关于 穿越火线的 CFSelWorld

十字架的诅咒

自行判断吧   没办法 想玩游戏的就排除就行啦


已确定“CFSelWorld.exe”文件是“MALWARE”。
我们的分析人员将这种威胁命名为“TR/Drop.Autoit.CE.51”。 术语“TR/”指的是能够窥探数据、侵犯您的隐私或对系统进行不需要的修改的特洛伊木马。从版本 7.10.13.10 开始，我们的病毒定义文件(VDF)中将添加这项检测。

防毒	版本	最后更新	结果
AhnLab-V3	2010.10.22.00	2010.10.21	-
AntiVir	7.10.13.15	2010.10.21	TR/Drop.Autoit.CE.51
Antiy-AVL	2.0.3.7	2010.10.22	-
Authentium	5.2.0.5	2010.10.22	-
Avast	4.8.1351.0	2010.10.21	-
Avast5	5.0.594.0	2010.10.21	-
AVG	9.0.0.851	2010.10.21	-
BitDefender	7.2	2010.10.22	-
CAT-QuickHeal	11.00	2010.10.22	-
ClamAV	0.96.2.0-git	2010.10.22	-
Comodo	6471	2010.10.22	-
DrWeb	5.0.2.03300	2010.10.22	-
Emsisoft	5.0.0.50	2010.10.22	-
eSafe	7.0.17.0	2010.10.21	-
eTrust-Vet	36.1.7924	2010.10.21	-
F-Prot	4.6.2.117	2010.10.22	-
F-Secure	9.0.16160.0	2010.10.22	-
Fortinet	4.2.249.0	2010.10.21	-
GData	21	2010.10.22	-
Ikarus	T3.1.1.90.0	2010.10.22	-
Jiangmin	13.0.900	2010.10.21	-
K7AntiVirus	9.66.2805	2010.10.21	-
Kaspersky	7.0.0.125	2010.10.22	-
McAfee	5.400.0.1158	2010.10.22	-
McAfee-GW-Edition	2010.1C	2010.10.21	Heuristic.BehavesLike.Win32.Suspicious.H
Microsoft	1.6301	2010.10.21	-
NOD32	5553	2010.10.21	-
Norman	6.06.10	2010.10.22	W32/Suspicious_Gen2.AZRDW
nProtect	2010-10-21.01	2010.10.21	-
Panda	10.0.2.7	2010.10.21	-
PCTools	7.0.3.5	2010.10.22	-
Prevx	3.0	2010.10.22	-
Rising	22.70.02.05	2010.10.21	-
Sophos	4.58.0	2010.10.22	-
Sunbelt	7115	2010.10.22	-
SUPERAntiSpyware	4.40.0.1006	2010.10.22	Trojan.Agent/Gen-Fooj
Symantec	20101.2.0.161	2010.10.21	-
TheHacker	6.7.0.1.064	2010.10.21	-
TrendMicro	9.120.0.1004	2010.10.22	-
TrendMicro-HouseCall	9.120.0.1004	2010.10.22	-
VBA32	3.12.14.1	2010.10.21	-
ViRobot	2010.9.25.4060	2010.10.22	-
VirusBuster	12.69.11.0	2010.10.21	-

其他信息 显示所有

MD5   : de381debb780a6747294c1720223d1cd

SHA1  : e94b49c863d29c21f23f33e915b7be87fd8f8ee2

SHA256: d19449e18aea20508dd2f845c2c95a0a3b74fd75c1299bd005a1a51c2e624a73

ssdeep: 3072:TjyZOELfgXi7lGUIA8Ap6SJxyvEPYZOwQSnEVR4l1WGzz:CZ56WxKDZdHngGH

File size : 155746 bytes

First seen: 2009-05-20 21:28:31

Last seen : 2010-10-22 04:59:11

TrID: Win32 Executable MS Visual C++ (generic) (65.2%) Win32 Executable Generic (14.7%) Win32 Dynamic Link Library (generic) (13.1%) Generic Win/DOS Executable (3.4%) DOS Executable Generic (3.4%)

sigcheck: publisher....: TENCENT copyright....: ____ (C) 2008 product......: CFSelWord ____ description..: CFSelWord Microsoft _______ original name: CFSelWord.EXE internal name: SelWorld file version.: 4, 1, 2, 2 comments.....: signers......: - signing date.: - verified.....: Unsigned

PEiD: Armadillo v1.71

PEInfo: PE structure information [[ basic data ]] entrypointaddress: 0x124B7 timedatestamp....: 0x49F6B7C5 (Tue Apr 28 08:01:09 2009) machinetype......: 0x14c (I386) [[ 4 section(s) ]] name, viradd, virsiz, rawdsiz, ntropy, md5 .text, 0x1000, 0x1D2B2, 0x1E000, 6.51, 201b0229f27c78f8890bb8f50debd0d1 .rdata, 0x1F000, 0x2286, 0x3000, 4.03, dc5eff79903dd1c9ee2ce9756c5bd531 .data, 0x22000, 0x3A28, 0x2000, 3.70, 5e80d4c4268b75b4dbb6ba3be6a35115 .rsrc, 0x26000, 0x14B0, 0x2000, 4.34, 80bf0292d308f083139f698215e9e05e [[ 5 import(s) ]] KERNEL32.dll: OutputDebugStringA, WritePrivateProfileStringA, GetModuleFileNameA, LoadLibraryA, GetModuleHandleA, Sleep, GetPrivateProfileStringA, CreateThread, GetLastError, FreeLibrary, GlobalFree, GlobalAlloc, GetProcAddress, GetPrivateProfileIntA, CompareStringW, CompareStringA, GetVersionExA, GetUserDefaultLCID, EnumSystemLocalesA, GetLocaleInfoA, IsValidCodePage, IsValidLocale, SetConsoleCtrlHandler, SetEndOfFile, ReadFile, IsBadCodePtr, IsBadReadPtr, GetStringTypeW, GetStringTypeA, SetFilePointer, CreateFileA, InterlockedIncrement, EnterCriticalSection, InitializeCriticalSection, InterlockedExchange, DeleteCriticalSection, LeaveCriticalSection, GetTimeZoneInformation, GetSystemTime, GetLocalTime, RtlUnwind, SetEnvironmentVariableA, GetCurrentDirectoryA, SetCurrentDirectoryA, GetStartupInfoA, GetCommandLineA, GetVersion, ExitProcess, HeapFree, RaiseException, CloseHandle, WideCharToMultiByte, FatalAppExitA, GetCPInfo, GetACP, GetOEMCP, TerminateProcess, GetCurrentProcess, HeapReAlloc, HeapAlloc, HeapSize, GetCurrentThreadId, TlsSetValue, TlsAlloc, TlsFree, SetLastError, TlsGetValue, GetCurrentThread, WriteFile, MultiByteToWideChar, LCMapStringA, LCMapStringW, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, IsBadWritePtr, SetUnhandledExceptionFilter, SetStdHandle, FlushFileBuffers, InterlockedDecrement, GetLocaleInfoW USER32.dll: GetMessageA, DispatchMessageA, TranslateMessage, PostQuitMessage, PostMessageA, TranslateAcceleratorA, MessageBoxA SHELL32.dll: ShellExecuteA gdiplus.dll: GdiplusStartup WSOCK32.dll: -, -, -, -, -

ExifTool: file metadata CharacterSet: Unicode CodeSize: 122880 Comments: CompanyName: TENCENT EntryPoint: 0x124b7 FileDescription: CFSelWord Microsoft FileFlagsMask: 0x003f FileOS: Win32 FileSize: 152 kB FileSubtype: 0 FileType: Win32 EXE FileVersion: 4, 1, 2, 2 FileVersionNumber: 4.1.2.2 ImageVersion: 0.0 InitializedDataSize: 36864 InternalName: SelWorld LanguageCode: Chinese (Simplified) LegalCopyright: (C) 2008 LegalTrademarks: LinkerVersion: 6.0 MIMEType: application/octet-stream MachineType: Intel 386 or later, and compatibles OSVersion: 4.0 ObjectFileType: Executable application OriginalFilename: CFSelWord.EXE PEType: PE32 PrivateBuild: ProductName: CFSelWord ProductVersion: CFSelWord ProductVersionNumber: 4.1.2.2 SpecialBuild: Subsystem: Windows GUI SubsystemVersion: 4.0 TimeStamp: 2009:04:28 10:01:09+02:00 UninitializedDataSize: 0

残奴鹰

回复 1楼 十字架的诅咒 的帖子

暂时围观    没玩过穿越                             

qiao7387

貌似以前卡巴报过...后来就没事儿了！

猪头大队

估计TX会和红伞有接触，并商量如何解决的

sjm666cn

这个是偷窥用户文件的东西

fqcomodo

十字架的诅咒 发表于 2010-10-22 13:09
自行判断吧   没办法 想玩游戏的就排除就行啦

排除吧 误报鰳

挥泪斩情思

今天傍晚我装好红伞后  扫描也是杀穿越  报的名称也是上面那个
直接卸载火线了  反正就平时过过瘾而已  
安全为大
另外   还杀迅雷看看播放器......

tung84

已经接触好了，红伞又说成误报了……

gan1236230

为了游戏 再报也要玩

gcshken

想玩只有排除下了