[6DED75]ESPI11.dll

显示全部楼层 · 发表于 2012-6-17 20:26:04

• File Info

Name	Value
Size	2904064
MD5	e59f8f224c6955c40247176d178f995b
SHA1	b257cff3a6bc714fbaab12ce2f60752bd9c3ff20
SHA256	15675ec78a5590e06a433bed2b77c1b84c571edebb4d543ba30955fc8abd7220
Process	Active

• Keys Created

Name	Last Write Time
LM\System\CurrentControlSet\Services\WinSock2\ESPI11	2009.01.09 10:37:30.843

• Values Created

Name	Type	Size	Value
LM\System\CurrentControlSet\Services\WinSock2\ESPI11\1001	REG_BINARY	888	?
LM\System\CurrentControlSet\Services\WinSock2\ESPI11\1002	REG_BINARY	888	?
LM\System\CurrentControlSet\Services\WinSock2\ESPI11\1003	REG_BINARY	888	?
LM\System\CurrentControlSet\Services\WinSock2\ESPI11\1004	REG_BINARY	888	?
LM\System\CurrentControlSet\Services\WinSock2\ESPI11\1005	REG_BINARY	888	?
LM\System\CurrentControlSet\Services\WinSock2\ESPI11\FileName	REG_SZ	62	"C:\WINDOWS\system32\ESPI11.dll"

• Files Created

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\8DIFWPAR\3344dnf[1].htm	161	2009.01.09 10:37:29.406	2009.01.09 10:37:29.406	2009.01.09 10:37:29.406	0x20
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\G12FG5QN\66iu[1].htm	161	2009.01.09 10:37:29.765	2009.01.09 10:37:29.421	2009.01.09 10:37:29.421	0x20
C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\G12FG5QN\kk8yy[1].htm	161	2009.01.09 10:37:29.765	2009.01.09 10:37:29.421	2009.01.09 10:37:29.421	0x20
C:\WINDOWS\system32\ESPI11.dll	122880	2009.01.09 10:37:30.796	2009.01.09 10:37:30.781	2009.01.09 10:37:30.781	0x20

• Files Changed

Name	Size	Last Write Time	Creation Time	Last Access Time	Attr
C:\WINDOWS\system32\config\system	3145728/3145728	2009.01.09 10:33:46.171/2009.01.09 10:37:30.843	2008.08.01 07:59:53.562/2008.08.01 07:59:53.562	2009.01.09 10:22:48.843/2009.01.09 10:22:48.843	0x20/0x20

https://www.virustotal.com/file/6733977939a17dafb2e100c898fd0948095b6b33e8362aebe57ef7ea87db58ab/analysis/1339935697/

显示全部楼层 · 发表于 2012-6-17 20:29:15

大蜘蛛clean，已上报。

显示全部楼层 · 发表于 2012-6-17 20:31:14

to AVG

显示全部楼层 · 发表于 2012-6-17 20:31:52

改winsock的家伙……

显示全部楼层 · 发表于 2012-6-17 20:32:35

ESS没反应

显示全部楼层 · 发表于 2012-6-17 20:38:44

这是网截的一个模块，很多挂用来拦截封包的。嘛—— 灰色软件。

显示全部楼层 · 发表于 2012-6-17 20:44:13

显示全部楼层 · 发表于 2012-6-17 20:47:35

过金山ESS，已上报

显示全部楼层 · 发表于 2012-6-18 10:10:50

FS 扫描没报

显示全部楼层 · 发表于 2012-6-18 22:11:57

360 安全
coranti clean
hitman clean

[病毒样本] [6DED75]ESPI11.dll