Bitte um Hilfe - Trojaner gefunden!

baerliner

Hallo,

ja das habe ich auch bemerkt das mein System verseucht ist. Das Löschen der verdächtigen Programme geht nicht im Win-betrieb. Abgesicherter Modus kann nicht gestartet werden. Evtl. von Bart XPE booten und von dort aus versuchen zu löschen?

Kaspersky schlägt bei folgenden Alarm:

13.10.2009 10:22:24 Verwendung von Systemfunktionen (DNS) zum heimlichen Senden von Daten an eine Netzwerkadresse jsactivity.com Verboten: KLPrivileges/KLPermissionSystem/KLPermissionHiddenNetAct/KLUseDNS

13.10.2009 10:16:55 Verwendung von Systemfunktionen (DNS) zum heimlichen Senden von Daten an eine Netzwerkadresse bfkq.com Verboten: KLPrivileges/KLPermissionSystem/KLPermissionHiddenNetAct/KLUseDNS

Servises.exe konnte ich manuell löschen. bei virustotal wurden keine ergebnisse gefunden.

Virus Total:
- überprüfen der Datei fastnetsry.exe

Datei FastNetSrv.exe empfangen 2009.10.13 08:34:48 (UTC)
Status: Laden ... Überprüfung Beendet Ergebnis: 7/41 (17.08%)

BitDefender 7.2 2009.10.13 Gen:Trojan.Heur.fG0@SsKHqIfb
Comodo 2591 2009.10.13 Backdoor.Win32.Refpron.~B
GData 19 2009.10.13 Gen:Trojan.Heur.fG0@SsKHqIfb
McAfee-GW-Edition 6.8.5 2009.10.13 Heuristic.LooksLike.Trojan.Backdoor.Delf.H
NOD32 4501 2009.10.12 a variant of Win32/Refpron.AF
Rising 21.51.12.00 2009.10.13 Backdoor.Win32.Meb.a

weitere Informationen
File size: 95232 bytes
MD5...: 665cc98c05a439f2370852cdb0b77f52
SHA1..: ea98ff389e3cf9145f52dbc0efc51f2b26572cfe
SHA256: fc6c307e68ebe1c61c534834c100f273245cc39cf6bca81b662139f9434c6077
ssdeep: 1536:75qDEOZN6zD2Fu/lXG7sTzORP6rLxWjSW3fODDwo6UuPhl9o:sw7863ENmH
wNll9o
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x13228
timedatestamp.....: 0xc0d875e6L (invalid)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x12280 0x12400 6.43 f4055a75993aa7f9f33916591ac13179
DATA 0x14000 0x794 0x800 4.24 d3529d8e031288af6791b5e33da740f3
BSS 0x15000 0xb3d 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0x16000 0x8a2 0xa00 4.25 e045a960aa991b87dfa5196ca11451eb
.tls 0x17000 0xc 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rdata 0x18000 0x18 0x200 0.20 3668967f26843d0bc049b1b675038ba5
.reloc 0x19000 0x19ec 0x1a00 6.67 99cff54aac5fff381b217a3188e1e1a5
.rsrc 0x1b000 0x6c00 0x1e00 5.02 716065761efedfa3c6612e36c0d38003

( 7 imports )
> kernel32.dll: GetCurrentThreadId, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, lstrcpyA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
> user32.dll: GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
> advapi32.dll: RegQueryValueExA, RegOpenKeyExA, RegCloseKey
> oleaut32.dll: VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysFreeString, SysReAllocStringLen, SysAllocStringLen
> kernel32.dll: TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA, GetModuleFileNameA
> kernel32.dll: WriteFile, WaitForSingleObject, VirtualQuery, SetFilePointer, SetEndOfFile, ReadFile, LoadLibraryExW, LeaveCriticalSection, InitializeCriticalSection, GetVersionExA, GetThreadLocale, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetDiskFreeSpaceA, GetCurrentThreadId, GetCPInfo, FormatMessageA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateFileA, CreateEventA, CompareStringA, CloseHandle
> user32.dll: MessageBoxA, LoadStringA, GetSystemMetrics, DestroyWindow

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (38.4%)
Win32 Dynamic Link Library (generic) (34.1%)
Win16/32 Executable Delphi generic (9.3%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
sigcheck:
publisher....: Sigma Designs Inc
copyright....: n/a
product......: Swap Filter
description..: Sigma Designs PCM Swap Filter
original name: n/a
internal name: n/a
file version.: 5. 3. 174
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned


Datei sc.exe empfangen 2009.10.13 08:40:53 (UTC)
Status:Überprüfung Beendet
Ergebnis: 10/41 (24.4%)

a-squared 4.5.0.41 2009.10.13 Trojan.Win32.Vilsel.gyl!A2
AntiVir 7.9.1.35 2009.10.13 HEUR/Malware
BitDefender 7.2 2009.10.13 Gen:Trojan.Heur.wmGfvPZhUQhOx
CAT-QuickHeal 10.00 2009.10.12 Trojan.Agent.ATV
eSafe 7.0.17.0 2009.10.12 Suspicious File
GData 19 2009.10.13 Gen:Trojan.Heur.wmGfvPZhUQhOx
McAfee 5769 2009.10.12 Generic.dx!fma
McAfee-GW-Edition 6.8.5 2009.10.13 Heuristic.LooksLike.Win32.Suspicious.C!81
NOD32 4501 2009.10.12 Win32/TrojanDownloader.FakeAlert.AKC

weitere Informationen
File size: 364032 bytes
MD5...: 7ea85666197e711f828ee2458f4c084f
SHA1..: 9afc55518adb3d6f33bb50f1f801f231b2eff8e0
SHA256: 77e8b6d9fac205847c0d2de532b52fb0241146eae8b0c10bfde3fe87310e4037
ssdeep: 61442YpeaSMZoLTrlCE8AIoYCeZwirzNcppFS90J/5DmpID72KVrYtJJ1e3F
9mIEOBR2VS9EBDmoEtDk
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xc34e0
timedatestamp.....: 0xc0d875e6L (invalid)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x6d000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x6e000 0x56000 0x55800 7.91 96e0326e060b2c404ce066154b4e0eb0
.rsrc 0xc4000 0x8000 0x3200 3.91 ac1521edaa632bd71635faa666a8d7a4

( 11 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> advapi32.dll: RegFlushKey
> comctl32.dll: ImageList_Add
> gdi32.dll: SaveDC
> ole32.dll: IsEqualGUID
> oleaut32.dll: VariantClear
> shell32.dll: Shell_NotifyIconA
> user32.dll: GetDC
> version.dll: VerQueryValueA
> winmm.dll: PlaySoundA
> winspool.drv: OpenPrinterA

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: UPX compressed Win32 Executable (38.5%)
Win32 EXE Yoda's Crypter (33.4%)
Win32 Executable Generic (10.7%)
Win32 Dynamic Link Library (generic) (9.5%)
Win16/32 Executable Delphi generic (2.6%)
packers (F-Prot): UPX
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
packers (Kaspersky): PE_Patch.UPX, UPX


Datei 5ED29D8100A0611B70260072A07F03000287AE6A.dll empfangen 2009.10.10 23:27:21 (UTC)
Status: Beendet
Ergebnis: 4/41 (9.76%)
(msxn193z.dll)

Authentium 5.1.2.4 2009.10.10 W32/Bongler-based!Maximus
F-Prot 4.5.1.85 2009.10.10 W32/Bongler-based!Maximus
Prevx 3.0 2009.10.11 Medium Risk Malware
Sophos 4.45.0 2009.10.10 Mal/Behav-170

weitere Informationen
File size: 28672 bytes
MD5 : adac7828ff7e3fb6ee9c799ef19879ac
SHA1 : 9785c2cdcbc4f71c7a84e9ce65a2f84d9906e49c
SHA256: 6fc70d5495ff9aa0b5e9ee913278ec541e06dd7999067fe5f9f0353a11f700b6
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x2D05
timedatestamp.....: 0x4AD08192 (Sat Oct 10 14:44:02 2009)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1DC2 0x2000 6.28 75c752e7873e62790fbad1d5ddd98f6a
.rdata 0x3000 0x6BE 0x1000 2.67 0abf9f7c1f1188ad973f9c718810859a
.data 0x4000 0x3F7C 0x1000 0.57 671322569a747718456c0a933153acc7
.rsrc 0x8000 0x360 0x1000 0.89 d77a9cf7943ccb6f469e695c5441c97e
.reloc 0x9000 0x226 0x1000 0.96 11edbda599217f3ffbb18beac7f3594e

( 5 imports )

> advapi32.dll: LookupPrivilegeValueA, RegOpenKeyExA, AdjustTokenPrivileges, OpenProcessToken, RegQueryValueExA, RegSetValueExA, RegCreateKeyA, RegCloseKey
> kernel32.dll: CreateThread, CloseHandle, GetCurrentProcess, GetCurrentDirectoryA, GlobalUnlock, GlobalLock, SetCurrentDirectoryA, Sleep, GetModuleHandleA, GetProcAddress, GetSystemInfo, lstrcmpiA, GetVersionExA, GetModuleFileNameA
> msvcrt.dll: _stricmp, _strlwr, _adjust_fdiv, malloc, _initterm, free, _splitpath, _ftol, fopen, fseek, fread, fclose, strstr, __2@YAPAXI@Z, __3@YAXPAX@Z, sprintf, _except_handler3, _itoa
> user32.dll: OpenClipboard, SetWindowsHookExA, wsprintfA, CharLowerA, GetSystemMetrics, CloseClipboard, GetClipboardData, EnumClipboardFormats, GetMessageA, CallNextHookEx, GetClientRect, DispatchMessageA, TranslateMessage
> wininet.dll: InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle

( 1 exports )

> AR, GetVer, w
TrID : File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 384:9sN8NjIibONdrz6DqsVp+xKWdyGeissK:WN8NsibWdHogdVel
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=5ED29D8100A0611B70260072A07F03000287AE6A
PEiD : -
RDS : NSRL Reference Data Set