sysloader

yuyando

Antivirus	Version	Last Update	Result
AhnLab-V3	2008.5.22.1	2008.05.27	-
AntiVir	7.8.0.19	2008.05.27	HEUR/Malware
Authentium	5.1.0.4	2008.05.26	-
Avast	4.8.1195.0	2008.05.27	-
AVG	7.5.0.516	2008.05.26	-
BitDefender	7.2	2008.05.27	-
CAT-QuickHeal	9.50	2008.05.26	-
ClamAV	0.92.1	2008.05.27	-
DrWeb	4.44.0.09170	2008.05.27	-
eSafe	7.0.15.0	2008.05.26	-
eTrust-Vet	31.4.5826	2008.05.27	-
Ewido	4.0	2008.05.27	-
F-Prot	4.4.4.56	2008.05.26	W32/Heuristic-210!Eldorado
F-Secure	6.70.13260.0	2008.05.27	-
Fortinet	3.14.0.0	2008.05.27	-
GData	2.0.7306.1023	2008.05.27	-
Ikarus	T3.1.1.26.0	2008.05.27	Backdoor.Win32.Agent.RK
Kaspersky	7.0.0.125	2008.05.27	-
McAfee	5303	2008.05.26	-
Microsoft	1.3520	2008.05.27	-
NOD32v2	3134	2008.05.27	-
Norman	5.80.02	2008.05.26	-
Panda	9.0.0.4	2008.05.27	Suspicious file
Prevx1	V2	2008.05.27	-
Rising	20.46.12.00	2008.05.27	-
Sophos	4.29.0	2008.05.27	-
Sunbelt	3.0.1123.1	2008.05.17	VIPRE.Suspicious
Symantec	10	2008.05.27	-
TheHacker	6.2.92.320	2008.05.26	-
VBA32	3.12.6.6	2008.05.27	-
VirusBuster	4.3.26:9	2008.05.27	-
Webwasher-Gateway	6.6.2	2008.05.27	Heuristic.Malware

                       

Additional information

File size: 176572 bytes

MD5...: b1c3631b7334f94208a9b8361db9ab43

SHA1..: d6c3fe941ac8dc7eb690f85b5ba6571776a0aed6

SHA256: 237c056772f3fe5f02b826c25532bf791dfac4b6280629f3d43ef4409807d00e

SHA512: 5018e5df4e19b60dddc7a5af549f1cf6553ae77ccc257a4d5d60fae5f4e814e7 9e8cf8d1807851459a3e52588405d49019db7e6b4851faa4167a4f7c84943aff

PEiD..: -

PEInfo: -

packers (F-Prot): PE_Patch, Aspack

[ 本帖最后由 yuyando 于 2008-5-27 20:39 编辑 ]

qigang

RS20.46.12未杀！

allinwonderi

[Found possible security risk]         <W32/Heuristic-210!Eldorado (not disinfectable)>        C:\Documents and Settings\All Users\Documents\Test\sysloader.rar->sysloader.dll->(PE_Patch)->(Aspack)->(Aspack)

---------------------------------------------------------------------
Scan ended:        2008-5-27, 20:44:45
Duration:        0:00:00

Scan result:

Scanned files:                 8
Infected objects:         1
Disinfected objects:         0
Quarantined files:         0
---------------------------------------------------------------------

allinwonderi

MiSS.

wangjay1980

晕 TO KL

yk1234

We received the following archive files:
File ID          Filename         Size (Byte)         Result
25029548          sysloader.rar         172.43 KB         OK

A listing of files contained inside archives alongside their results can be found below:
File ID          Filename         Size (Byte)         Result
25029549          sysloader.dll          180 KB          UNDER ANALYSIS

yunhan123

金山毒霸0

The file 'sysloader.dll' has been determined to be 'MALWARE'. Our analysts named the threat ADSPY/Bho.GS. The term "ADSPY/" denotes adware or spyware. This type of malware is able to change browser settings for example by manipulating registry settings or by using of NTFS-streams. Very often IEexploits are used to manipulate the browserhelp.dll.Detection will be added to our virus definition file (VDF) with one of the next updates. Please note that Avira's proactive heuristic detection module AHeAD detected this threat up front without the latest VDF update as: HEUR/Malware.

BING126

McAfee  MISS