Nach Trojaner-Beseitgung kein WinXP-Update mehr möglich!

bernem

Hallo,
habe SChritt 1 und 2 durchgeführt. Ergebnis sieht wie befürchtet aus:

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.10.24.3 2008.10.25 -
AntiVir 7.9.0.9 2008.10.25 -
Authentium 5.1.0.4 2008.10.26 -
Avast 4.8.1248.0 2008.10.25 -
AVG 8.0.0.161 2008.10.25 -
BitDefender 7.2 2008.10.26 -
CAT-QuickHeal 9.50 2008.10.25 (Suspicious) - DNAScan
ClamAV 0.93.1 2008.10.26 -
DrWeb 4.44.0.09170 2008.10.26 -
eSafe 7.0.17.0 2008.10.26 -
eTrust-Vet 31.6.6168 2008.10.25 -
Ewido 4.0 2008.10.26 -
F-Prot 4.4.4.56 2008.10.26 -
F-Secure 8.0.14332.0 2008.10.26 Suspicious:W32/Malware!Gemini
Fortinet 3.113.0.0 2008.10.26 -
GData 19 2008.10.26 -
Ikarus T3.1.1.44.0 2008.10.26 -
K7AntiVirus 7.10.508 2008.10.26 -
Kaspersky 7.0.0.125 2008.10.26 -
McAfee 5415 2008.10.25 -
Microsoft 1.4005 2008.10.26 -
NOD32 3556 2008.10.26 -
Norman 5.80.02 2008.10.24 -
Panda 9.0.0.4 2008.10.25 -
PCTools 4.4.2.0 2008.10.25 -
Prevx1 V2 2008.10.26 -
Rising 21.00.62.00 2008.10.26 -
SecureWeb-Gateway 6.7.6 2008.10.25 Virus.Win32.FileInfector.gen (suspicious)
Sophos 4.35.0 2008.10.26 -
Sunbelt 3.1.1753.1 2008.10.25 -
Symantec 10 2008.10.26 -
TheHacker 6.3.1.1.129 2008.10.25 -
TrendMicro 8.700.0.1004 2008.10.24 -
VBA32 3.12.8.8 2008.10.25 -
ViRobot 2008.10.24.1436 2008.10.24 -
VirusBuster 4.5.11.0 2008.10.25 -

weitere Informationen
File size: 816376 bytes
MD5...: ffb4bc584ae2cdcdce647b29d74e6b8d
SHA1..: 5d3bf5f104868ec99a6ed51d1651eabc761b4440
SHA256: 25ed27bd9337767476d0aad0b49cfa874cb68c0a9664dc55b57e498afba0b72c
SHA512: 7d8002862f104f92f969770f1a0eed5e4797e55988de6ed2ccc09b75f3746dab
ff06965ee8a80ef7af47a99440a8c8f37cafb50745b11a25676f22b9b3139943
PEiD..: -
TrID..: File type identification
Generic Win/DOS Executable (49.9%)
DOS Executable Generic (49.8%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x485000
timedatestamp.....: 0x46bae819 (Thu Aug 09 10:10:33 2007)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x294a6 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x2b000 0x6e6e 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.data 0x32000 0x2e14 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.text1 0x35000 0x50000 0x43000 7.98 f5fde3a04cf115e830a31c460d7d1d14
.adata 0x85000 0x10000 0xd000 7.01 a2e2195614c8ab367fb814ab194a469a
.data1 0x95000 0x20000 0xb000 3.76 d79ab0e1c126e69dd920e213df3a115c
.pdata 0xb5000 0x70000 0x62000 7.99 60802f7e8a46849ab596e454f227518a
.rsrc 0x125000 0x8000 0x8000 5.15 267f839db7193c953bad7d1a33687939

( 3 imports )
> KERNEL32.dll: CreateThread, GlobalUnlock, GlobalLock, GlobalAlloc, GetTickCount, WideCharToMultiByte, IsBadReadPtr, GlobalAddAtomA, GlobalAddAtomW, GetModuleHandleA, GlobalFree, GlobalGetAtomNameA, GlobalDeleteAtom, GlobalGetAtomNameW, FreeConsole, GetEnvironmentVariableA, VirtualProtect, VirtualAlloc, GetProcAddress, GetLastError, LoadLibraryA, SetLastError, SetThreadPriority, GetCurrentThread, CreateProcessA, GetCommandLineA, GetStartupInfoA, SetEnvironmentVariableA, ReleaseMutex, WaitForSingleObject, CreateMutexA, OpenMutexA, GetCurrentThreadId, CreateFileA, FindClose, FindFirstFileA, FindFirstFileW, VirtualQueryEx, GetExitCodeProcess, ReadProcessMemory, UnmapViewOfFile, ContinueDebugEvent, SetThreadContext, GetThreadContext, WaitForDebugEvent, SuspendThread, DebugActiveProcess, ResumeThread, CreateProcessW, GetCommandLineW, GetStartupInfoW, CloseHandle, DuplicateHandle, GetCurrentProcess, CreateFileMappingA, VirtualProtectEx, WriteProcessMemory, ExitProcess, FlushFileBuffers, WriteConsoleW, GetConsoleOutputCP, WriteConsoleA, SetStdHandle, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetConsoleMode, GetConsoleCP, SetFilePointer, GetLocaleInfoA, MultiByteToWideChar, HeapSize, HeapReAlloc, QueryPerformanceCounter, VirtualFree, HeapCreate, HeapDestroy, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, RtlUnwind, DeleteCriticalSection, GetStdHandle, WriteFile, Sleep, EnterCriticalSection, LeaveCriticalSection, GetVersionExA, InitializeCriticalSection, GetCurrentProcessId, GetModuleFileNameW, GetShortPathNameW, GetModuleFileNameA, MapViewOfFile, GetShortPathNameA, GetSystemTimeAsFileTime, HeapFree, HeapAlloc, GetProcessHeap, RaiseException, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, InterlockedDecrement
> USER32.dll: GetDesktopWindow, MoveWindow, SetPropA, EnumThreadWindows, GetPropA, GetMessageA, GetSystemMetrics, SetTimer, GetAsyncKeyState, KillTimer, BeginPaint, EndPaint, SetWindowTextA, GetDlgItem, CreateDialogIndirectParamA, ShowWindow, UpdateWindow, LoadStringA, LoadStringW, FindWindowA, WaitForInputIdle, MessageBoxA, InSendMessage, UnpackDDElParam, FreeDDElParam, DefWindowProcA, LoadCursorA, RegisterClassW, CreateWindowExW, RegisterClassA, CreateWindowExA, GetWindowThreadProcessId, SendMessageW, SendMessageA, PeekMessageA, TranslateMessage, DispatchMessageA, EnumWindows, IsWindowUnicode, PackDDElParam, PostMessageW, PostMessageA, IsWindow, DestroyWindow
> GDI32.dll: CreateDCA, CreateDIBitmap, CreateCompatibleDC, SelectObject, SelectPalette, RealizePalette, BitBlt, DeleteDC, DeleteObject, CreatePalette

( 0 exports )

ThreatExpert info: http://www.threatexpert.com/report.aspx?md5=ffb4bc584ae2cdcdce647b29d74e6b8d
packers (F-Prot): Armadillo
packers (Kaspersky): Armadillo

**********

Was ist zu tun?