Trojaner-Board - Wahrscheinlich trojaner/wurm verseucht bitte um Hilfe

Hallo,

mein System ist wahrscheinlich mit einem Wurm befallen.... manchmal öffnet sich urplözlich der iexplorer und es wird eine Fake-Virenseite aufgerufen, wo ich natürlich eine angebliche Virensoftware runterladen soll... was ich natürlich nicht gemacht habe.

Habe mit Hilfe von McAffee folgende Trojaner entfernt:

antzom[1].exe
mshtml2.exe
winAB.tmp
xc23[1].exe
xc29[1].exe
xzc37[1].exe

leider installieren sie sich nach ner Zeit wieder neu und alles fängt von vorne an, nur das jetzt die Seite "greencard lottery" und andere komische englischen Seiten aufgerufen werden.

Ich bitte um Hilfe!

Mein HiJack log:

Logfile of HijackThis v1.99.1
Scan saved at 20:38:21, on 17.05.2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WS002XP\System32\smss.exe
C:\WS002XP\system32\winlogon.exe
C:\WS002XP\system32\services.exe
C:\WS002XP\system32\lsass.exe
C:\WS002XP\system32\Ati2evxx.exe
C:\WS002XP\system32\svchost.exe
C:\WS002XP\System32\svchost.exe
C:\WS002XP\system32\Ati2evxx.exe
C:\WS002XP\system32\spoolsv.exe
C:\ACMPClient\ClientSVC.exe
C:\Programme\Gemeinsame Dateien\Acronis\Agent\agent.exe
C:\Programme\Network Associates\Common Framework\FrameworkService.exe
C:\Programme\Network Associates\VirusScan\Mcshield.exe
C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
E:\Programme\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\Programme\NVIDIA Corporation\nTune\nTuneService.exe
C:\WS002XP\system32\svchost.exe
C:\WS002XP\Explorer.EXE
E:\Programme\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
C:\Programme\Network Associates\VirusScan\SHSTAT.EXE
C:\Programme\Network Associates\Common Framework\UpdaterUI.exe
C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe
C:\WS002XP\Mixer.exe
E:\Programme\ICQLite\ICQLite.exe
C:\WS002XP\system32\LVCOMSX.EXE
C:\Programme\Logitech\Video\LogiTray.exe
C:\Programme\ATI Technologies\ATI.ACE\CLI.EXE
C:\Programme\Java\jre1.6.0_01\bin\jusched.exe
C:\Programme\Logitech\Video\FxSvr2.exe
C:\Programme\MSI\Live Update 3\LMonitor.exe
C:\Programme\QuickTime\qttask.exe
E:\Programme\iTunes\iTunesHelper.exe
E:\Programme\Total Recorder\TotRecSched.exe
C:\WS002XP\system32\ctfmon.exe
C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe
C:\Programme\MSN Messenger\msnmsgr.exe
E:\Programme\Spybot - Search & Destroy\TeaTimer.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\ATI Technologies\ATI.ACE\cli.exe
C:\Programme\MSN Messenger\usnsvc.exe
C:\Programme\Internet Explorer\iexplore.exe
E:\Programme\Teamspeak2\TeamSpeak.exe
D:\Games\Steam\Steam.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
E:\Programme\HiJackTHis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cf.icq.com/cf/icq5/0/lost_password.html
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Programme\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Programme\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Programme\Gemeinsame Dateien\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [NVIDIA nTune] "C:\Programme\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [ICQ Lite] "E:\Programme\ICQLite\ICQLite.exe" -minimize
O4 - HKLM\..\Run: [LVCOMSX] C:\WS002XP\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ATICCC] "C:\Programme\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WS002XP\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Programme\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WS002XP\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [TotalRecorderScheduler] "E:\Programme\Total Recorder\TotRecSched.exe"
O4 - HKLM\..\Run: [WindowsUpdate] rundll32.exe "C:\WS002XP\system32\wifgvtoe.dll",realset
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WS002XP\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programme\Logitech\Video\ManifestEngine.exe boot
O4 - HKCU\..\Run: [msnmsgr] "C:\Programme\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] E:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programme\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Programme\Sidebar\sbhelp.dll
O9 - Extra 'Tools' menuitem: Subscribe in Desktop Sidebar - {09FE188B-6E85-479e-9411-51FB2220DF80} - E:\Programme\Sidebar\sbhelp.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20070501/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{12207C45-3FA3-42C8-846D-20BF42E61073}: Domain = hamburg.intranet.lan-professionals.de
O17 - HKLM\System\CCS\Services\Tcpip\..\{12207C45-3FA3-42C8-846D-20BF42E61073}: NameServer = 192.168.2.1,192.168.2.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{12207C45-3FA3-42C8-846D-20BF42E61073}: Domain = hamburg.intranet.lan-professionals.de
O17 - HKLM\System\CS1\Services\Tcpip\..\{12207C45-3FA3-42C8-846D-20BF42E61073}: NameServer = 192.168.2.1,192.168.2.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{12207C45-3FA3-42C8-846D-20BF42E61073}: Domain = hamburg.intranet.lan-professionals.de
O17 - HKLM\System\CS2\Services\Tcpip\..\{12207C45-3FA3-42C8-846D-20BF42E61073}: NameServer = 192.168.2.1,192.168.2.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WS002XP\system32\WPDShServiceObj.dll
O23 - Service: ACMP Client (ACMPClient) - Aagon Consulting GmbH - C:\ACMPClient\ClientSVC.exe
O23 - Service: Acronis Remote Agent (AcronisAgent) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Agent\agent.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WS002XP\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WS002XP\system32\ati2sgag.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Programme\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Programme\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSSQL$PINNACLESYS - Unknown owner - E:\Programme\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe" -sPINNACLESYS (file missing)
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Programme\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Pinnacle Systems - E:\Programme\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WS002XP\system32\PSIService.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite XI.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Programme\SiSoftware\SiSoftware Sandra Lite XI.SP1\RpcSandraSrv.exe
O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - E:\Programme\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE" -i PINNACLESYS (file missing)

escan ergebnis:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Header
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
find.bat Version 2007.05.07.01

Microsoft Windows XP [Version 5.1.2600]
Bootmodus: NORMAL

eScan Version: 9.2.2
Sprache: English
File C:\Programme\Gemeinsame Dateien\Yazzle1162OinAdmin.exe//PE_Patch.PECompact//PecBundle//PECompact infected by "Trojan-Downloader.Win32.PurityScan.eg" Virus! Action Taken: No Action Taken.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infektionsmeldungen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (process.exe)! Action taken: No Action Taken.
System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (reboot.exe)! Action taken: No Action Taken.
System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (swreg.exe)! Action taken: No Action Taken.
System found infected with trojan-downloader.bat.ftp.ab Trojan-Downloader (swsc.exe)! Action taken: No Action Taken.
Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
Object "Possible Fujacks-type Worm" found in File System! Action Taken: No Action Taken.
~~~~~~~~~~~
Dateien
~~~~~~~~~~~
~~~~ Infected files
~~~~~~~~~~~
File C:\WS002XP\system32\wineak32.dll//PE_Patch.PECompact//PecBundle//PECompact infected by "Trojan.Win32.Agent.qt" Virus! Action Taken: No Action Taken.
File C:\WS002XP\system32\wineak32.dll//PE_Patch.PECompact//PecBundle//PECompact infected by "Trojan.Win32.Agent.qt" Virus! Action Taken: No Action Taken.
File C:\WS002XP\system32\wineak32.dll//PE_Patch.PECompact//PecBundle//PECompact infected by "Trojan.Win32.Agent.qt" Virus! Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\mustermann.WS002\Lokale Einstellungen\Temporary Internet Files\Content.IE5\D84QAK97\xc42[1].exe//data0002//PE_Patch.PECompact//PecBundle//PECompact infected by "Trojan-Downloader.Win32.PurityScan.eg" Virus! Action Taken: No Action Taken.
File C:\Programme\Gemeinsame Dateien\Yazzle1162OinAdmin.exe//PE_Patch.PECompact//PecBundle//PECompact infected by "Trojan-Downloader.Win32.PurityScan.eg" Virus! Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Tagged files
~~~~~~~~~~~
File C:\WS002XP\system32\hggfdab.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.jp". Action Taken: No Action Taken.
File C:\WS002XP\system32\hggfdab.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.jp". Action Taken: No Action Taken.
File C:\WS002XP\system32\hggfdab.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.jp". Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\mustermann.WS002\Desktop\SmitfraudFix\Reboot.exe tagged as "not-a-virus:RiskTool.Win32.Reboot.f". Action Taken: No Action Taken.
File C:\WS002XP\system32\ecotrqvv.dll//Virtumonde//PE_Patch.UPX//UPX tagged as "not-a-virus:AdWare.Win32.Virtumonde.ar". Action Taken: No Action Taken.
File C:\WS002XP\system32\efcaxxy.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.jp". Action Taken: No Action Taken.
File C:\WS002XP\system32\hggfdab.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.jp". Action Taken: No Action Taken.
File C:\WS002XP\system32\iifcyyy.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.jp". Action Taken: No Action Taken.
File C:\WS002XP\system32\iifdebx.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.jp". Action Taken: No Action Taken.
File C:\WS002XP\system32\urqnmkl.dll tagged as "not-a-virus:AdWare.Win32.Virtumonde.jp". Action Taken: No Action Taken.
File C:\WS002XP\system32\wifgvtoe.dll//Virtumonde//PE_Patch.UPX//UPX tagged as "not-a-virus:AdWare.Win32.Virtumonde.ar". Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\mustermann.WS002\Desktop\SmitfraudFix\Reboot.exe tagged as "not-a-virus:RiskTool.Win32.Reboot.f". Action Taken: No Action Taken.
File C:\Dokumente und Einstellungen\mustermann.WS002\Lokale Einstellungen\Temporary Internet Files\Content.IE5\CG163TZV\anti4[1].exe tagged as "not-a-virus:AdWare.Win32.Virtumonde.bq". Action Taken: No Action Taken.
~~~~~~~~~~~
~~~~ Offending files
~~~~~~~~~~~
Offending file found: C:\Dokumente und Einstellungen\mustermann.WS002\Desktop\smitfraudfix\process.exe
Offending file found: C:\Dokumente und Einstellungen\mustermann.WS002\Desktop\smitfraudfix\reboot.exe
Offending file found: C:\Dokumente und Einstellungen\mustermann.WS002\Desktop\smitfraudfix\swreg.exe
Offending file found: C:\Dokumente und Einstellungen\mustermann.WS002\Desktop\smitfraudfix\swsc.exe
~~~~~~~~~~~
Ordner
~~~~~~~~~~~
~~~~~~~~~~~
Registry
~~~~~~~~~~~
Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\H !!!
Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\I !!!
Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\J !!!
Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{336bd0e6-b4e1-11db-b39a-0050bf06efdb} !!!
Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a83f7cb6-dfdc-11db-b3d5-0050bf06efdb} !!!
Offending Key found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a83f7cb7-dfdc-11db-b3d5-0050bf06efdb} !!!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Diverses
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~
Prozesse und Module
~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~
Scanfehler
~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~
Hosts-Datei
~~~~~~~~~~~~~~~~~~~~~~
DataBasePath: %SystemRoot%\System32\drivers\etc
C:\WS002XP\System32\drivers\etc\hosts :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Statistiken:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan-Optionen
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Memory Check: Enabled
Registry Check: Enabled
System Folder Check: Enabled
System Area Check: Disabled
Services Check: Enabled
Drive Check: Disabled
All Drive Check :Enabled
All Drive Check :Enabled

Batchstart: 22:01:32,89
Batchende: 22:02:13,82

TotalVirus:

Complete scanning result of "wifgvtoe.dll", received in VirusTotal at 05.17.2007, 21:06:43 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.5.16.1 05.17.2007 no virus found
AntiVir 7.4.0.23 05.17.2007 TR/Spy.Agent.132660
Authentium 4.93.8 05.16.2007 no virus found
Avast 4.7.997.0 05.17.2007 no virus found
AVG 7.5.0.467 05.17.2007 Adware Generic2.BTU
BitDefender 7.2 05.17.2007 no virus found
CAT-QuickHeal 9.00 05.17.2007 AdWare.Virtumonde.ar (Not a Virus)
ClamAV devel-20070416 05.17.2007 Trojan.Packed-7
DrWeb 4.33 05.17.2007 Trojan.Virtumod
eSafe 7.0.15.0 05.17.2007 no virus found
eTrust-Vet 30.7.3639 05.17.2007 no virus found
Ewido 4.0 05.17.2007 no virus found
FileAdvisor 1 05.17.2007 no virus found
Fortinet 2.85.0.0 05.17.2007 suspicious
F-Prot 4.3.2.48 05.16.2007 no virus found
F-Secure 6.70.13030.0 05.17.2007 no virus found
Ikarus T3.1.1.7 05.17.2007 no virus found
Kaspersky 4.0.2.24 05.17.2007 not-a-virus:AdWare.Win32.Virtumonde.ar
McAfee 5033 05.17.2007 no virus found
Microsoft 1.2503 05.17.2007 no virus found
NOD32v2 2274 05.17.2007 no virus found
Norman 5.80.02 05.17.2007 no virus found
Panda 9.0.0.4 05.17.2007 Spyware/Virtumonde
Prevx1 V2 05.17.2007 no virus found
Sophos 4.17.0 05.16.2007 no virus found
Sunbelt 2.2.907.0 05.17.2007 VIPRE.Suspicious
Symantec 10 05.17.2007 Trojan.Vundo
TheHacker 6.1.6.115 05.15.2007 no virus found
VBA32 3.12.0 05.16.2007 AdWare.Win32.Virtumonde.ar
VirusBuster 4.3.7:9 05.17.2007 no virus found
Webwasher-Gateway 6.0.1 05.17.2007 Trojan.Spy.Agent.132660

Aditional Information
File size: 132660 bytes
MD5: ce65dc367c90047bd5d8d490a2203f09
SHA1: a246e8ae11f8190ba276bc17c7a57b32dbbd27fb
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
> Go to: Home Contactar En Español
--------------------------------------------------------------------------------
www.virustotal.com :: ©Hispasec Sistemas 2004-07:: e-mail info@virustotal.com