s.exe,4f4.exe,8g4.dll,fh8.dll

文件说明符 : C:/WINDOWS/system32/s.exe
属性 : A--R
数字签名:否
PE文件:是
语言 : 中文(中国)
文件版本 : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
说明 : Windows Progman Group Converter
版权 : Copyright Zhongsou(C) 2005
产品版本 : 5.1.2600.2180
产品名称 : Microsoft(R) Windows(R) Operating System
公司名称 : Microsoft Corporation
内部名称 : GrpConv
创建时间 : 2008-8-8 12:9:38
修改时间 : 2008-7-26 9:48:34
大小 : 98304 字节 96.0 KB
MD5 : e989fd3e1b34e9beb26c6d9744143b5e
SHA1: BA27F06F5C76B7DD78D80414ADC9DC97E2647BC0
CRC32: 443ca0a9

文件 s.exe 接收于 2008.09.02 07:56:02 (CET)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.9.2.02008.09.02-
AntiVir7.8.1.232008.09.01-
Authentium5.1.0.42008.09.02-
Avast4.8.1195.02008.09.01-
AVG8.0.0.1612008.09.01-
BitDefender7.22008.09.02-
CAT-QuickHeal9.502008.08.29-
ClamAV0.93.12008.09.02-
DrWeb4.44.0.091702008.09.01-
eSafe7.0.17.02008.09.01-
eTrust-Vet31.6.60622008.09.01-
Ewido4.02008.09.01-
F-Prot4.4.4.562008.09.02-
F-Secure7.60.13501.02008.09.02-
Fortinet3.14.0.02008.09.02-
GData192008.09.02-
IkarusT3.1.1.34.02008.09.02Trojan.Win32.Jhee.V
K7AntiVirus7.10.4352008.09.01-
Kaspersky7.0.0.1252008.09.02-
McAfee53742008.09.01-
Microsoft1.38072008.09.02Trojan:Win32/Jhee.V
NOD32v234062008.09.02-
Norman5.80.022008.09.01-
Panda9.0.0.42008.09.02-
PCTools4.4.2.02008.09.01-
Prevx1V22008.09.02Malware Downloader
Rising20.60.02.002008.09.02-
Sophos4.33.02008.09.02-
Sunbelt3.1.1592.12008.08.30-
Symantec102008.09.02-
TheHacker6.3.0.8.0692008.09.01-
TrendMicro8.700.0.10042008.09.02TROJ_JHEE.BU
VBA323.12.8.42008.09.01-
ViRobot2008.9.1.13592008.09.01-
VirusBuster4.5.11.02008.09.01-
Webwasher-Gateway6.6.22008.09.01-

附加信息
File size: 98304 bytes
MD5...: e989fd3e1b34e9beb26c6d9744143b5e
SHA1..: ba27f06f5c76b7dd78d80414adc9dc97e2647bc0
SHA256: 106ab625564ca6909f70cc3e935530043046c5435275f642c48cdf66a2e02a68
SHA512: be682cd2432cf677db5a1511f8626a2f898e12ec56bd0ca438ab4a38aa143bf1
717e21d0aab5f47121e39bfbc88a9dd8ea8c2b0a1dd6e9573c74880fdae52240
PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40777e
timedatestamp.....: 0x488a8272 (Sat Jul 26 01:48:34 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xea15 0xf000 6.56 bc21b827dc08dc0a38b7f037cbacd830
.rdata 0x10000 0x20a0 0x3000 3.53 5d06b741269a1ab50e725000971ad5b4
.data 0x13000 0x5da8 0x4000 1.80 cf3cbe4050c51c06a50c399959f21f72
.rsrc 0x19000 0x3a8 0x1000 1.01 d4e889dabc877175e20b2ef2f4be76dd

( 2 imports )
> KERNEL32.dll: GetModuleHandleA, GetEnvironmentVariableA, SetStdHandle, IsBadCodePtr, IsBadReadPtr, ReadFile, Sleep, GetLastError, GetModuleFileNameA, GetShortPathNameA, CreateProcessA, CreateDirectoryA, LoadLibraryA, GetProcAddress, FreeLibrary, GetWindowsDirectoryA, GetVersionExA, CloseHandle, CreateToolhelp32Snapshot, Process32First, Process32Next, OpenProcess, MultiByteToWideChar, WideCharToMultiByte, RtlUnwind, RaiseException, GetCommandLineA, GetVersion, ExitProcess, HeapFree, HeapAlloc, HeapReAlloc, TerminateProcess, GetCurrentProcess, LCMapStringA, LCMapStringW, GetCPInfo, HeapSize, GetACP, GetOEMCP, SetUnhandledExceptionFilter, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, WriteFile, VirtualAlloc, IsBadWritePtr, SetFilePointer, FlushFileBuffers, GetStringTypeA, GetStringTypeW
> ADVAPI32.dll: ControlService, RegQueryInfoKeyA, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA, DeleteService, StartServiceA, QueryServiceStatus, CreateServiceA, ChangeServiceConfig2A, RegCreateKeyA, RegSetValueExA, RegCloseKey, OpenSCManagerA, OpenServiceA, CloseServiceHandle, DeregisterEventSource, GetUserNameA, CreateProcessAsUserA, OpenProcessToken

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=09D2F541009E3A18805B016D663C340007832D56
ThreatExpert info: http://www.threatexpert.com/report.aspx?md5=e989fd3e1b34e9beb26c6d9744143b5e

文件说明符 : C:/WINDOWS/system32/4f4.exe
属性 : ---R
数字签名:否
PE文件:是
语言 : 中文(中国)
文件版本 : 7, 0, 6000, 381
说明 : Windows Update Automatic Updates
版权 : Copyright Zhongsou(C) 2005
产品版本 : 7, 0, 6000, 381
产品名称 : Microsoft(R) Windows(R) Operating System
公司名称 : Microsoft Corporation
内部名称 : wuauclt
创建时间 : 2008-8-14 19:39:15
修改时间 : 2008-8-18 9:23:23
大小 : 114688 字节 112.0 KB
MD5 : 7d9d179ed12d26eff1a7c5d2aadc1884
SHA1: 42608AD8247C89CD6C52697AF082FBCA213FA5CC
CRC32: c44ee596

文件 4f4.exe 接收于 2008.09.02 07:51:50 (CET)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.9.2.02008.09.02-
AntiVir7.8.1.232008.09.01-
Authentium5.1.0.42008.09.02-
Avast4.8.1195.02008.09.01Win32:Trojan-gen {Other}
AVG8.0.0.1612008.09.01-
BitDefender7.22008.09.02Trojan.Generic.667569
CAT-QuickHeal9.502008.08.29-
ClamAV0.93.12008.09.02-
DrWeb4.44.0.091702008.09.01-
eSafe7.0.17.02008.09.01-
eTrust-Vet31.6.60622008.09.01-
Ewido4.02008.09.01-
F-Prot4.4.4.562008.09.02-
F-Secure7.60.13501.02008.09.02Trojan.Win32.BHO.gdt
Fortinet3.14.0.02008.09.02-
GData192008.09.02Trojan.Win32.BHO.gdt
IkarusT3.1.1.34.02008.09.02Trojan.Win32.Jhee.V
K7AntiVirus7.10.4352008.09.01-
Kaspersky7.0.0.1252008.09.02Trojan.Win32.BHO.gdt
McAfee53742008.09.01-
Microsoft1.38072008.09.02Trojan:Win32/Jhee.V
NOD32v234062008.09.02a variant of Win32/BHO.NCY
Norman5.80.022008.09.01-
Panda9.0.0.42008.09.02-
PCTools4.4.2.02008.09.01-
Prevx1V22008.09.02Malicious Software
Rising20.60.02.002008.09.02Trojan.Win32.BHO.fef
Sophos4.33.02008.09.02-
Sunbelt3.1.1592.12008.08.30-
Symantec102008.09.02-
TheHacker6.3.0.8.0692008.09.01-
TrendMicro8.700.0.10042008.09.02-
VBA323.12.8.42008.09.01-
ViRobot2008.9.1.13592008.09.01-
VirusBuster4.5.11.02008.09.01-
Webwasher-Gateway6.6.22008.09.01-

附加信息
File size: 114688 bytes
MD5...: 7d9d179ed12d26eff1a7c5d2aadc1884
SHA1..: 42608ad8247c89cd6c52697af082fbca213fa5cc
SHA256: 923b711004868c4b93fda6ded1c75b05097d0ad7901c18a3b9cf4fac21392c06
SHA512: b7873b2bb3169c353aba5657da10e6685adf71bbfac998f330819ed01684757d
c829419cf9105695c7d4aac685a2127868e610e623bc9fba2f31d322dfb9aaff
PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40d7ce
timedatestamp.....: 0x48a8cf0b (Mon Aug 18 01:23:23 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x148a5 0x15000 6.58 9540ea1874c6abf2d0412723de0fd4ef
.rdata 0x16000 0x2636 0x3000 3.92 d3825aad0a09cace49691d3fb795bdfa
.data 0x19000 0x4068 0x2000 3.46 f23487b12d7926a9080d896434f01aac
.rsrc 0x1e000 0x420 0x1000 1.11 7e1601bbdaf4774922a6674fbd7eb714

( 4 imports )
> KERNEL32.dll: ReadFile, CreateFileA, DeviceIoControl, GetModuleHandleA, lstrlenA, MultiByteToWideChar, WideCharToMultiByte, LocalFree, SetEndOfFile, SetStdHandle, IsBadCodePtr, Sleep, GetLastError, GetModuleFileNameA, CreateDirectoryA, GetFileAttributesA, DeleteFileA, CreateProcessA, WaitForSingleObject, CloseHandle, SetFileAttributesA, CopyFileA, GetPrivateProfileStringA, LoadLibraryA, GetProcAddress, GetVersionExA, FreeLibrary, GetWindowsDirectoryA, IsBadReadPtr, GetStringTypeW, GetStringTypeA, FlushFileBuffers, SetFilePointer, IsBadWritePtr, VirtualAlloc, RtlUnwind, RaiseException, GetCommandLineA, GetVersion, ExitProcess, HeapFree, HeapAlloc, HeapReAlloc, TerminateProcess, GetCurrentProcess, LCMapStringA, LCMapStringW, GetCPInfo, HeapSize, GetACP, GetOEMCP, SetUnhandledExceptionFilter, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, WriteFile
> ADVAPI32.dll: RegisterServiceCtrlHandlerA, RegEnumValueA, SetServiceStatus, StartServiceCtrlDispatcherA, ControlService, DeleteService, StartServiceA, QueryServiceStatus, CreateServiceA, ChangeServiceConfig2A, RegCreateKeyA, RegSetValueExA, OpenSCManagerA, OpenServiceA, CloseServiceHandle, DeregisterEventSource, RegQueryInfoKeyA, RegOpenKeyExA, RegCloseKey
> ole32.dll: CoUninitialize, CoGetClassObject, StringFromCLSID, CoInitialize
> OLEAUT32.dll: -

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=1A741BE600E22A09C07901CE1AE8BF0084B630EB

文件说明符 : C:/WINDOWS/system32/8g4.dll
属性 : ---R
数字签名:否
PE文件:是
语言 : 英语(美国)
文件版本 : 6, 0, 2900, 3395
说明 : Internet Extensions for Win32
版权 : Copyright 2007
备注 :
产品版本 : 6, 0, 2900, 3395
产品名称 : Microsoft(R) Windows(R) Operating System
公司名称 : Microsoft Corporation
内部名称 : wininet.dll
创建时间 : 2008-8-16 7:28:49
修改时间 : 2008-8-18 9:24:6
大小 : 53248 字节 52.0 KB
MD5 : 8b0f13a77904747fa97c94ca9d385820
SHA1: DEEA688792B17F0963627910AEFCDEEF1C29A93A
CRC32: 5f208cad

文件 8g4.dll 接收于 2008.09.02 08:03:07 (CET) 结果: 7/36 (19.45%)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.9.2.02008.09.02-
AntiVir7.8.1.232008.09.01ADSPY/Bho.aeu
Authentium5.1.0.42008.09.02-
Avast4.8.1195.02008.09.01-
AVG8.0.0.1612008.09.01-
BitDefender7.22008.09.02Adware.BDSearch.1
CAT-QuickHeal9.502008.08.29-
ClamAV0.93.12008.09.02-
DrWeb4.44.0.091702008.09.01Adware.Sogou.119
eSafe7.0.17.02008.09.01-
eTrust-Vet31.6.60622008.09.01-
Ewido4.02008.09.01-
F-Prot4.4.4.562008.09.02-
F-Secure7.60.13501.02008.09.02-
Fortinet3.14.0.02008.09.02-
GData192008.09.02-
IkarusT3.1.1.34.02008.09.02AdWare.Bdsearch.1
K7AntiVirus7.10.4352008.09.01-
Kaspersky7.0.0.1252008.09.02-
McAfee53742008.09.01-
Microsoft1.38072008.09.02-
NOD32v234062008.09.02-
Norman5.80.022008.09.01-
Panda9.0.0.42008.09.02-
PCTools4.4.2.02008.09.01Adware.WSearch.O
Prevx1V22008.09.02-
Rising20.60.10.002008.09.02-
Sophos4.33.02008.09.02DesktopMedia
Sunbelt3.1.1592.12008.08.30-
Symantec102008.09.02-
TheHacker6.3.0.8.0692008.09.01-
TrendMicro8.700.0.10042008.09.02-
VBA323.12.8.42008.09.01-
ViRobot2008.9.1.13592008.09.01-
VirusBuster4.5.11.02008.09.01-
Webwasher-Gateway6.6.22008.09.01Ad-Spyware.Bho.aeu

附加信息
File size: 53248 bytes
MD5...: 8b0f13a77904747fa97c94ca9d385820
SHA1..: deea688792b17f0963627910aefcdeef1c29a93a
SHA256: 5f98c4e22ab2101045c5f6f50fd03e2b43603b277389ddfeae1b6ab77ab5642d
SHA512: e5f314dbe88bdf68a89a4676cd3459abd8b1c88b42e19318f4489b7a4e57bc5b
3fbf105077ec0c123c6732fa5c8292927518bd3791ce3d3f8627f20d66de4c4a
PEiD..: Armadillo v1.xx - v2.xx
TrID..: File type identification
DirectShow filter (52.6%)
Windows OCX File (32.2%)
Win32 Executable MS Visual C++ (generic) (9.8%)
Win32 Executable Generic (2.2%)
Win32 Dynamic Link Library (generic) (1.9%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10007153
timedatestamp.....: 0x48a8ced7 (Mon Aug 18 01:22:31 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6846 0x7000 6.12 bf6c802cab768d06827795f8a039bd62
.rdata 0x8000 0x1f42 0x2000 5.09 70d66633da7462cc773003a3c24c6e86
.data 0xa000 0x2250 0x1000 1.78 24134641bcf54f63f31c909833171a5e
.rsrc 0xd000 0xed0 0x1000 4.09 d331bda4646b0bb8d6cc9254ce2dea02
.reloc 0xe000 0xef2 0x1000 5.15 2be4cafb06c52c0d0369dbfad86010c7

( 8 imports )
> MFC42.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCRT.dll: memcmp, strlen, strcpy, memset, _access, realloc, malloc, free, _EH_prolog, strcat, strrchr, strncpy, strncmp, __dllonexit, _onexit, _except_handler3, _terminate@@YAXXZ, _initterm, _adjust_fdiv, __1type_info@@UAE@XZ, __CxxFrameHandler, _purecall, _mbslwr, memcpy, sprintf
> KERNEL32.dll: InterlockedDecrement, LocalAlloc, LocalFree, GetModuleHandleA, DeviceIoControl, CreateFileA, CreateDirectoryA, GetTempFileNameA, GetDriveTypeA, SearchPathA, GetFileAttributesA, WaitForSingleObject, SetFileAttributesA, GetVolumeInformationA, OpenMutexA, GetWindowsDirectoryA, GetSystemDirectoryA, CreateProcessA, CloseHandle, GetVersionExA, GetProcessHeap, GetLogicalDrives, lstrcatA, lstrcpyA, LoadLibraryA, GetProcAddress, HeapDestroy, IsDBCSLeadByte, lstrcpynA, lstrcmpiA, LoadLibraryExA, GetLastError, FindResourceA, LoadResource, SizeofResource, FreeLibrary, WideCharToMultiByte, GetShortPathNameA, lstrlenA, MultiByteToWideChar, GetModuleFileNameA, InitializeCriticalSection, DeleteCriticalSection, LeaveCriticalSection, InterlockedIncrement, EnterCriticalSection, CopyFileA, lstrlenW
> USER32.dll: CharNextA
> ADVAPI32.dll: RegEnumValueA, RegCreateKeyExA, RegDeleteValueA, RegCloseKey, RegOpenKeyExA, RegEnumKeyExA, RegSetValueExA, RegQueryInfoKeyA, RegDeleteKeyA, RegCreateKeyA, RegQueryValueA, RegSetValueA, RegSetKeySecurity, RegUnLoadKeyA, RegNotifyChangeKeyValue, CloseServiceHandle, OpenServiceA, OpenSCManagerA, QueryServiceStatus, RegQueryValueExA
> ole32.dll: CoTaskMemAlloc, CoTaskMemRealloc, CoCreateInstance, CoTaskMemFree
> OLEAUT32.dll: -, -, -, -, -, -, -
> MSVCP60.dll: _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, __1_Winit@std@@QAE@XZ, __0_Winit@std@@QAE@XZ, __1Init@ios_base@std@@QAE@XZ, __0Init@ios_base@std@@QAE@XZ, _substr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBE_AV12@II@Z, __8std@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@PBD@Z, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@ABV01@@Z, __Hstd@@YA_AV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@ABV10@0@Z, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, __C@_1___Nullstr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@CAPBDXZ@4DB, __Hstd@@YA_AV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@ABV10@PBD@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer

文件说明符 : C:/WINDOWS/system32/fh8.dll
属性 : ---R
数字签名:否
PE文件:是
语言 : 中文(中国)
文件版本 : 4, 1, 0, 3936
说明 : MS DTC administrative component
版权 : 版权所有 (C) 2006
产品版本 : 4, 1, 0, 3936
产品名称 : Microsoft Distributed Transaction Coordinator
公司名称 : Microsoft Corporation
内部名称 : msdtcui
创建时间 : 2008-8-16 7:28:49
修改时间 : 2008-8-18 9:24:8
大小 : 679936 字节 664.0 KB
MD5 : 5cc9d394a169a062f7ff5a083e1d2f16
SHA1: DA8F216AFD1A4E61DDD93B447BB697520D0AC697
CRC32: 5e40c01c

文件 fh8.dll 接收于 2008.09.02 08:12:20 (CET) 结果: 20/36 (55.56%)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.9.2.02008.09.02-
AntiVir7.8.1.232008.09.01TR/Agent.49152
Authentium5.1.0.42008.09.02-
Avast4.8.1195.02008.09.01Win32:Agent-GRW
AVG8.0.0.1612008.09.01Generic_r.D
BitDefender7.22008.09.02Adware.BDSearch.1
CAT-QuickHeal9.502008.08.29AdWare.BHO.cox (Not a Virus)
ClamAV0.93.12008.09.02-
DrWeb4.44.0.091702008.09.01Adware.Sogou.120
eSafe7.0.17.02008.09.01-
eTrust-Vet31.6.60622008.09.01-
Ewido4.02008.09.01-
F-Prot4.4.4.562008.09.02-
F-Secure7.60.13501.02008.09.02AdWare.Win32.BHO.cox
Fortinet3.14.0.02008.09.02Adware/DesktopMedia
GData192008.09.02Win32:Agent-GRW
IkarusT3.1.1.34.02008.09.02Virus.Win32.Agent.GRW
K7AntiVirus7.10.4352008.09.01Trojan.Win32.Malware.1
Kaspersky7.0.0.1252008.09.02not-a-virus:AdWare.Win32.BHO.cox
McAfee53742008.09.01potentially unwanted program Adware-DesktopMedia
Microsoft1.38072008.09.02Adware:Win32/Rugo
NOD32v234062008.09.02-
Norman5.80.022008.09.01-
Panda9.0.0.42008.09.02-
PCTools4.4.2.02008.09.01-
Prevx1V22008.09.02Worm
Rising20.60.10.002008.09.02AdWare.Win32.Mnless.ahb
Sophos4.33.02008.09.02-
Sunbelt3.1.1592.12008.08.30Adware.Bdsearch
Symantec102008.09.02-
TheHacker6.3.0.8.0692008.09.01-
TrendMicro8.700.0.10042008.09.02-
VBA323.12.8.42008.09.01AdWare.Win32.BHO.cox
ViRobot2008.9.1.13592008.09.01Adware.BHO.679936.D
VirusBuster4.5.11.02008.09.01-
Webwasher-Gateway6.6.22008.09.01Ad-Spyware.BDSearch.1.45

附加信息
File size: 679936 bytes
MD5...: 5cc9d394a169a062f7ff5a083e1d2f16
SHA1..: da8f216afd1a4e61ddd93b447bb697520d0ac697
SHA256: f230b2961b14d6f817312d09786e3b8270eb85571e0f6acfff0e6a9aed56f6ab
SHA512: d73fbdd486596eda659f1f05e9f532496a02f18625ca4c1801cc18811c88024a
2127f14f1f7d2163749c364f920b729ebedd2704792146bdd1e78e97e1759fbb
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (53.1%)
Windows Screen Saver (18.4%)
Win32 Executable Generic (12.0%)
Win32 Dynamic Link Library (generic) (10.6%)
Generic Win/DOS Executable (2.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10044883
timedatestamp.....: 0x48a8ce36 (Mon Aug 18 01:19:50 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x79f76 0x7a000 6.62 daa7ab1749d0349d0d49b08f790012dd
.rdata 0x7b000 0xc4ce 0xd000 4.73 470ce27f912cec8a2fb64d136a712951
.data 0x88000 0x52e2c 0xd000 2.61 31fa3a006582c503094bbf1d8a2c44ce
.rsrc 0xdb000 0x1258 0x2000 3.01 9f55d89a8fd45e9f03a4f5db7ab987b7
.reloc 0xdd000 0xe674 0xf000 5.83 a465aad81a0719d36866c17035df8794

( 9 imports )
> WS2_32.dll: -, -, -
> ole32.dll: CoTaskMemRealloc, CLSIDFromString, CLSIDFromProgID, CoGetClassObject, OleLockRunning, CoTaskMemAlloc, StringFromGUID2, OleUninitialize, OleInitialize, CreateStreamOnHGlobal, CoCreateInstance, CoUninitialize, CoInitialize, CoTaskMemFree
> WININET.dll: InternetOpenA, InternetReadFile, GetUrlCacheEntryInfoA, InternetCrackUrlA, DeleteUrlCacheEntry, InternetConnectA, InternetCloseHandle, HttpOpenRequestA, HttpSendRequestA
> urlmon.dll: URLDownloadToFileA
> KERNEL32.dll: RaiseException, InitializeCriticalSection, DeleteCriticalSection, GetLocalTime, CloseHandle, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, OpenFileMappingA, ReleaseMutex, FlushViewOfFile, WaitForSingleObject, CreateMutexA, FindClose, FindFirstFileA, GetLastError, GetSystemTimeAsFileTime, SetErrorMode, MultiByteToWideChar, GetShortPathNameA, GetTempFileNameA, GetTempPathA, CopyFileA, Sleep, SetFileAttributesA, GetWindowsDirectoryA, DeleteFileA, GetVolumeInformationA, GetSystemDirectoryA, FindNextFileA, lstrcmpA, lstrcatA, lstrcpyA, CreateDirectoryA, GetVersionExA, SetProcessWorkingSetSize, GetCurrentProcess, GetTickCount, InterlockedExchange, GetACP, GetLocaleInfoA, GetThreadLocale, EnterCriticalSection, LeaveCriticalSection, FlushInstructionCache, HeapFree, GetProcessHeap, HeapAlloc, WideCharToMultiByte, InterlockedDecrement, lstrlenA, GetCurrentThreadId, GlobalUnlock, GlobalLock, GlobalAlloc, lstrlenW, MulDiv, InterlockedIncrement, GetModuleFileNameA, SetEvent, GetModuleHandleA, FreeLibrary, SizeofResource, LoadResource, LoadLibraryExA, lstrcmpiA, lstrcpynA, IsDBCSLeadByte, GetProcAddress, LoadLibraryA, CreateThread, OpenEventA, CreateProcessA, WaitForMultipleObjects, CreateEventA, Module32Next, Module32First, CreateToolhelp32Snapshot, GetCurrentDirectoryA, Process32Next, Process32First, ReadFile, CreateFileA, TerminateProcess, DeviceIoControl, VirtualAlloc, VirtualFree, SetFilePointer, WriteFile, SetEndOfFile, GetStdHandle, QueryPerformanceCounter, HeapSize, GetCurrentProcessId, SetUnhandledExceptionFilter, IsBadWritePtr, HeapCreate, FlushFileBuffers, HeapDestroy, TlsGetValue, TlsSetValue, TlsFree, SetLastError, TlsAlloc, GetOEMCP, GetCPInfo, LCMapStringW, LCMapStringA, RemoveDirectoryA, GetCommandLineA, HeapReAlloc, VirtualQuery, GetSystemInfo, VirtualProtect, GetFileAttributesA, GetDriveTypeA, FileTimeToLocalFileTime, FileTimeToSystemTime, ExitProcess, RtlUnwind, SetHandleCount, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, UnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, IsBadReadPtr, IsBadCodePtr, GetTimeZoneInformation, SetStdHandle, GetLocaleInfoW, CompareStringA, CompareStringW, SetEnvironmentVariableA, LocalFree, FindResourceA, GetFullPathNameA
> USER32.dll: GetForegroundWindow, SetForegroundWindow, SystemParametersInfoA, MapWindowPoints, ShowWindow, UpdateWindow, PeekMessageA, GetMessageA, TranslateMessage, DispatchMessageA, EnumWindows, AdjustWindowRectEx, FindWindowExA, PostMessageA, CreateAcceleratorTableA, CharNextA, GetParent, GetClassNameA, RedrawWindow, IsWindow, GetDlgItem, SetFocus, GetFocus, IsChild, GetWindow, DestroyAcceleratorTable, BeginPaint, EndPaint, GetDesktopWindow, InvalidateRgn, InvalidateRect, FillRect, SetCapture, ReleaseCapture, GetSysColor, CreateWindowExA, CallWindowProcA, RegisterWindowMessageA, RegisterClassExA, GetWindowTextLengthA, GetWindowTextA, DefWindowProcA, SetActiveWindow, LoadCursorA, GetClassInfoExA, KillTimer, SetTimer, SetWindowPos, MoveWindow, SetWindowTextA, SendMessageA, GetWindowLongA, SetWindowLongA, DestroyWindow, PostQuitMessage, wsprintfA, SetWindowRgn, ReleaseDC, GetWindowRect, GetClientRect, GetSystemMetrics, LoadImageA, UnregisterClassA, GetDC
> GDI32.dll: CreateRectRgn, GetPixel, RestoreDC, CreateSolidBrush, GetStockObject, GetObjectA, GetDeviceCaps, BitBlt, CreateCompatibleBitmap, DeleteDC, SelectObject, CreateCompatibleDC, CombineRgn, SaveDC, DeleteObject
> ADVAPI32.dll: RegOpenKeyA, RegQueryValueExA, InitializeSecurityDescriptor, RegSetValueExA, RegCreateKeyA, GetUserNameA, RegCreateKeyExA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, RegEnumKeyExA, SetSecurityDescriptorDacl, RegCloseKey
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -

( 8 exports )
Always, CallByControl, GetPlayerVersion, HxcDown, HxcUpdate, RunAD, Stop, playAdh
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=52B62B9300B9F45560080A686AD6A100F0A85D5F


  • 0
    点赞
  • 0
    收藏
  • 0
    评论

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
©️2022 CSDN 皮肤主题:大白 设计师:CSDN官方博客 返回首页
评论
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、C币套餐、付费专栏及课程。

余额充值