GridService

显示全部楼层 · 发表于 2008-6-28 06:51:55

在C:\Program Files\GridService下，鸽子服务，明目张胆，哈哈，报得很少

AhnLab-V3	2008.5.30.1	2008.06.09	-
AntiVir	7.8.0.55	2008.06.09	-
Authentium	5.1.0.4	2008.06.09	-
Avast	4.8.1195.0	2008.06.09	-
AVG	7.5.0.516	2008.06.09	-
BitDefender	7.2	2008.06.10	-
CAT-QuickHeal	9.50	2008.06.09	-
ClamAV	0.92.1	2008.06.10	-
DrWeb	4.44.0.09170	2008.06.09	-
eSafe	7.0.15.0	2008.06.09	suspicious Trojan/Worm
eTrust-Vet	31.6.5858	2008.06.08	-
Ewido	4.0	2008.06.09	-
F-Prot	4.4.4.56	2008.06.09	-
F-Secure	6.70.13260.0	2008.06.10	-
Fortinet	3.14.0.0	2008.06.10	-
GData	2.0.7306.1023	2008.06.10	-
Ikarus	T3.1.1.26.0	2008.06.10	-
Kaspersky	7.0.0.125	2008.06.10	-
McAfee	5313	2008.06.09	-
Microsoft	1.3604	2008.06.10	-
NOD32v2	3169	2008.06.09	-
Norman	5.80.02	2008.06.09	-
Panda	9.0.0.4	2008.06.09	-
Prevx1	V2	2008.06.10	System Back Door
Rising	20.47.42.00	2008.06.06	-
Sophos	4.30.0	2008.06.10	-
Sunbelt	3.0.1145.1	2008.06.05	-
Symantec	10	2008.06.10	-
TheHacker	6.2.92.341	2008.06.10	-
VBA32	3.12.6.7	2008.06.09	-
VirusBuster	4.3.26:9	2008.06.09	-
Webwasher-Gateway	6.6.2	2008.06.10	-

附加信息

File size: 840192 bytes

MD5...: fdb5b965d0b7bca617565a85781852f6

SHA1..: 2b51238a4c2b51f4b8647142e0c8a7ae2e35b8dd

SHA256: 58f89915fc84cc29c104a2b9c8018441ae419551d498f991698a6f634ca5217d

SHA512: 0771c6efd5b2521d9611c4bd0db5ceea25fff966e77876818c8aa17b66fc37f2
349d9ef7ee02dc612e33c82dad906fc1b7120df5abaed711d00e1c3d5dbedf1f

PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x6b54a0
timedatestamp.....: 0x47623d61 (Fri Dec 14 08:22:57 2007)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x1e8000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x1e9000 0xcd000 0xcc800 7.92 61188105d34280dd68f736b2d897b158
.rsrc 0x2b6000 0x1000 0x600 3.77 e441e00796325a6e48af79314a52b023

( 12 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, ExitProcess
> ADVAPI32.dll: RegCloseKey
> IMAGEHLP.dll: SymCleanup
> iphlpapi.dll: GetIfTable
> NETAPI32.dll: Netbios
> ole32.dll: CoInitialize
> OLEAUT32.dll: -
> SHELL32.dll: SHGetFolderPathA
> USER32.dll: GetMessageA
> VERSION.dll: VerQueryValueA
> WININET.dll: InternetOpenA
> WS2_32.dll: -

( 0 exports )

Prevx info: http://info.prevx.com/aboutprogr ... C895FB2300086490BB7

packers (Kaspersky): UPX

packers (F-Prot): UPX

显示全部楼层 · 发表于 2008-6-28 08:59:18

kav 0

显示全部楼层 · 发表于 2008-6-28 10:09:40

The file 'peer.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.

显示全部楼层 · 发表于 2008-6-28 10:13:01

记得没错得话是fs2you网盘的东西

显示全部楼层 · 发表于 2008-6-28 10:19:54

汗，这个是FS下载的客户端

显示全部楼层 · 发表于 2008-6-28 13:55:07

files2you……

显示全部楼层 · 发表于 2008-6-28 14:02:21

就是RaySource吧，怪不得这么眼熟。

显示全部楼层 · 发表于 2008-6-28 14:06:05

FS客户端程序，之前F-Secure也报过

显示全部楼层 · 发表于 2008-6-28 14:09:10

应该椒RaySource！版主可以锁贴了！

[病毒样本] GridService

本帖子中包含更多资源