| |  Werbe-PopUp mit IE7
 Hallo,
habe seit einigen Tagen immer diese blöden Werbungen - es öffnet automatisch der IE7 obwohl ich Firefox benutze.
Kann mir jemand sagen, wie ich den Mist weg bekomme?
HijackThis Zitat:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:30:58, on 24.11.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
D:\Nero\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\Hcontrol.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Programme\Synaptics\SynTP\SynTPLpr.exe
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\Notebook Hardware Control\nhc.exe
C:\Programme\LevelOne\MFP Server Control Center\Control Center.exe
C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\IoctlSvc.exe
D:\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\Programme\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\PrevxCSI\prevxcsi.exe
C:\Programme\PrevxCSI\prevxcsi.exe
C:\WINDOWS\System32\msiexec.exe
C:\Programme\Windows Defender\MsMpEng.exe
C:\Programme\Windows Defender\MSASCui.exe
C:\Programme\Java\jre1.6.0_01\launch4j-tmp\JDownloader.exe
D:\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://www.asus.com.tw/
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - D:\GetRight\xx2gr.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - D:\Free Download Manager\iefdmcks.dll
O4 - HKLM\..\Run: [Hcontrol] C:\WINDOWS\ATK0100\Hcontrol.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SynTPLpr] C:\Programme\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NotebookHardwareControl] "C:\Programme\Notebook Hardware Control\nhc.exe" -quiet
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programme\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Programme\ATK Hotkey\Hcontrol.exe"
O4 - HKLM\..\Run: [Control Center] C:\Programme\LevelOne\MFP Server Control Center\Control Center.exe -mini
O4 - HKLM\..\Run: [AVP] "C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Programme\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "D:\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [Sign Info] C:\DOKUME~1\**\ANWEND~1\IDOLIN~1\Encbias.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: netzlaufwerk-movie.bat
O4 - Global Startup: netzlaufwerk - mediacenter.bat
O8 - Extra context menu item: Alles mit FDM herunterladen - file://D:\Free Download Manager\dlall.htm
O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://D:\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Datei mit FDM herunterladen - file://D:\Free Download Manager\dllink.htm
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: Mit GetRight laden - D:\GetRight\GRdownload.htm
O8 - Extra context menu item: Mit GetRight-Browser öffnen - D:\GetRight\GRdownload.htm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://D:\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Statistik für den Schutz des Web-Datenverkehrs - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programme\Kaspersky Lab\Kaspersky
Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=h**p://www.asus.com.tw
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1158592582713
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1158592621329
O17 - HKLM\System\CCS\Services\Tcpip\..\{66A2A8B5-4B65-49F0-B190-6B738C7882AA}: NameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{7D5ABC62-FCE4-43D5-80C9-FD9D8C903838}: NameServer = 192.168.2.1
O20 - AppInit_DLLs:
C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASP ER~
1\kloehk.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Programme\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: CSIScanner - Prevx - C:\Programme\PrevxCSI\prevxcsi.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programme\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel
32\IDriverT.exe
O23 - Service: ITE Remote Control Service (ITECIRService) - ITE Tech. Inc. - C:\WINDOWS\system32\RemoteControlService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - D:\Nero\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - D:\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
--
End of file - 8858 bytes
| VirusTotal Zitat:
Datei Encbias.exe empfangen 2008.11.24 07:52:33 (CET)
Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.11.21.0 2008.11.24 -
AntiVir 7.9.0.35 2008.11.23 -
Authentium 5.1.0.4 2008.11.24 W32/Swizzor-based.2!Maximus
Avast 4.8.1281.0 2008.11.23 -
AVG 8.0.0.199 2008.11.23 -
BitDefender 7.2 2008.11.24 -
CAT-QuickHeal 10.00 2008.11.24 -
ClamAV 0.94.1 2008.11.24 -
DrWeb 4.44.0.09170 2008.11.24 Trojan.Swizzor.based
eSafe 7.0.17.0 2008.11.23 -
eTrust-Vet 31.6.6222 2008.11.22 -
Ewido 4.0 2008.11.23 -
F-Prot 4.4.4.56 2008.11.24 W32/Swizzor-based.2!Maximus
F-Secure 8.0.14332.0 2008.11.24 Suspicious:W32/Kronos.b!Gemini
Fortinet 3.117.0.0 2008.11.23 -
GData 19 2008.11.24 -
Ikarus T3.1.1.45.0 2008.11.24 Virus.Trojan.Win32.Obfuscated
K7AntiVirus 7.10.531 2008.11.22 -
Kaspersky 7.0.0.125 2008.11.24 -
McAfee 5443 2008.11.23 -
McAfee+Artemis 5443 2008.11.23 -
Microsoft 1.4104 2008.11.24 -
NOD32 3633 2008.11.24 -
Norman 5.80.02 2008.11.22 -
Panda 9.0.0.4 2008.11.23 -
PCTools 4.4.2.0 2008.11.23 -
Prevx1 V2 2008.11.24 -
Rising 21.05.00.00 2008.11.24 Trojan.Win32.Swizzor.ul
SecureWeb-Gateway 6.7.6 2008.11.23 -
Sophos 4.35.0 2008.11.24 -
Sunbelt 3.1.1823.2 2008.11.22 -
Symantec 10 2008.11.24 -
TheHacker 6.3.1.1.160 2008.11.23 -
TrendMicro 8.700.0.1004 2008.11.24 -
VBA32 3.12.8.9 2008.11.23 OScope.Trojan.BagsWay.C
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.23 -
weitere Informationen
File size: 560128 bytes
MD5...: 115a80d2ba703fb59734535c823a4c94
SHA1..: 02913558ed78fb13e9e82941d7a9730e43c05103
SHA256: a1b58ac473b54bd12682060cc6d0e88d3bd953986f298508cee6355679c8ba7b
SHA512: 7ed6c283b0ad8b9e334bd72d0d50c869f36ce384a4a04ac4b605d932b32252af
6518e1dfebdf6caf8b8ccbbdf8edc994f2734e79331d6571c644fa79d9eef1e7
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x4066b0
timedatestamp.....: 0x46c05d83 (Mon Aug 13 13:32:51 2007)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x3082a 0x30a00 6.39 a3b10db0e9ef6f76e30b6009f8905848
.rdata 0x32000 0x39ca0 0x34600 7.98 e6406eb1aeaa5825fe131fbf107f9969
.data 0x6c000 0x1bd3c 0x1be00 7.18 39fb76c83601617097dc0b8664bb1b2b
.rsrc 0x88000 0x7859 0x7a00 5.73 1a410fa338fc82cfccdbb0054106785b
( 4 imports )
> WININET.dll: InternetOpenUrlA, FtpCommandA, FindFirstUrlCacheEntryW, UnlockUrlCacheEntryFileA, FreeUrlCacheSpaceW, FtpCreateDirectoryA, FtpGetCurrentDirectoryW
> comctl32.dll: InitCommonControlsEx, _TrackMouseEvent
> USER32.dll: MessageBoxW, RegisterClassA, ShowWindow, ClientToScreen, DefWindowProcA, FindWindowW, DestroyWindow, BeginDeferWindowPos, CopyRect, CreateWindowExW, IsWindowVisible, RegisterClassExA, CallMsgFilter
> KERNEL32.dll: IsDebuggerPresent, LoadLibraryA, WideCharToMultiByte, GetACP, GetTimeFormatA, CompareStringA, GetStartupInfoA, HeapAlloc, WriteConsoleA, TerminateProcess, MultiByteToWideChar, GetConsoleCP, InitializeCriticalSection, HeapFree, TlsAlloc, EnterCriticalSection, GetStdHandle, LCMapStringW, OpenMutexA, FindFirstFileExA, GetCommandLineA, GetStartupInfoW, GetConsoleMode, Sleep, VirtualFree, GetStringTypeA, WriteFile, InterlockedIncrement, SetEnvironmentVariableA, LCMapStringA, CreateMutexA, WriteConsoleOutputW, FillConsoleOutputCharacterW, VirtualQuery, DeleteCriticalSection, GetEnvironmentStrings, ReadFile, GetModuleFileNameA, GetCurrentProcessId, GetStringTypeW, HeapDestroy, SetStdHandle, SetFilePointer, SetConsoleCtrlHandler, GetCurrentProcess, GetFileType, LockFile, SetUnhandledExceptionFilter, TlsSetValue, AllocConsole, GetVersionExA, GetCurrentThread, IsValidLocale, TlsGetValue, GetEnvironmentStringsW, GetLastError, FreeLibrary, GetCurrentThreadId, CreateFileA, FlushFileBuffers, VirtualAlloc, SetHandleCount, ExitProcess, GetUserDefaultLCID, CloseHandle, LeaveCriticalSection, InterlockedDecrement, QueryPerformanceCounter, EnumSystemLocalesA, GetCommandLineW, HeapReAlloc, WriteConsoleW, GetConsoleOutputCP, LoadLibraryExA, GetModuleFileNameW, GetProcessHeap, RtlUnwind, GetProcAddress, GetTimeZoneInformation, FreeEnvironmentStringsW, HeapSize, FreeEnvironmentStringsA, GetSystemTimeAsFileTime, GetLocaleInfoA, GetTickCount, InterlockedExchange, UnhandledExceptionFilter, GetLocaleInfoW, GetCPInfo, IsValidCodePage, GetOEMCP, SetLastError, GetDateFormatA, GetModuleHandleA, WriteProfileSectionW, HeapCreate, CompareStringW, LocalUnlock, TlsFree, SystemTimeToFileTime
( 0 exports )
packers (Kaspersky): PE_Patch
| Zitat:
Datei Noun_Heck_Nurb.exe empfangen 2008.11.24 10:52:57 (CET)
Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.11.21.0 2008.11.24 -
AntiVir 7.9.0.35 2008.11.24 -
Authentium 5.1.0.4 2008.11.24 W32/Swizzor-based.2!Maximus
Avast 4.8.1281.0 2008.11.23 -
AVG 8.0.0.199 2008.11.23 -
BitDefender 7.2 2008.11.24 -
CAT-QuickHeal 10.00 2008.11.24 Win32.Trojan.C2Lop.E.4
ClamAV 0.94.1 2008.11.24 -
DrWeb 4.44.0.09170 2008.11.24 Trojan.Swizzor.based
eSafe 7.0.17.0 2008.11.23 -
eTrust-Vet 31.6.6225 2008.11.24 -
Ewido 4.0 2008.11.23 -
F-Prot 4.4.4.56 2008.11.24 W32/Swizzor-based.2!Maximus
F-Secure 8.0.14332.0 2008.11.24 -
Fortinet 3.117.0.0 2008.11.24 -
GData 19 2008.11.24 -
Ikarus T3.1.1.45.0 2008.11.24 -
K7AntiVirus 7.10.531 2008.11.22 -
Kaspersky 7.0.0.125 2008.11.24 -
McAfee 5443 2008.11.23 -
McAfee+Artemis 5443 2008.11.23 -
Microsoft 1.4104 2008.11.24 -
NOD32 3634 2008.11.24 -
Norman 5.80.02 2008.11.22 -
Panda 9.0.0.4 2008.11.23 -
PCTools 4.4.2.0 2008.11.23 -
Prevx1 V2 2008.11.24 -
Rising 21.05.00.00 2008.11.24 Trojan.Win32.Swizzor.ul
SecureWeb-Gateway 6.7.6 2008.11.24 -
Sophos 4.35.0 2008.11.24 -
Sunbelt 3.1.1823.2 2008.11.22 -
Symantec 10 2008.11.24 -
TheHacker 6.3.1.1.161 2008.11.24 -
TrendMicro 8.700.0.1004 2008.11.24 -
VBA32 3.12.8.9 2008.11.23 Trojan.Win32.Drivecurb.3
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.23 -
weitere Informationen
File size: 311808 bytes
MD5...: cd771aeb365c4cc60f9c4adac3565abc
SHA1..: edfc421dc90c1894d0d4d368d160f351f412d45e
SHA256: 17b342cb016868df638555a8e6016524ac0d5ba93d427009b088e33307a32a3c
SHA512: 92b10cc4311ae4242a0a3525c3015f28718ff23e9a69fd3a5a63ad30e91f2900
34996fac9505aff6e32e906ff8de1d5cdc1fb1cce1c8bf7c3e693cd88761b07b
PEiD..: -
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x403ffa
timedatestamp.....: 0x47133cfe (Mon Oct 15 10:12:14 2007)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2206f 0x22200 6.51 a0a16e1228d04b832e5f0506ad4f397f
.rdata 0x24000 0x146c0 0xea00 7.84 2db3775a9cf2fca46a309237a32bc328
.data 0x39000 0x16cc4 0x16e00 7.17 bc11b303dc3bd7c1542673a533ad96d3
.rsrc 0x50000 0x43b8 0x4400 4.70 b848ea21d5471e022864ce2fdc03a1bb
( 4 imports )
> USER32.dll: CheckRadioButton, GetCursorInfo, GetKeyNameTextW, GetScrollBarInfo, RegisterClassExA, LoadCursorA, RegisterWindowMessageA, RegisterClassA, CallMsgFilter, GetClipboardSequenceNumber, GetDlgItemTextW, DlgDirListA, RegisterHotKey, DestroyWindow, ShowWindow, FrameRect, ChangeMenuW, DefWindowProcA, CreateWindowExA, ReleaseCapture, ClientToScreen, DdeInitializeA, MessageBoxW, GetKBCodePage, CreateDialogIndirectParamA, DdeConnect
> comctl32.dll: ImageList_Merge, CreateMappedBitmap, ImageList_Remove, ImageList_LoadImage, ImageList_AddMasked, GetEffectiveClientRect, InitCommonControlsEx, ImageList_SetFilter
> SHELL32.dll: RealShellExecuteA
> KERNEL32.dll: TlsGetValue, MultiByteToWideChar, GetVersionExA, VirtualFree, HeapSize, HeapAlloc, GetModuleHandleA, LCMapStringW, GetFileType, InterlockedDecrement, IsDebuggerPresent, GetStartupInfoA, WritePrivateProfileStructA, GetConsoleMode, GetProcessHeap, SetFilePointer, TlsAlloc, SetStdHandle, GetLocaleInfoA, FreeEnvironmentStringsW, GetProcAddress, CreateMutexA, WideCharToMultiByte, CreateFileA, HeapDestroy, LocalSize, HeapFree, TerminateProcess, lstrcmpW, EnterCriticalSection, GetConsoleOutputCP, GetSystemTimeAsFileTime, GetUserDefaultLCID, GetTickCount, GetCurrentProcess, GetEnvironmentStringsW, LoadLibraryA, OpenMutexA, InterlockedExchange, TlsSetValue, TlsFree, GetPrivateProfileSectionNamesW, GetLocaleInfoW, RtlUnwind, IsValidCodePage, WriteProfileStringW, GetTimeZoneInformation, GetStringTypeA, GetCurrentProcessId, FreeEnvironmentStringsA, GetOEMCP, SetEnvironmentVariableA, ExitProcess, GetSystemDirectoryW, InterlockedIncrement, CompareStringA, GetDateFormatA, GetConsoleCP, FlushFileBuffers, CreateNamedPipeW, GetCurrentThread, ReadFile, CompareStringW, CloseHandle, LCMapStringA, FreeLibrary, QueryPerformanceCounter, GetModuleFileNameA, EnumSystemLocalesA, HeapCreate, WriteConsoleA, SetConsoleCtrlHandler, GetACP, WriteConsoleW, Sleep, GetCommandLineA, VirtualQuery, WriteFile, SetUnhandledExceptionFilter, DeleteCriticalSection, GetTimeFormatA, GetStringTypeW, InitializeCriticalSection, IsValidLocale, GetCPInfo, VirtualAlloc, SetHandleCount, GetStdHandle, SetLastError, IsBadWritePtr, HeapReAlloc, GetLastError, GetEnvironmentStrings, GetCurrentThreadId, UnhandledExceptionFilter, LeaveCriticalSection, CopyFileA
( 0 exports )
packers (Kaspersky): PE_Patch
| Zitat:
Datei option_body.exe empfangen 2008.11.24 10:58:25 (CET)
Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.11.21.0 2008.11.24 -
AntiVir 7.9.0.35 2008.11.24 -
Authentium 5.1.0.4 2008.11.24 W32/Swizzor-based.2!Maximus
Avast 4.8.1281.0 2008.11.23 -
AVG 8.0.0.199 2008.11.23 -
BitDefender 7.2 2008.11.24 -
CAT-QuickHeal 10.00 2008.11.24 -
ClamAV 0.94.1 2008.11.24 -
DrWeb 4.44.0.09170 2008.11.24 -
eSafe 7.0.17.0 2008.11.23 -
eTrust-Vet 31.6.6225 2008.11.24 -
Ewido 4.0 2008.11.23 -
F-Prot 4.4.4.56 2008.11.24 W32/Swizzor-based.2!Maximus
Fortinet 3.117.0.0 2008.11.24 -
GData 19 2008.11.24 -
Ikarus T3.1.1.45.0 2008.11.24 -
K7AntiVirus 7.10.531 2008.11.22 -
Kaspersky 7.0.0.125 2008.11.24 -
McAfee 5443 2008.11.23 -
McAfee+Artemis 5443 2008.11.23 -
Microsoft 1.4104 2008.11.24 -
NOD32 3634 2008.11.24 -
Norman 5.80.02 2008.11.22 -
Panda 9.0.0.4 2008.11.23 -
PCTools 4.4.2.0 2008.11.23 -
Prevx1 V2 2008.11.24 -
Rising 21.05.00.00 2008.11.24 Trojan.DL.Win32.Swizzor.cx
SecureWeb-Gateway 6.7.6 2008.11.24 -
Sophos 4.35.0 2008.11.24 -
Sunbelt 3.1.1823.2 2008.11.22 -
Symantec 10 2008.11.24 -
TheHacker 6.3.1.1.161 2008.11.24 -
TrendMicro 8.700.0.1004 2008.11.24 -
VBA32 3.12.8.9 2008.11.23 OScope.Trojan.BagsWay.D
ViRobot 2008.11.18.1474 2008.11.18 -
VirusBuster 4.5.11.0 2008.11.23 -
weitere Informationen
File size: 3972608 bytes
MD5...: 2ade602331263b6235e52c0a9020b333
SHA1..: 2abadaafedefe8767950d30dcee60d37e2b12a50
SHA256: 494a752adbcfb3c24d3c126bf538d6de609858c7e8992e2b1a2abd245834938a
SHA512: 66ea997a220f0a4c1f516994cd3086b10d5cfb8088c77277b22fbd2c0d39d1dd
e6a3329f36930868858ae16df60fd63330038ed6228367abae0d950a5a8535dc
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x41eaf5
timedatestamp.....: 0x4719ccd3 (Sat Oct 20 09:39:31 2007)
machinetype.......: 0x14c (I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x24858 0x24a00 6.43 eefec69a6423bf916f3b3d37b4fa12ff
.rdata 0x26000 0x43b0c 0x3f000 7.98 b533f05d085bd784f9ba63d4e736002f
.data 0x6a000 0x358d60 0x35a000 8.00 ad14798a690f6dacae3ad31eef20d378
.rsrc 0x3c3000 0xbff8 0xc000 4.93 089321638e08f2dd01edf1a752195969
( 4 imports )
> KERNEL32.dll: GetTimeFormatA, GetCommandLineA, HeapReAlloc, ReadFile, InterlockedExchange, WriteConsoleW, GetEnvironmentStrings, GetProcAddress, OpenMutexA, GetStartupInfoA, HeapDestroy, WideCharToMultiByte, SetStdHandle, GetUserDefaultLCID, InterlockedIncrement, GetStdHandle, GetModuleHandleA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetPrivateProfileStringA, UnhandledExceptionFilter, HeapCreate, GetSystemTimeAsFileTime, GetStringTypeA, IsValidLocale, LeaveCriticalSection, WriteFile, FreeLibrary, CreateMutexA, GetStringTypeW, TlsSetValue, EnumSystemLocalesA, ExitProcess, TlsGetValue, SetUnhandledExceptionFilter, InterlockedDecrement, LCMapStringW, GetDateFormatA, GetModuleHandleW, LocalSize, SetWaitableTimer, IsValidCodePage, GetProcessHeaps, Sleep, CompareStringA, GetTickCount, RtlUnwind, DeleteCriticalSection, LockResource, LoadLibraryA, FlushFileBuffers, GetTimeZoneInformation, SetConsoleCtrlHandler, HeapAlloc, GetCurrentProcessId, GetLastError, GetConsoleOutputCP, HeapSize, FillConsoleOutputCharacterA, CloseHandle, SetFilePointer, GetEnvironmentStringsW, GetCurrentProcess, GetLocaleInfoW, SetHandleCount, EnterCriticalSection, GetCPInfo, GetCurrentThreadId, TerminateProcess, QueryPerformanceCounter, GetCurrentThread, VirtualAlloc, VirtualFree, GetConsoleCP, SetLastError, GetFileType, CreateFileA, VirtualQuery, MultiByteToWideChar, SetEnvironmentVariableA, GetACP, WriteConsoleA, LCMapStringA, TlsFree, GetModuleFileNameA, HeapFree, IsDebuggerPresent, TlsAlloc, GetLocaleInfoA, GetWindowsDirectoryA, GetAtomNameW, GetFileTime, GetOEMCP, CompareStringW, GetConsoleMode, InitializeCriticalSectionAndSpinCount
> SHELL32.dll: SheGetDirA
> comctl32.dll: ImageList_DrawIndirect, CreateToolbarEx, ImageList_DrawEx, ImageList_SetDragCursorImage, ImageList_GetImageCount, ImageList_AddIcon, InitMUILanguage, CreatePropertySheetPageW, ImageList_ReplaceIcon, ImageList_Destroy, ImageList_DragShowNolock, GetEffectiveClientRect, InitCommonControlsEx
> USER32.dll: GetUserObjectInformationW, BeginDeferWindowPos, DestroyAcceleratorTable, ActivateKeyboardLayout, GetKeyboardLayoutList, SetWindowLongA, DialogBoxIndirectParamA, RegisterClassA, DefWindowProcW, RegisterClassExA, UnregisterClassA, DrawEdge, CreateWindowExW, EndDeferWindowPos, CascadeChildWindows, DestroyWindow, EnumPropsExA, MessageBoxW, LoadAcceleratorsW, EnumWindowStationsA, DdeSetUserHandle, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, RegisterClassW, ShowWindow, GetGuiResources, EnumDesktopWindows, SetWindowWord
( 0 exports )
packers (Kaspersky): PE_Patch
|
|
24.11.2008, 11:48
Baum-Darstellung