0.4 06.26.2007 Spyware/Virtumonde Sophos 4.19.0 06.24.2007 Troj/Vundo-Y Sunbelt 2.2.907.0 06.26.2007 VIPRE.Suspicious Symantec 10 06.26.2007 Trojan.Vundo TheHacker 6.1.6.137 06.26.2007 Adware/Virtumonde.ki VBA32 3.12.0.2 06.25.2007 AdWare.Win32.Virtumonde.ki VirusBuster 4.3.23:9 06.26.2007 Adware.Vundo.N Webwasher-Gateway 6.0.1 06.26.2007 Ad-Spyware.Agent.DA Aditional Information File size: 124480 bytes MD5: bc6b0f16a3dac8b7423ceee6d3590b23 SHA1: 7f29c43661a094e3e107d0339e73e4fde8ff5f60 Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics. ______________________________________________________ Complete scanning result of "frmwrk.exe", received in VirusTotal at 06.26.2007, 19:02:09 (CET). Antivirus Version Update Result AhnLab-V3 2007.6.27.0 06.26.2007 no virus found AntiVir 7.4.0.34 06.26.2007 no virus found Authentium 4.93.8 06.25.2007 no virus found Avast 4.7.997.0 06.26.2007 no virus found AVG 7.5.0.476 06.26.2007 no virus found BitDefender 7.2 06.26.2007 Trojan.Peed.HXN CAT-QuickHeal 9.00 06.26.2007 (Suspicious) - DNAScan ClamAV devel-20070416 06.26.2007 no virus found DrWeb 4.33 06.26.2007 Trojan.Packed.140 eSafe 7.0.15.0 06.26.2007 Suspicious Trojan/Worm eTrust-Vet 30.8.3743 06.26.2007 no virus found Ewido 4.0 06.26.2007 no virus found FileAdvisor 1 06.26.2007 no virus found Fortinet 2.91.0.0 06.26.2007 no virus found F-Prot 4.3.2.48 06.25.2007 no virus found F-Secure 6.70.13030.0 06.26.2007 Trojan-Downloader.Win32.Tibs.lj Ikarus T3.1.1.8 06.26.2007 Trojan-Downloader.Win32.Tibs.lj Kaspersky 4.0.2.24 06.26.2007 Trojan-Downloader.Win32.Tibs.lj McAfee 5061 06.26.2007 no virus found Microsoft 1.2701 06.26.2007 Worm:Win32/Nuwar.gen NOD32v2 2355 06.26.2007 no virus found Norman 5.80.02 06.26.2007 no virus found Panda 9.0.0.4 06.26.2007 Suspicious file Sophos 4.19.0 06.24.2007 Mal/EncPk-Q Sunbelt 2.2.907.0 06.26.2007 VIPRE.Suspicious Symantec 10 06.26.2007 Trojan.Packed.13 TheHacker 6.1.6.137 06.26.2007 no virus found VBA32 3.12.0.2 06.25.2007 MalwareScope.Worm.Nuwar-Glowa.1 VirusBuster 4.3.23:9 06.26.2007 Trojan.Tibs.Gen!Pac.126 Webwasher-Gateway 6.0.1 06.26.2007 Virus.Win32.FileInfector.gen (suspicious) Aditional Information File size: 9178 bytes MD5: ec8ed1ea4e6c29349455ff79930adcf8 SHA1: 4236912a469ac85b6319c65da4174a686561f898 Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics. _________________________________________________________ Complete scanning result of "hostlook.exe", received in VirusTotal at 06.26.2007, 19:03:00 (CET). Antivirus Version Update Result AhnLab-V3 2007.6.27.0 06.26.2007 Win-Trojan/Alphabet.28160 AntiVir 7.4.0.34 06.26.2007 DR/Dldr.Alphabet.E Authentium 4.93.8 06.25.2007 is a security risk or a "backdoor" program Avast 4.7.997.0 06.26.2007 Win32:Alphabet-B AVG 7.5.0.476 06.26.2007 Clicker.GAS BitDefender 7.2 06.26.2007 MemScan:Trojan.Downloader.Alphabet.F CAT-QuickHeal 9.00 06.26.2007 TrojanDownloader.Alphabet.c ClamAV devel-20070416 06.26.2007 Trojan.Downloader-8296 DrWeb 4.33 06.26.2007 Trojan.DownLoader.23031 eSafe 7.0.15.0 06.26.2007 Win32.Alphabet.c eTrust-Vet 30.8.3743 06.26.2007 Win32/Kastem.R Ewido 4.0 06.26.2007 Downloader.Alphabet.c FileAdvisor 1 06.26.2007 no virus found Fortinet 2.91.0.0 06.26.2007 W32/Alphabet.C!tr.dldr F-Prot 4.3.2.48 06.25.2007 W32/Malware!4cfc F-Secure 6.70.13030.0 06.26.2007 Trojan-Downloader.Win32.Alphabet.c Ikarus T3.1.1.8 06.26.2007 Trojan-Downloader.Win32.Alphabet.c Kaspersky 4.0.2.24 06.26.2007 Trojan-Downloader.Win32.Alphabet.c McAfee 5061 06.26.2007 Generic Downloader Microsoft 1.2701 06.26.2007 no virus found NOD32v2 2355 06.26.2007 Win32/TrojanDownloader.Alphabet.C Norman 5.80.02 06.26.2007 W32/DLoader.CWCF.dropper Panda 9.0.0.4 06.26.2007 Adware/DriveCleaner Sophos 4.19.0 06.24.2007 no virus found Sunbelt 2.2.907.0 06.26.2007 Scam.Iwin Symantec 10 06.26.2007 no virus found TheHacker 6.1.6.137 06.26.2007 Trojan/Downloader.Alphabet.c VBA32 3.12.0.2 06.25.2007 Trojan-Downloader.Win32.Alphabet.c VirusBuster 4.3.23:9 06.26.2007 no virus found Webwasher-Gateway 6.0.1 06.26.2007 Trojan.Dldr.Alphabet.E Aditional Information File size: 28160 bytes MD5: 71bf6fa39bd4d24ab686b1b8400b01cb SHA1: 0433ddec42ef0910edcdbde0360071bdf1382df7 packers: PECompact, PECompact, PECompact packers: PECOMPACT norman sandbox: [ General information ] * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**. * Decompressing PEC2. * Accesses executable file from resource section. * Creating several executable files on hard-drive. * File length: 28160 bytes. [ Changes to filesystem ] * Creates file C:WINDOWSTEMP<981.exe. * Creates file C:WINDOWSTEMPagent.exe. * Creates file C:WINDOWSTEMPǯ8481.exe. * Deletes file C:WINDOWSTEMP\7578481.exe. [ Changes to registry ] * Creates value "avp"="C:WINDOWSTEMP\74981.exe" in key "HKLMSoftwareMicrosoftWindowsCurrentVersionRun". [ Process/window information ] * Will automatically restart after boot (I'll be back...). [ Signature Scanning ] * C:WINDOWSTEMP<981.exe (19456 bytes) : W32/DLoader.CWCF. Sunbelt info: Scam.Iwin is created by a browser exploit for the purpose of transmitting false clicks to internet URLs. _________________________________________________- Service is stopped in this moments. Scanning of your sample has not been finalized and results has been lost. If you wish to scan it, please send it again. Antivirus Version Update Result AhnLab-V3 2007.6.27.0 06.26.2007 no virus found AntiVir 7.4.0.34 06.26.2007 TR/Dldr.Alphabet.11776.29 Authentium 4.93.8 06.25.2007 no virus found Avast 4.7.997.0 06.26.2007 no virus found AVG 7.5.0.476 06.26.2007 Downloader.Generic4.YSK BitDefender 7.2 06.26.2007 no virus found CAT-QuickHeal 9.00 06.26.2007 (Suspicious) - DNAScan ClamAV devel-20070416 06.26.2007 no virus found DrWeb 4.33 06.26.2007 no virus found eSafe 7.0.15.0 06.26.2007 Win32.Alphabet.gen eTrust-Vet 30.8.3743 06.26.2007 no virus found Ewido 4.0 06.26.2007 Downloader.Alphabet FileAdvisor 1 06.26.2007 no virus found Fortinet 2.91.0.0 06.26.2007 W32/Alphabet!tr.dldr F-Prot 4.3.2.48 06.25.2007 no virus found F-Secure 6.70.13030.0 06.26.2007 Trojan-Downloader.Win32.Alphabet.gen Ikarus T3.1.1.8 06.26.2007 Trojan-Downloader.Win32.Alphabet Kaspersky 4.0.2.24 06.26.2007 Trojan-Downloader.Win32.Alphabet.gen McAfee 5061 06.26.2007 no virus found Microsoft 1.2701 06.26.2007 TrojanDownloader:Win32/Small.gen!F NOD32v2 2355 06.26.2007 probably a variant of Win32/TrojanClicker.Agent.NBS Norman 5.80.02 06.26.2007 W32/DLoader.CXTE Panda 9.0.0.4 06.26.2007 no virus found Sophos 4.19.0 06.24.2007 no virus found Sunbelt 2.2.907.0 06.26.2007 VIPRE.Suspicious Symantec 10 06.26.2007 no virus found TheHacker 6.1.6.137 06.26.2007 no virus found VBA32 3.12.0.2 06.25.2007 no virus found Aditional Information File size: 11776 bytes MD5: 672ac976b0778a8eb189f535b480103b SHA1: 91af870d10fb6bb86e6a0cf65cb86198f1014019 packers: PECOMPACT packers: embedded, PecBundle, PECompact Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics. FRMWRK war das |
|
| Themen zu Drivecleaner/pop ups ohne ende |
| adobe, antivirus, askbar, dll, drivers, explorer, firewall, hijackthis, internet, internet explorer, monitor, nvidia, opera, performance, problem, programm, programme, rundll, seiten, software, symantec, system, t-online, temp, ups, urlsearchhook, windows, windows xp |
