直接搞定
文件 msts.exe 接收于 2008.09.10 16:44:15 (CET)
当前状态: 正在读取 ... 队列中 等待中 扫描中 完成 未发现 停止
结果: 11/36 (30.56%)
正在读取服务器信息中...
您的文件所排队列位置: ___.
预计开始时间为 ___ 和 ___
之间.
扫描完成前请勿关闭窗口.
目前针对您的文件所进行的扫描进程已停止, 我们将会在稍后恢复.
如果您的等候时间超过 5 分钟, 请重新发送文件.
您的文件目前正在被 VirusTotal 扫描中,
结果将会稍后完成时生成.
您的文件已过期或不存在.
目前服务已停止, 您的文件将会稍后的未知时间内进行扫描 (位置:
). 您可以继续等待回应 (自动读取) 或者在下面的表单内输入您的电子邮件地址, 并按下 "获取", 当扫描完成时, 系统会自动给您发送电子邮件通知.
| 反病毒引擎 | 版本 | 最后更新 | 扫描结果 | | AhnLab-V3 | 2008.9.6.0 | 2008.09.10 | - | | AntiVir | 7.8.1.28 | 2008.09.10 | - | | Authentium | 5.1.0.4 | 2008.09.10 | - | | Avast | 4.8.1195.0 | 2008.09.10 | - | | AVG | 8.0.0.161 | 2008.09.10 | Win32/Naked | | BitDefender | 7.2 | 2008.09.10 | Trojan.Spy.Agent.NTT | | CAT-QuickHeal | 9.50 | 2008.09.10 | - | | ClamAV | 0.93.1 | 2008.09.10 | Trojan.Packed-75 | | DrWeb | 4.44.0.09170 | 2008.09.10 | - | | eSafe | 7.0.17.0 | 2008.09.10 | - | | eTrust-Vet | 31.6.6082 | 2008.09.10 | - | | Ewido | 4.0 | 2008.09.10 | - | | F-Prot | 4.4.4.56 | 2008.09.09 | W32/Heuristic-210!Eldorado | | F-Secure | 8.0.14332.0 | 2008.09.10 | W32/Suspicious_N.gen | | Fortinet | 3.112.0.0 | 2008.09.10 | - | | GData | 19 | 2008.09.10 | Win32:Hupigon-FB | | Ikarus | T3.1.1.34.0 | 2008.09.10 | - | | K7AntiVirus | 7.10.450 | 2008.09.10 | - | | Kaspersky | 7.0.0.125 | 2008.09.10 | - | | McAfee | 5380 | 2008.09.09 | - | | Microsoft | 1.3903 | 2008.09.10 | - | | NOD32v2 | 3429 | 2008.09.09 | - | | Norman | 5.80.02 | 2008.09.10 | W32/Suspicious_N.gen | | Panda | 9.0.0.4 | 2008.09.09 | - | | PCTools | 4.4.2.0 | 2008.09.10 | Packed/NakedPack | | Prevx1 | V2 | 2008.09.10 | - | | Rising | 20.61.22.00 | 2008.09.10 | - | | Sophos | 4.33.0 | 2008.09.10 | Mal/EncPk-BO | | Sunbelt | 3.1.1616.1 | 2008.09.09 | - | | Symantec | 10 | 2008.09.10 | - | | TheHacker | 6.3.0.9.077 | 2008.09.10 | - | | TrendMicro | 8.700.0.1004 | 2008.09.10 | - | | VBA32 | 3.12.8.5 | 2008.09.10 | - | | ViRobot | 2008.9.10.1371 | 2008.09.10 | - | | VirusBuster | 4.5.11.0 | 2008.09.10 | Packed/NakedPack | | Webwasher-Gateway | 6.6.2 | 2008.09.10 | Trojan.Crypt.CFI.Gen |
| 附加信息 | | File size: 521216 bytes | | MD5...: a95dd571ea3c3aff30245cf9cae46d50 | | SHA1..: 7c0bbbe82e221fe383afd30100cffdd68e960574 | | SHA256: 896653eb163858b82c6fb96a5f24673aa3dfed3d0d6f7b7c336cba8ada591752 | SHA512: 90e378a18f0d80f9ad8d7d96c5a7ecded6583602c08faf669904b032b30d7827
8416388ca8158048234bd4f5f145886013e847ed6726fcc2e8969ec71a0b4818 | | PEiD..: - | TrID..: File type identification
Win64 Executable Generic (63.0%)
Win32 Executable MS Visual C++ (generic) (27.7%)
Win32 Executable Generic (6.2%)
Generic Win/DOS Executable (1.4%)
DOS Executable Generic (1.4%) | PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x100645c
timedatestamp.....: 0x41107bc1 (Wed Aug 04 06:01:37 2004)
machinetype.......: 0x14c (I386)
( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x992c 0x9a00 6.57 84463f4198790f16b92c2aefc0d7a62a
.data 0xb000 0x1be4 0x400 4.25 99858e86526942a66950c7139f78a725
.rsrc 0xd000 0x76000 0x75200 7.96 27ea7cfb6a92e2f011ad58167aa2ad86
( 6 imports )
> ADVAPI32.dll: FreeSid, AllocateAndInitializeSid, EqualSid, GetTokenInformation, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueA, RegCloseKey, RegDeleteValueA, RegOpenKeyExA, RegSetValueExA, RegQueryValueExA, RegCreateKeyExA, RegQueryInfoKeyA
> KERNEL32.dll: LocalFree, LocalAlloc, GetLastError, GetCurrentProcess, lstrlenA, GetModuleFileNameA, GetSystemDirectoryA, _lclose, _llseek, _lopen, WritePrivateProfileStringA, GetWindowsDirectoryA, CreateDirectoryA, GetFileAttributesA, ExpandEnvironmentStringsA, lstrcpyA, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, IsDBCSLeadByte, GetShortPathNameA, GetPrivateProfileStringA, GetPrivateProfileIntA, lstrcmpiA, RemoveDirectoryA, FindClose, FindNextFileA, DeleteFileA, SetFileAttributesA, lstrcmpA, FindFirstFileA, FreeResource, GetProcAddress, LoadResource, SizeofResource, FindResourceA, lstrcatA, CloseHandle, WriteFile, SetFilePointer, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, SetCurrentDirectoryA, GetTempFileNameA, ExitProcess, CreateFileA, LoadLibraryExA, lstrcpynA, GetVolumeInformationA, FormatMessageA, GetCurrentDirectoryA, GetVersionExA, GetExitCodeProcess, WaitForSingleObject, CreateProcessA, GetTempPathA, GetSystemInfo, CreateMutexA, SetEvent, CreateEventA, CreateThread, ResetEvent, TerminateThread, GetDriveTypeA, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, ReadFile, LoadLibraryA, GetDiskFreeSpaceA, MulDiv, EnumResourceLanguagesA, FreeLibrary, LockResource
> GDI32.dll: GetDeviceCaps
> USER32.dll: ExitWindowsEx, wsprintfA, CharNextA, CharUpperA, CharPrevA, SetWindowLongA, GetWindowLongA, CallWindowProcA, DispatchMessageA, MsgWaitForMultipleObjects, PeekMessageA, SendMessageA, SetWindowPos, ReleaseDC, GetDC, GetWindowRect, SendDlgItemMessageA, GetDlgItem, SetForegroundWindow, SetWindowTextA, MessageBoxA, DialogBoxIndirectParamA, ShowWindow, EnableWindow, GetDlgItemTextA, EndDialog, GetDesktopWindow, MessageBeep, SetDlgItemTextA, LoadStringA, GetSystemMetrics
> COMCTL32.dll: -
> VERSION.dll: GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA
( 0 exports )
| Norman Sandbox: [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* File length: 521216 bytes.
[ Changes to filesystem ]
* Deletes directory C:\WINDOWS\TEMP\IXP0.TMP.
* Creates directory C:\WINDOWS\TEMP\IXP0.TMP.
* Creates file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
* Deletes file C:\WINDOWS\TEMP\IXP0.TMP\TMP4351$.TMP.
* Creates file C:\WINDOWS\TEMP\IXP0.TMP\2EXEOU~1.EXE.
[ Changes to registry ]
* Accesses Registry key \"HKLM\System\CurrentControlSet\Control\Session Manager\".
* Creates key \"HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\".
* Sets value \"wextract_cleanup0\"=\"rundll32.exe C:\WINDOWS\SYSTEM32\advpack.dll,DelNodeRunDLL32 \"C:\WINDOWS\TEMP\IXP0.TMP\\"\" in key \"HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\".
[ Process/window information ]
* Creates process \"2EXEOU~1.EXE\".
| | packers (F-Prot): CAB, Nakedpack, SVKProtector | | packers (Kaspersky): NakedPack, SVKP |
[ 本帖最后由 wangjay1980 于 2008-9-10 22:50 编辑 ] |
发表于 2008-9-10 22:25:11
过了几个主流的 
发表于 2008-9-10 22:29:32
