帮我看看是什么来得(SRE报)

Firewall

API HOOK
Entrypoint Error: LoadLibraryA (Dangerous Level: High,  Hooked by Module: C:\windows\system32\sockspy.dll)

sockspy.dll的名字好象spyware

附件内附SRE Log和sockspy.dll

tracydk

没有任何问题,鉴定完毕

kirk8

应该发到样品区吧

睡眼朦胧

LZ发错地方了

jpzy

呵呵，看这个dll的名字很有问题啊！
sockspy？！

Firewall

File sockspy.dll received on 09.02.2007 04:14:58 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 0/32 (0%)
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 43 and 62 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:        
       
Antivirus         Version         Last Update         Result
AhnLab-V3        2007.9.1.0        2007.09.01        -
AntiVir        7.4.1.66        2007.09.01        -
Authentium        4.93.8        2007.09.01        -
Avast        4.7.1029.0        2007.09.01        -
AVG        7.5.0.484        2007.09.01        -
BitDefender        7.2        2007.09.02        -
CAT-QuickHeal        9.00        2007.09.01        -
ClamAV        0.91.2        2007.09.02        -
DrWeb        4.33        2007.09.01        -
eSafe        7.0.15.0        2007.08.29        -
eTrust-Vet        31.1.5100        2007.08.31        -
Ewido        4.0        2007.09.01        -
FileAdvisor        1        2007.09.02        -
Fortinet        3.11.0.0        2007.09.02        -
F-Prot        4.3.2.48        2007.09.01        -
F-Secure        6.70.13030.0        2007.08.31        -
Ikarus        T3.1.1.12        2007.09.02        -
Kaspersky        4.0.2.24        2007.09.02        -
McAfee        5110        2007.08.31        -
Microsoft        1.2803        2007.09.02        -
NOD32v2        2497        2007.09.01        -
Norman        5.80.02        2007.08.31        -
Panda        9.0.0.4        2007.09.01        -
Prevx1        V2        2007.09.02        -
Rising        19.38.60.00        2007.09.02        -
Sophos        4.21.0        2007.09.02        -
Sunbelt        2.2.907.0        2007.08.31        -
Symantec        10        2007.09.02        -
TheHacker        6.1.9.175        2007.08.31        -
VBA32        3.12.2.3        2007.09.01        -
VirusBuster        4.3.26:9        2007.09.01        -
Webwasher-Gateway        6.0.1        2007.09.01        -

hj5abc

一个dll,不能怎么测试,多引擎又没家报.

这里..
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><sockspy.dll>  []

利用Appinit_DLLs实现DLL注入的,一般都不是什么好东西.
如果lz确定可以不要它,只要用用SRENG把上面那个键值改为空值,删除sockspy.dll,再用sreng或wsyscheck修复一下API就行了.

david_sg

你有没有装过Bitdefender?sockspy.dll是bitdefender里的一个组件。

但是最好确定一下你的这个文件是否被修改过。

[ 本帖最后由 david_sg 于 2007-9-2 12:23 编辑 ]

hj5abc

原帖由 david_sg 于 2007-9-2 12:22 发表
你有没有装过Bitdefender?sockspy.dll是bitdefender里的一个组件。

但是最好确定一下你的这个文件是否被修改过。

原来如此...

Firewall

Bitdefender v10 oem