Trojaner gefunden TR/Monder und TR/Vundo.gen

TheSteve

Hii, dank dir für deine schnelle Antwort...ich kann die nächsten Tage
leider nicht im Forum sein, weil ich ne Forbildung hab (die Begeisterung hält
sich in Grenzen, ich hasse das lol

hab mich auch scon gewundert, warum die icq toolbar dort angezeigt wird...

hier erstmal das Ergenis von virustotal, das mit Malwarebytes reich ich nach alright?

Datei ICQ_Service.exe empfangen 2008.07.21 22:41:23 (CET)
Status: Laden ... Wartend Warten Überprüfung Beendet Nicht gefunden Gestoppt
Ergebnis: 0/34 (0%)


Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.7.21.1 2008.07.21 -
AntiVir 7.8.1.11 2008.07.21 -
Authentium 5.1.0.4 2008.07.21 -
Avast 4.8.1195.0 2008.07.21 -
AVG 8.0.0.130 2008.07.21 -
BitDefender 7.2 2008.07.21 -
CAT-QuickHeal 9.50 2008.07.21 -
ClamAV 0.93.1 2008.07.21 -
DrWeb 4.44.0.09170 2008.07.21 -
eSafe 7.0.17.0 2008.07.21 -
eTrust-Vet 31.6.5971 2008.07.21 -
Ewido 4.0 2008.07.21 -
F-Prot 4.4.4.56 2008.07.21 -
F-Secure 7.60.13501.0 2008.07.21 -
Fortinet 3.14.0.0 2008.07.21 -
GData 2.0.7306.1023 2008.07.21 -
Ikarus T3.1.1.34.0 2008.07.21 -
Kaspersky 7.0.0.125 2008.07.21 -
McAfee 5343 2008.07.21 -
Microsoft 1.3704 2008.07.21 -
NOD32v2 3284 2008.07.21 -
Norman 5.80.02 2008.07.21 -
Panda 9.0.0.4 2008.07.21 -
PCTools 4.4.2.0 2008.07.21 -
Prevx1 V2 2008.07.21 -
Rising 20.54.02.00 2008.07.21 -
Sophos 4.31.0 2008.07.21 -
Sunbelt 3.1.1536.1 2008.07.18 -
Symantec 10 2008.07.21 -
TheHacker 6.2.96.385 2008.07.20 -
TrendMicro 8.700.0.1004 2008.07.21 -
VBA32 3.12.8.1 2008.07.21 -
VirusBuster 4.5.11.0 2008.07.21 -
Webwasher-Gateway 6.6.2 2008.07.21 -
weitere Informationen
File size: 222456 bytes
MD5...: a4e43a7ab1202356bebeb6b798f15488
SHA1..: c50ea1dbefc285a4046589a8fa9c379091e7f218
SHA256: ccf8c95b0aabd4112e5d7c93cdbffe8a0f86d84d50247573702d9486c36fa128
SHA512: bc268e29425380b11439323a2a34deb20cce0ce8b997be8206474f80f2d6bb9f
08c6e0c13497f21c870f0966358b31d2cba0a024359044c8053ca265d978c6d7
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x411492
timedatestamp.....: 0x483bbe08 (Tue May 27 07:53:44 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x26f57 0x27000 6.64 7c1a0f5d135ff69f429f40a05c116a72
.rdata 0x28000 0xb7fe 0xb800 6.09 ed361b5d7724d6aed56b5805f30512f3
.data 0x34000 0x38fc 0x1800 3.43 0cd655aeb5691bec1579549a5e52461a
.rsrc 0x38000 0xbbc 0xc00 4.24 8626d667ee291bf20ec3f10232ea3302

( 12 imports )
> urlmon.dll: URLDownloadToFileW
> WININET.dll: DeleteUrlCacheEntryW
> SETUPAPI.dll: SetupIterateCabinetW
> KERNEL32.dll: FreeLibrary, LoadLibraryExW, GetCommandLineW, ReleaseMutex, FindClose, FindNextFileW, RemoveDirectoryW, FindFirstFileW, WideCharToMultiByte, HeapDestroy, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, GetProcessHeap, EnterCriticalSection, LeaveCriticalSection, GetLocaleInfoW, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, CreateFileW, InitializeCriticalSectionAndSpinCount, LoadLibraryA, lstrcmpiW, InterlockedIncrement, GetCurrentThread, GetCurrentProcess, CloseHandle, GetModuleHandleW, GetProcAddress, InterlockedDecrement, DeleteCriticalSection, InitializeCriticalSection, RaiseException, Sleep, MoveFileExW, CreateDirectoryW, DeleteFileW, MoveFileW, GetModuleFileNameW, GetCurrentThreadId, lstrlenW, CreateEventW, WaitForSingleObject, LocalFree, FindResourceExW, FindResourceW, LoadResource, LockResource, SizeofResource, GetLastError, lstrcpynW, SetEndOfFile, CreateFileA, IsValidLocale, EnumSystemLocalesA, GetUserDefaultLCID, GetStringTypeW, GetStringTypeA, GetLocaleInfoA, SetFilePointer, ReadFile, FlushFileBuffers, VirtualAlloc, GetConsoleMode, GetConsoleCP, SetStdHandle, IsValidCodePage, GetOEMCP, GetACP, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, VirtualFree, HeapCreate, SetLastError, CreateMutexW, MultiByteToWideChar, CreateThread, GetStartupInfoW, RtlUnwind, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetSystemTimeAsFileTime, SetFileAttributesW, GetFileAttributesW, LCMapStringA, LCMapStringW, GetCPInfo, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, FreeEnvironmentStringsW, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree
> USER32.dll: GetMessageW, DispatchMessageW, PostThreadMessageW, FindWindowW, CharNextW, LoadStringW
> ADVAPI32.dll: ControlService, DeleteService, CreateServiceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, OpenThreadToken, OpenProcessToken, GetTokenInformation, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, IsValidSid, GetLengthSid, CopySid, RegDeleteValueW, RegDeleteKeyW, SetServiceStatus, RegisterEventSourceW, ReportEventW, DeregisterEventSource, OpenSCManagerW, OpenServiceW, CloseServiceHandle, RegOpenKeyExW, RegQueryInfoKeyW, RegEnumKeyExW, RegSetValueExW, RegQueryValueExW, RegCreateKeyExW, InitializeSecurityDescriptor, SetSecurityDescriptorDacl, RegCloseKey, ConvertStringSecurityDescriptorToSecurityDescriptorW, GetSecurityDescriptorSacl, SetSecurityInfo
> ole32.dll: CoRevokeClassObject, CoRegisterClassObject, CoTaskMemAlloc, CoTaskMemRealloc, CoCreateInstance, CoTaskMemFree, StringFromGUID2, CoInitializeSecurity, CoInitialize, CoUninitialize
> SHELL32.dll: SHGetFolderPathW
> OLEAUT32.dll: -, -, -, -, -, -, -
> SHLWAPI.dll: PathAppendW
> msi.dll: -
> CRYPT32.dll: CertCompareCertificate, CertFreeCertificateContext

( 0 exports )