Trojaner? Brauche Hilfe (XP)

Philipp_1

>>
Lass folgende Dateien bei VirusTotal - Kostenloser online Viren- und Malwarescanner prüfen:
1. c:\windows\system32\runouce.exe
2. c:\dokumente und einstellungen\ko. Songoku 33\Anwendungsdaten\Macromedia\Common\e0de003a19.ex e
3. c:\dokumente und einstellungen\All Users\Anwendungsdaten\SecTaskMan\icn_7040580900063 D11C8EF10054038389C.dll
4. c:\windows\killproc.exe

1. 0 bytes size received / Se ha recibido un archivo vacio
2. weitere Informationen
File size: 3072 bytes
MD5...: 8ad9aea9b765730368e6ac35a488270f
SHA1..: c60468e631d803e047a7b64270cb1fc2066e6911
SHA256: a875aebf20442d3d52de61911e33a7673e59fd0d6507d8e479a4acb2dae7d023
ssdeep: 24:etGSwXoPD0U3Yt2icxshdUr+yknddXq8oqpVAaRBv:68qQb5cxK2ronPXRogB
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10bc
timedatestamp.....: 0x4a255096 (Tue Jun 02 16:17:26 2009)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x33f 0x400 5.55 a8e2c9ce04df746c137fdb209241ce11
.rdata 0x2000 0x54 0x200 0.63 16b4ff9036790e407462d181731d53a4
.data 0x3000 0x94 0x200 1.89 496bf081e93fcf5b7d35ea4d3e768351

( 1 imports )
> KERNEL32.dll: ExitProcess

( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=75270B0700BCFFB00CFD002F5461A500B79BCD14' target='_blank'>ht**tp://info.prevx.com/aboutprogramtext.asp?PX5=75270B0700BCFFB00CFD002F5461A500B79BCD14</a> und gesammt irgendwie 2/41


3. File size: 256 bytes
MD5...: 4343b50745983d26e4a1643c34ca2ab4
SHA1..: 5c322d1c85c395ab65efb2d58c5447d34b76558d
SHA256: d1b206bf913b6531a6633fc5e6888d4a90257ed9b19d569d12b6ade34d9068de
ssdeep: 6:NlmuXF2lBJJcyBLeOrf2MnmvJNdLzlTOlvaYs6WAU:3musBJJXBaOrf2umvJ3f
hOkYZWAU
PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -
PDFiD.: -
RDS...: NSRL Reference Data Set
-

und gesammt 0/41

4. weitere Informationen
File size: 118784 bytes
MD5...: 195ad0a4cc7ed2b574c11071b5fe9911
SHA1..: 86dec6a35887b8213a3760fa83224edf280188e8
SHA256: 5783ff699165129f90d8703992cb2694f2987eb75965307e18e7cb4d7ebbba5e
ssdeep: 1536:CzLf7BpJldYv4WBP5Tp+Hl2jG2pcyfo9lPLzaFxxoFz/tL:m73YEF2xWt36
xxoFZ
PEiD..: Armadillo v1.71
TrID..: File type identification
-
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x64a2
timedatestamp.....: 0x4a0426d9 (Fri May 08 12:34:33 2009)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xe0b0 0xf000 6.45 a40484c57245fede6a3f9edfdb443b7c
.rdata 0x10000 0x3018 0x4000 3.96 e1137fb7c4b31c7d95b16ccbb11ab271
.data 0x14000 0xe5b4 0x8000 3.35 c765d3168396b5c1e72c568318072536
.rsrc 0x23000 0x6d8 0x1000 2.30 008c9083c76867bb351865ab530262a3

( 4 imports )
> KERNEL32.dll: GetCurrentThread, GetCurrentThreadId, WideCharToMultiByte, SetCurrentDirectoryA, FlushFileBuffers, OpenProcess, lstrcmpA, SetEndOfFile, GetModuleFileNameA, GetShortPathNameA, Sleep, LocalAlloc, LocalFree, LoadLibraryA, FreeLibrary, GetSystemDirectoryA, lstrcatA, lstrcpyA, GetVersion, CreateDirectoryA, GetTickCount, FindFirstFileA, FindClose, GetFileAttributesA, GetFullPathNameA, SetLastError, AreFileApisANSI, GetStringTypeW, MultiByteToWideChar, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GetModuleHandleA, GetProcAddress, GetLastError, WriteFile, CreateFileA, CloseHandle, ReadFile, SetFilePointer, CreateMutexA, GetEnvironmentVariableA, FormatMessageA, GetProcessHeap, HeapAlloc, HeapFree, GetDateFormatA, GetTimeFormatA, DeviceIoControl, GetCurrentProcess, GetVersionExA, TerminateProcess, GetStringTypeA, SetUnhandledExceptionFilter, GetEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsW, FreeEnvironmentStringsA, SetStdHandle, GetFileType, GetStdHandle, SetHandleCount, UnhandledExceptionFilter, VirtualAlloc, VirtualFree, HeapCreate, HeapDestroy, GetOEMCP, GetACP, GetCPInfo, TlsGetValue, TlsAlloc, LCMapStringW, LCMapStringA, LeaveCriticalSection, EnterCriticalSection, DeleteCriticalSection, InitializeCriticalSection, RaiseException, ExitProcess, GetCommandLineA, GetStartupInfoA, HeapSize, HeapReAlloc, TlsSetValue, RtlUnwind, InterlockedIncrement, InterlockedDecrement, IsBadCodePtr
> USER32.dll: SendMessageA, FindWindowExA, GetSystemMetrics, GetWindowTextA, GetWindowThreadProcessId, EnumWindows, RedrawWindow, SetCursorPos, GetCursorPos, GetWindowRect, CreateCursor, DestroyCursor, SetSystemCursor, CopyImage, PostThreadMessageA, LoadCursorA
> ADVAPI32.dll: RegOpenKeyExA, RegCloseKey, RegQueryValueExA, GetUserNameA, AdjustTokenPrivileges, LookupPrivilegeValueA, OpenProcessToken, RegOpenKeyA, GetSidSubAuthority, GetSidSubAuthorityCount, GetTokenInformation, GetSecurityDescriptorSacl, SetSecurityDescriptorSacl, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, OpenThreadToken
> SHELL32.dll: SHGetDesktopFolder, SHGetMalloc, SHGetPathFromIDListA

( 0 exports )
PDFiD.: -
RDS...: NSRL Reference Data Set
-

auch 0/40