Trojan Spy.Win32.Ursnif ....kann ich nicht löschen

sunda

Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.50 2010.03.02 Trojan.SuspectCRC!IK
AhnLab-V3 5.0.0.2 2010.03.02 -
AntiVir 8.2.1.176 2010.03.02 -
Antiy-AVL 2.0.3.7 2010.03.02 -
Authentium 5.2.0.5 2010.03.02 -
Avast 4.8.1351.0 2010.03.02 -
Avast5 5.0.332.0 2010.03.02 -
AVG 9.0.0.730 2010.03.02 -
BitDefender 7.2 2010.03.02 Trojan.Generic.KD.103
CAT-QuickHeal 10.00 2010.03.02 -
ClamAV 0.96.0.0-git 2010.03.02 -
Comodo 4091 2010.02.28 -
DrWeb 5.0.1.12222 2010.03.02 Trojan.Siggen1.4277
eSafe 7.0.17.0 2010.03.01 -
eTrust-Vet 35.2.7335 2010.03.02 -
F-Prot 4.5.1.85 2010.03.02 -
F-Secure 9.0.15370.0 2010.03.02 Gen:Heur.Krypt.5
Fortinet 4.0.14.0 2010.02.28 -
GData 19 2010.03.02 Trojan.Generic.KD.103
Ikarus T3.1.1.80.0 2010.03.02 Trojan.SuspectCRC
Jiangmin 13.0.900 2010.03.02 -
K7AntiVirus 7.10.986 2010.03.01 -
Kaspersky 7.0.0.125 2010.03.02 -
McAfee 5907 2010.03.01 -
McAfee+Artemis 5907 2010.03.01 -
McAfee-GW-Edition 6.8.5 2010.03.02 -
Microsoft 1.5502 2010.03.02 -
NOD32 4908 2010.03.02 -
Norman 6.04.08 2010.03.01 -
nProtect 2009.1.8.0 2010.03.02 -
Panda 10.0.2.2 2010.03.01 Suspicious file
PCTools 7.0.3.5 2010.03.02 -
Prevx 3.0 2010.03.02 -
Rising 22.37.01.04 2010.03.02 -
Sophos 4.50.0 2010.03.02 -
Sunbelt 5716 2010.03.01 -
Symantec 20091.2.0.41 2010.03.02 Suspicious.Insight
TheHacker 6.5.1.7.218 2010.03.02 -
TrendMicro 9.120.0.1004 2010.03.02 TROJ_FAKEAV.VGC
VBA32 3.12.12.2 2010.03.02 -
ViRobot 2010.3.2.2208 2010.03.02 -
VirusBuster 5.0.27.0 2010.03.02 -
weitere Informationen
File size: 39424 bytes
MD5...: 1f9d3a73da0a142c24aea9e257535f57
SHA1..: 7e9d804b46e8eae102068ff1dbc403876be0d42c
SHA256: d1c41f35b7c9d9d9b2eeffd198820cb5fdd8a467fc2cbebcaa7de7c6676b79ea
ssdeep: 768:tanB/9ta1IeuKw7h6JxeUMTLLACk9P5BaVOMzCMOS3XMygY8f:tan9aVuN6J
sR/K5BUOY7OS3XGX

PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3c5f
timedatestamp.....: 0x4b86c43b (Thu Feb 25 18:40:59 2010)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2dec 0x2e00 6.09 9a37f20cae12e95d4a77e3f30fd4086b
.rdata 0x4000 0x206d 0x2200 5.68 316edb3e50bc6b9d212251cc12f75865
.data 0x7000 0x157a0 0x4200 6.12 1bbda29f578d9a8e120e66425601af57
.rsrc 0x1d000 0x380 0x400 2.93 2f42b6496cc95cfe533f403527c7dca7

( 5 imports )
> KERNEL32.dll: ExitProcess, GetSystemTimeAsFileTime, lstrcpyW, GetProcessHeap, lstrlenW, SetFilePointer, SetLastError, TerminateProcess, LocalAlloc, GetLastError, GetModuleHandleA, VirtualFree, VirtualAlloc, GetVersion, GetCommandLineW, GetModuleHandleW, LocalFree, CreateFileA, WriteFile, CloseHandle, SetEvent, GetCPInfo, GetModuleFileNameA, GetCurrentProcess, GetCommandLineA, GetStartupInfoA
> USER32.dll: GetSystemMetrics, ClientToScreen, ShowWindow, TranslateMessage, EndPaint, BeginPaint, SetWindowLongA, GetWindowLongA, GetMessageA, LoadAcceleratorsA, DispatchMessageA, RedrawWindow, PostQuitMessage, RegisterClassW, CreateWindowExA, MessageBoxA
> ADVAPI32.dll: LookupPrivilegeValueW, DeleteService, CreateServiceW, RegQueryValueExA, RegSetValueExW, RegOpenKeyExA, RegCloseKey, GetTokenInformation
> WS2_32.dll: -, -, -, -, -, -, -, -
> MSVCRT.dll: _controlfp, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, fclose, memchr, memcpy, __p__commode, __p__fmode, __set_app_type, _except_handler3, _adjust_fdiv

( 2 exports )
YFAALPOAGN, pfWtgaxKMRCB

RDS...: NSRL Reference Data Set
-
pdfid.: -
trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
sigcheck:
publisher....: IrBXJDKfFt
copyright....: VfaTl
product......: IrBXJDKfFt
description..: EkKweXi
original name: IrBXJDKfFt.exe
internal name: IrBXJDKfFt.exe
file version.: 2.0.0.5
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned