程序博客网 > mr.ace homme 知乎

s.exe,4f4.exe,8g4.dll,fh8.dll

来源：互联网 发布：mr.ace homme 知乎 编辑：程序博客网 时间：2024/04/30 23:14

文件说明符 : C:/WINDOWS/system32/s.exe
属性 : A--R
数字签名:否
PE文件:是
语言 : 中文(中国)
文件版本 : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
说明 : Windows Progman Group Converter
版权 : Copyright Zhongsou(C) 2005
产品版本 : 5.1.2600.2180
产品名称 : Microsoft(R) Windows(R) Operating System
公司名称 : Microsoft Corporation
内部名称 : GrpConv
创建时间 : 2008-8-8 12:9:38
修改时间 : 2008-7-26 9:48:34
大小 : 98304 字节 96.0 KB
MD5 : e989fd3e1b34e9beb26c6d9744143b5e
SHA1: BA27F06F5C76B7DD78D80414ADC9DC97E2647BC0
CRC32: 443ca0a9

文件 s.exe 接收于 2008.09.02 07:56:02 (CET)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.9.2.02008.09.02-
AntiVir7.8.1.232008.09.01-
Authentium5.1.0.42008.09.02-
Avast4.8.1195.02008.09.01-
AVG8.0.0.1612008.09.01-
BitDefender7.22008.09.02-
CAT-QuickHeal9.502008.08.29-
ClamAV0.93.12008.09.02-
DrWeb4.44.0.091702008.09.01-
eSafe7.0.17.02008.09.01-
eTrust-Vet31.6.60622008.09.01-
Ewido4.02008.09.01-
F-Prot4.4.4.562008.09.02-
F-Secure7.60.13501.02008.09.02-
Fortinet3.14.0.02008.09.02-
GData192008.09.02-
IkarusT3.1.1.34.02008.09.02Trojan.Win32.Jhee.V
K7AntiVirus7.10.4352008.09.01-
Kaspersky7.0.0.1252008.09.02-
McAfee53742008.09.01-
Microsoft1.38072008.09.02Trojan:Win32/Jhee.V
NOD32v234062008.09.02-
Norman5.80.022008.09.01-
Panda9.0.0.42008.09.02-
PCTools4.4.2.02008.09.01-
Prevx1V22008.09.02Malware Downloader
Rising20.60.02.002008.09.02-
Sophos4.33.02008.09.02-
Sunbelt3.1.1592.12008.08.30-
Symantec102008.09.02-
TheHacker6.3.0.8.0692008.09.01-
TrendMicro8.700.0.10042008.09.02TROJ_JHEE.BU
VBA323.12.8.42008.09.01-
ViRobot2008.9.1.13592008.09.01-
VirusBuster4.5.11.02008.09.01-
Webwasher-Gateway6.6.22008.09.01-

附加信息
File size: 98304 bytes
MD5...: e989fd3e1b34e9beb26c6d9744143b5e
SHA1..: ba27f06f5c76b7dd78d80414adc9dc97e2647bc0
SHA256: 106ab625564ca6909f70cc3e935530043046c5435275f642c48cdf66a2e02a68
SHA512: be682cd2432cf677db5a1511f8626a2f898e12ec56bd0ca438ab4a38aa143bf1
717e21d0aab5f47121e39bfbc88a9dd8ea8c2b0a1dd6e9573c74880fdae52240
PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40777e
timedatestamp.....: 0x488a8272 (Sat Jul 26 01:48:34 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xea15 0xf000 6.56 bc21b827dc08dc0a38b7f037cbacd830
.rdata 0x10000 0x20a0 0x3000 3.53 5d06b741269a1ab50e725000971ad5b4
.data 0x13000 0x5da8 0x4000 1.80 cf3cbe4050c51c06a50c399959f21f72
.rsrc 0x19000 0x3a8 0x1000 1.01 d4e889dabc877175e20b2ef2f4be76dd

( 2 imports )
> KERNEL32.dll: GetModuleHandleA, GetEnvironmentVariableA, SetStdHandle, IsBadCodePtr, IsBadReadPtr, ReadFile, Sleep, GetLastError, GetModuleFileNameA, GetShortPathNameA, CreateProcessA, CreateDirectoryA, LoadLibraryA, GetProcAddress, FreeLibrary, GetWindowsDirectoryA, GetVersionExA, CloseHandle, CreateToolhelp32Snapshot, Process32First, Process32Next, OpenProcess, MultiByteToWideChar, WideCharToMultiByte, RtlUnwind, RaiseException, GetCommandLineA, GetVersion, ExitProcess, HeapFree, HeapAlloc, HeapReAlloc, TerminateProcess, GetCurrentProcess, LCMapStringA, LCMapStringW, GetCPInfo, HeapSize, GetACP, GetOEMCP, SetUnhandledExceptionFilter, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, WriteFile, VirtualAlloc, IsBadWritePtr, SetFilePointer, FlushFileBuffers, GetStringTypeA, GetStringTypeW
> ADVAPI32.dll: ControlService, RegQueryInfoKeyA, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA, DeleteService, StartServiceA, QueryServiceStatus, CreateServiceA, ChangeServiceConfig2A, RegCreateKeyA, RegSetValueExA, RegCloseKey, OpenSCManagerA, OpenServiceA, CloseServiceHandle, DeregisterEventSource, GetUserNameA, CreateProcessAsUserA, OpenProcessToken

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=09D2F541009E3A18805B016D663C340007832D56
ThreatExpert info: http://www.threatexpert.com/report.aspx?md5=e989fd3e1b34e9beb26c6d9744143b5e

文件说明符 : C:/WINDOWS/system32/4f4.exe
属性 : ---R
数字签名:否
PE文件:是
语言 : 中文(中国)
文件版本 : 7, 0, 6000, 381
说明 : Windows Update Automatic Updates
版权 : Copyright Zhongsou(C) 2005
产品版本 : 7, 0, 6000, 381
产品名称 : Microsoft(R) Windows(R) Operating System
公司名称 : Microsoft Corporation
内部名称 : wuauclt
创建时间 : 2008-8-14 19:39:15
修改时间 : 2008-8-18 9:23:23
大小 : 114688 字节 112.0 KB
MD5 : 7d9d179ed12d26eff1a7c5d2aadc1884
SHA1: 42608AD8247C89CD6C52697AF082FBCA213FA5CC
CRC32: c44ee596

文件 4f4.exe 接收于 2008.09.02 07:51:50 (CET)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.9.2.02008.09.02-
AntiVir7.8.1.232008.09.01-
Authentium5.1.0.42008.09.02-
Avast4.8.1195.02008.09.01Win32:Trojan-gen {Other}
AVG8.0.0.1612008.09.01-
BitDefender7.22008.09.02Trojan.Generic.667569
CAT-QuickHeal9.502008.08.29-
ClamAV0.93.12008.09.02-
DrWeb4.44.0.091702008.09.01-
eSafe7.0.17.02008.09.01-
eTrust-Vet31.6.60622008.09.01-
Ewido4.02008.09.01-
F-Prot4.4.4.562008.09.02-
F-Secure7.60.13501.02008.09.02Trojan.Win32.BHO.gdt
Fortinet3.14.0.02008.09.02-
GData192008.09.02Trojan.Win32.BHO.gdt
IkarusT3.1.1.34.02008.09.02Trojan.Win32.Jhee.V
K7AntiVirus7.10.4352008.09.01-
Kaspersky7.0.0.1252008.09.02Trojan.Win32.BHO.gdt
McAfee53742008.09.01-
Microsoft1.38072008.09.02Trojan:Win32/Jhee.V
NOD32v234062008.09.02a variant of Win32/BHO.NCY
Norman5.80.022008.09.01-
Panda9.0.0.42008.09.02-
PCTools4.4.2.02008.09.01-
Prevx1V22008.09.02Malicious Software
Rising20.60.02.002008.09.02Trojan.Win32.BHO.fef
Sophos4.33.02008.09.02-
Sunbelt3.1.1592.12008.08.30-
Symantec102008.09.02-
TheHacker6.3.0.8.0692008.09.01-
TrendMicro8.700.0.10042008.09.02-
VBA323.12.8.42008.09.01-
ViRobot2008.9.1.13592008.09.01-
VirusBuster4.5.11.02008.09.01-
Webwasher-Gateway6.6.22008.09.01-

附加信息
File size: 114688 bytes
MD5...: 7d9d179ed12d26eff1a7c5d2aadc1884
SHA1..: 42608ad8247c89cd6c52697af082fbca213fa5cc
SHA256: 923b711004868c4b93fda6ded1c75b05097d0ad7901c18a3b9cf4fac21392c06
SHA512: b7873b2bb3169c353aba5657da10e6685adf71bbfac998f330819ed01684757d
c829419cf9105695c7d4aac685a2127868e610e623bc9fba2f31d322dfb9aaff
PEiD..: Armadillo v1.71
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40d7ce
timedatestamp.....: 0x48a8cf0b (Mon Aug 18 01:23:23 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x148a5 0x15000 6.58 9540ea1874c6abf2d0412723de0fd4ef
.rdata 0x16000 0x2636 0x3000 3.92 d3825aad0a09cace49691d3fb795bdfa
.data 0x19000 0x4068 0x2000 3.46 f23487b12d7926a9080d896434f01aac
.rsrc 0x1e000 0x420 0x1000 1.11 7e1601bbdaf4774922a6674fbd7eb714

( 4 imports )
> KERNEL32.dll: ReadFile, CreateFileA, DeviceIoControl, GetModuleHandleA, lstrlenA, MultiByteToWideChar, WideCharToMultiByte, LocalFree, SetEndOfFile, SetStdHandle, IsBadCodePtr, Sleep, GetLastError, GetModuleFileNameA, CreateDirectoryA, GetFileAttributesA, DeleteFileA, CreateProcessA, WaitForSingleObject, CloseHandle, SetFileAttributesA, CopyFileA, GetPrivateProfileStringA, LoadLibraryA, GetProcAddress, GetVersionExA, FreeLibrary, GetWindowsDirectoryA, IsBadReadPtr, GetStringTypeW, GetStringTypeA, FlushFileBuffers, SetFilePointer, IsBadWritePtr, VirtualAlloc, RtlUnwind, RaiseException, GetCommandLineA, GetVersion, ExitProcess, HeapFree, HeapAlloc, HeapReAlloc, TerminateProcess, GetCurrentProcess, LCMapStringA, LCMapStringW, GetCPInfo, HeapSize, GetACP, GetOEMCP, SetUnhandledExceptionFilter, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, WriteFile
> ADVAPI32.dll: RegisterServiceCtrlHandlerA, RegEnumValueA, SetServiceStatus, StartServiceCtrlDispatcherA, ControlService, DeleteService, StartServiceA, QueryServiceStatus, CreateServiceA, ChangeServiceConfig2A, RegCreateKeyA, RegSetValueExA, OpenSCManagerA, OpenServiceA, CloseServiceHandle, DeregisterEventSource, RegQueryInfoKeyA, RegOpenKeyExA, RegCloseKey
> ole32.dll: CoUninitialize, CoGetClassObject, StringFromCLSID, CoInitialize
> OLEAUT32.dll: -

( 0 exports )
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=1A741BE600E22A09C07901CE1AE8BF0084B630EB

文件说明符 : C:/WINDOWS/system32/8g4.dll
属性 : ---R
数字签名:否
PE文件:是
语言 : 英语(美国)
文件版本 : 6, 0, 2900, 3395
说明 : Internet Extensions for Win32
版权 : Copyright 2007
备注 :
产品版本 : 6, 0, 2900, 3395
产品名称 : Microsoft(R) Windows(R) Operating System
公司名称 : Microsoft Corporation
内部名称 : wininet.dll
创建时间 : 2008-8-16 7:28:49
修改时间 : 2008-8-18 9:24:6
大小 : 53248 字节 52.0 KB
MD5 : 8b0f13a77904747fa97c94ca9d385820
SHA1: DEEA688792B17F0963627910AEFCDEEF1C29A93A
CRC32: 5f208cad

文件 8g4.dll 接收于 2008.09.02 08:03:07 (CET) 结果: 7/36 (19.45%)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.9.2.02008.09.02-
AntiVir7.8.1.232008.09.01ADSPY/Bho.aeu
Authentium5.1.0.42008.09.02-
Avast4.8.1195.02008.09.01-
AVG8.0.0.1612008.09.01-
BitDefender7.22008.09.02Adware.BDSearch.1
CAT-QuickHeal9.502008.08.29-
ClamAV0.93.12008.09.02-
DrWeb4.44.0.091702008.09.01Adware.Sogou.119
eSafe7.0.17.02008.09.01-
eTrust-Vet31.6.60622008.09.01-
Ewido4.02008.09.01-
F-Prot4.4.4.562008.09.02-
F-Secure7.60.13501.02008.09.02-
Fortinet3.14.0.02008.09.02-
GData192008.09.02-
IkarusT3.1.1.34.02008.09.02AdWare.Bdsearch.1
K7AntiVirus7.10.4352008.09.01-
Kaspersky7.0.0.1252008.09.02-
McAfee53742008.09.01-
Microsoft1.38072008.09.02-
NOD32v234062008.09.02-
Norman5.80.022008.09.01-
Panda9.0.0.42008.09.02-
PCTools4.4.2.02008.09.01Adware.WSearch.O
Prevx1V22008.09.02-
Rising20.60.10.002008.09.02-
Sophos4.33.02008.09.02DesktopMedia
Sunbelt3.1.1592.12008.08.30-
Symantec102008.09.02-
TheHacker6.3.0.8.0692008.09.01-
TrendMicro8.700.0.10042008.09.02-
VBA323.12.8.42008.09.01-
ViRobot2008.9.1.13592008.09.01-
VirusBuster4.5.11.02008.09.01-
Webwasher-Gateway6.6.22008.09.01Ad-Spyware.Bho.aeu

附加信息
File size: 53248 bytes
MD5...: 8b0f13a77904747fa97c94ca9d385820
SHA1..: deea688792b17f0963627910aefcdeef1c29a93a
SHA256: 5f98c4e22ab2101045c5f6f50fd03e2b43603b277389ddfeae1b6ab77ab5642d
SHA512: e5f314dbe88bdf68a89a4676cd3459abd8b1c88b42e19318f4489b7a4e57bc5b
3fbf105077ec0c123c6732fa5c8292927518bd3791ce3d3f8627f20d66de4c4a
PEiD..: Armadillo v1.xx - v2.xx
TrID..: File type identification
DirectShow filter (52.6%)
Windows OCX File (32.2%)
Win32 Executable MS Visual C++ (generic) (9.8%)
Win32 Executable Generic (2.2%)
Win32 Dynamic Link Library (generic) (1.9%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10007153
timedatestamp.....: 0x48a8ced7 (Mon Aug 18 01:22:31 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x6846 0x7000 6.12 bf6c802cab768d06827795f8a039bd62
.rdata 0x8000 0x1f42 0x2000 5.09 70d66633da7462cc773003a3c24c6e86
.data 0xa000 0x2250 0x1000 1.78 24134641bcf54f63f31c909833171a5e
.rsrc 0xd000 0xed0 0x1000 4.09 d331bda4646b0bb8d6cc9254ce2dea02
.reloc 0xe000 0xef2 0x1000 5.15 2be4cafb06c52c0d0369dbfad86010c7

( 8 imports )
> MFC42.DLL: -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -, -
> MSVCRT.dll: memcmp, strlen, strcpy, memset, _access, realloc, malloc, free, _EH_prolog, strcat, strrchr, strncpy, strncmp, __dllonexit, _onexit, _except_handler3, _terminate@@YAXXZ, _initterm, _adjust_fdiv, __1type_info@@UAE@XZ, __CxxFrameHandler, _purecall, _mbslwr, memcpy, sprintf
> KERNEL32.dll: InterlockedDecrement, LocalAlloc, LocalFree, GetModuleHandleA, DeviceIoControl, CreateFileA, CreateDirectoryA, GetTempFileNameA, GetDriveTypeA, SearchPathA, GetFileAttributesA, WaitForSingleObject, SetFileAttributesA, GetVolumeInformationA, OpenMutexA, GetWindowsDirectoryA, GetSystemDirectoryA, CreateProcessA, CloseHandle, GetVersionExA, GetProcessHeap, GetLogicalDrives, lstrcatA, lstrcpyA, LoadLibraryA, GetProcAddress, HeapDestroy, IsDBCSLeadByte, lstrcpynA, lstrcmpiA, LoadLibraryExA, GetLastError, FindResourceA, LoadResource, SizeofResource, FreeLibrary, WideCharToMultiByte, GetShortPathNameA, lstrlenA, MultiByteToWideChar, GetModuleFileNameA, InitializeCriticalSection, DeleteCriticalSection, LeaveCriticalSection, InterlockedIncrement, EnterCriticalSection, CopyFileA, lstrlenW
> USER32.dll: CharNextA
> ADVAPI32.dll: RegEnumValueA, RegCreateKeyExA, RegDeleteValueA, RegCloseKey, RegOpenKeyExA, RegEnumKeyExA, RegSetValueExA, RegQueryInfoKeyA, RegDeleteKeyA, RegCreateKeyA, RegQueryValueA, RegSetValueA, RegSetKeySecurity, RegUnLoadKeyA, RegNotifyChangeKeyValue, CloseServiceHandle, OpenServiceA, OpenSCManagerA, QueryServiceStatus, RegQueryValueExA
> ole32.dll: CoTaskMemAlloc, CoTaskMemRealloc, CoCreateInstance, CoTaskMemFree
> OLEAUT32.dll: -, -, -, -, -, -, -
> MSVCP60.dll: _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, __1_Winit@std@@QAE@XZ, __0_Winit@std@@QAE@XZ, __1Init@ios_base@std@@QAE@XZ, __0Init@ios_base@std@@QAE@XZ, _substr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QBE_AV12@II@Z, __8std@@YA_NABV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@PBD@Z, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z, __0_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@ABV01@@Z, __Hstd@@YA_AV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@ABV10@0@Z, _append@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z, _npos@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@2IB, __C@_1___Nullstr@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@CAPBDXZ@4DB, __Hstd@@YA_AV_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@0@ABV10@PBD@Z, __1_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAE@XZ, __Tidy@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@AAEX_N@Z, _assign@_$basic_string@DU_$char_traits@D@std@@V_$allocator@D@2@@std@@QAEAAV12@PBDI@Z

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer

文件说明符 : C:/WINDOWS/system32/fh8.dll
属性 : ---R
数字签名:否
PE文件:是
语言 : 中文(中国)
文件版本 : 4, 1, 0, 3936
说明 : MS DTC administrative component
版权 :    版权所有 (C) 2006
产品版本 : 4, 1, 0, 3936
产品名称 : Microsoft Distributed Transaction Coordinator
公司名称 : Microsoft Corporation
内部名称 : msdtcui
创建时间 : 2008-8-16 7:28:49
修改时间 : 2008-8-18 9:24:8
大小 : 679936 字节 664.0 KB
MD5 : 5cc9d394a169a062f7ff5a083e1d2f16
SHA1: DA8F216AFD1A4E61DDD93B447BB697520D0AC697
CRC32: 5e40c01c

文件 fh8.dll 接收于 2008.09.02 08:12:20 (CET) 结果: 20/36 (55.56%)

反病毒引擎版本最后更新扫描结果
AhnLab-V32008.9.2.02008.09.02-
AntiVir7.8.1.232008.09.01TR/Agent.49152
Authentium5.1.0.42008.09.02-
Avast4.8.1195.02008.09.01Win32:Agent-GRW
AVG8.0.0.1612008.09.01Generic_r.D
BitDefender7.22008.09.02Adware.BDSearch.1
CAT-QuickHeal9.502008.08.29AdWare.BHO.cox (Not a Virus)
ClamAV0.93.12008.09.02-
DrWeb4.44.0.091702008.09.01Adware.Sogou.120
eSafe7.0.17.02008.09.01-
eTrust-Vet31.6.60622008.09.01-
Ewido4.02008.09.01-
F-Prot4.4.4.562008.09.02-
F-Secure7.60.13501.02008.09.02AdWare.Win32.BHO.cox
Fortinet3.14.0.02008.09.02Adware/DesktopMedia
GData192008.09.02Win32:Agent-GRW
IkarusT3.1.1.34.02008.09.02Virus.Win32.Agent.GRW
K7AntiVirus7.10.4352008.09.01Trojan.Win32.Malware.1
Kaspersky7.0.0.1252008.09.02not-a-virus:AdWare.Win32.BHO.cox
McAfee53742008.09.01potentially unwanted program Adware-DesktopMedia
Microsoft1.38072008.09.02Adware:Win32/Rugo
NOD32v234062008.09.02-
Norman5.80.022008.09.01-
Panda9.0.0.42008.09.02-
PCTools4.4.2.02008.09.01-
Prevx1V22008.09.02Worm
Rising20.60.10.002008.09.02AdWare.Win32.Mnless.ahb
Sophos4.33.02008.09.02-
Sunbelt3.1.1592.12008.08.30Adware.Bdsearch
Symantec102008.09.02-
TheHacker6.3.0.8.0692008.09.01-
TrendMicro8.700.0.10042008.09.02-
VBA323.12.8.42008.09.01AdWare.Win32.BHO.cox
ViRobot2008.9.1.13592008.09.01Adware.BHO.679936.D
VirusBuster4.5.11.02008.09.01-
Webwasher-Gateway6.6.22008.09.01Ad-Spyware.BDSearch.1.45

附加信息
File size: 679936 bytes
MD5...: 5cc9d394a169a062f7ff5a083e1d2f16
SHA1..: da8f216afd1a4e61ddd93b447bb697520d0ac697
SHA256: f230b2961b14d6f817312d09786e3b8270eb85571e0f6acfff0e6a9aed56f6ab
SHA512: d73fbdd486596eda659f1f05e9f532496a02f18625ca4c1801cc18811c88024a
2127f14f1f7d2163749c364f920b729ebedd2704792146bdd1e78e97e1759fbb
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (53.1%)
Windows Screen Saver (18.4%)
Win32 Executable Generic (12.0%)
Win32 Dynamic Link Library (generic) (10.6%)
Generic Win/DOS Executable (2.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10044883
timedatestamp.....: 0x48a8ce36 (Mon Aug 18 01:19:50 2008)
machinetype.......: 0x14c (I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x79f76 0x7a000 6.62 daa7ab1749d0349d0d49b08f790012dd
.rdata 0x7b000 0xc4ce 0xd000 4.73 470ce27f912cec8a2fb64d136a712951
.data 0x88000 0x52e2c 0xd000 2.61 31fa3a006582c503094bbf1d8a2c44ce
.rsrc 0xdb000 0x1258 0x2000 3.01 9f55d89a8fd45e9f03a4f5db7ab987b7
.reloc 0xdd000 0xe674 0xf000 5.83 a465aad81a0719d36866c17035df8794

( 9 imports )
> WS2_32.dll: -, -, -
> ole32.dll: CoTaskMemRealloc, CLSIDFromString, CLSIDFromProgID, CoGetClassObject, OleLockRunning, CoTaskMemAlloc, StringFromGUID2, OleUninitialize, OleInitialize, CreateStreamOnHGlobal, CoCreateInstance, CoUninitialize, CoInitialize, CoTaskMemFree
> WININET.dll: InternetOpenA, InternetReadFile, GetUrlCacheEntryInfoA, InternetCrackUrlA, DeleteUrlCacheEntry, InternetConnectA, InternetCloseHandle, HttpOpenRequestA, HttpSendRequestA
> urlmon.dll: URLDownloadToFileA
> KERNEL32.dll: RaiseException, InitializeCriticalSection, DeleteCriticalSection, GetLocalTime, CloseHandle, UnmapViewOfFile, MapViewOfFile, CreateFileMappingA, OpenFileMappingA, ReleaseMutex, FlushViewOfFile, WaitForSingleObject, CreateMutexA, FindClose, FindFirstFileA, GetLastError, GetSystemTimeAsFileTime, SetErrorMode, MultiByteToWideChar, GetShortPathNameA, GetTempFileNameA, GetTempPathA, CopyFileA, Sleep, SetFileAttributesA, GetWindowsDirectoryA, DeleteFileA, GetVolumeInformationA, GetSystemDirectoryA, FindNextFileA, lstrcmpA, lstrcatA, lstrcpyA, CreateDirectoryA, GetVersionExA, SetProcessWorkingSetSize, GetCurrentProcess, GetTickCount, InterlockedExchange, GetACP, GetLocaleInfoA, GetThreadLocale, EnterCriticalSection, LeaveCriticalSection, FlushInstructionCache, HeapFree, GetProcessHeap, HeapAlloc, WideCharToMultiByte, InterlockedDecrement, lstrlenA, GetCurrentThreadId, GlobalUnlock, GlobalLock, GlobalAlloc, lstrlenW, MulDiv, InterlockedIncrement, GetModuleFileNameA, SetEvent, GetModuleHandleA, FreeLibrary, SizeofResource, LoadResource, LoadLibraryExA, lstrcmpiA, lstrcpynA, IsDBCSLeadByte, GetProcAddress, LoadLibraryA, CreateThread, OpenEventA, CreateProcessA, WaitForMultipleObjects, CreateEventA, Module32Next, Module32First, CreateToolhelp32Snapshot, GetCurrentDirectoryA, Process32Next, Process32First, ReadFile, CreateFileA, TerminateProcess, DeviceIoControl, VirtualAlloc, VirtualFree, SetFilePointer, WriteFile, SetEndOfFile, GetStdHandle, QueryPerformanceCounter, HeapSize, GetCurrentProcessId, SetUnhandledExceptionFilter, IsBadWritePtr, HeapCreate, FlushFileBuffers, HeapDestroy, TlsGetValue, TlsSetValue, TlsFree, SetLastError, TlsAlloc, GetOEMCP, GetCPInfo, LCMapStringW, LCMapStringA, RemoveDirectoryA, GetCommandLineA, HeapReAlloc, VirtualQuery, GetSystemInfo, VirtualProtect, GetFileAttributesA, GetDriveTypeA, FileTimeToLocalFileTime, FileTimeToSystemTime, ExitProcess, RtlUnwind, SetHandleCount, GetFileType, GetStartupInfoA, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, UnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, GetUserDefaultLCID, EnumSystemLocalesA, IsValidLocale, IsValidCodePage, IsBadReadPtr, IsBadCodePtr, GetTimeZoneInformation, SetStdHandle, GetLocaleInfoW, CompareStringA, CompareStringW, SetEnvironmentVariableA, LocalFree, FindResourceA, GetFullPathNameA
> USER32.dll: GetForegroundWindow, SetForegroundWindow, SystemParametersInfoA, MapWindowPoints, ShowWindow, UpdateWindow, PeekMessageA, GetMessageA, TranslateMessage, DispatchMessageA, EnumWindows, AdjustWindowRectEx, FindWindowExA, PostMessageA, CreateAcceleratorTableA, CharNextA, GetParent, GetClassNameA, RedrawWindow, IsWindow, GetDlgItem, SetFocus, GetFocus, IsChild, GetWindow, DestroyAcceleratorTable, BeginPaint, EndPaint, GetDesktopWindow, InvalidateRgn, InvalidateRect, FillRect, SetCapture, ReleaseCapture, GetSysColor, CreateWindowExA, CallWindowProcA, RegisterWindowMessageA, RegisterClassExA, GetWindowTextLengthA, GetWindowTextA, DefWindowProcA, SetActiveWindow, LoadCursorA, GetClassInfoExA, KillTimer, SetTimer, SetWindowPos, MoveWindow, SetWindowTextA, SendMessageA, GetWindowLongA, SetWindowLongA, DestroyWindow, PostQuitMessage, wsprintfA, SetWindowRgn, ReleaseDC, GetWindowRect, GetClientRect, GetSystemMetrics, LoadImageA, UnregisterClassA, GetDC
> GDI32.dll: CreateRectRgn, GetPixel, RestoreDC, CreateSolidBrush, GetStockObject, GetObjectA, GetDeviceCaps, BitBlt, CreateCompatibleBitmap, DeleteDC, SelectObject, CreateCompatibleDC, CombineRgn, SaveDC, DeleteObject
> ADVAPI32.dll: RegOpenKeyA, RegQueryValueExA, InitializeSecurityDescriptor, RegSetValueExA, RegCreateKeyA, GetUserNameA, RegCreateKeyExA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, RegEnumKeyExA, SetSecurityDescriptorDacl, RegCloseKey
> OLEAUT32.dll: -, -, -, -, -, -, -, -, -, -, -, -

( 8 exports )
Always, CallByControl, GetPlayerVersion, HxcDown, HxcUpdate, RunAD, Stop, playAdh
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=52B62B9300B9F45560080A686AD6A100F0A85D5F


 

mr.ace homme 知乎 mr.ace homme 知乎
原创粉丝点击
热门IT博客
小策子弹弓商城淘宝小策子弹弓商城淘宝
四维星窗帘软件下载四维星窗帘软件下载
文明5 mac 中文
java小项目开发案例
女留学生遇害 知乎
shell编程的特点
青蜂网络
陈默外推软件
手机淘宝可以实名认证
微信养号软件
怎样在matlab2014编程
买淘宝账号多少钱一个
经传软件免费版
苹果8plus网络设置
电话软件下载
全国公章大数据平台
wto数据库怎么用
mac发送文件给iphone
matlab数组写入excel
动态演示软件
热门问题 老师的惩罚 人脸识别 我在镇武司摸鱼那些年 重生之率土为王 我在大康的咸鱼生活 盘龙之生命进化 天生仙种 凡人之先天五行 春回大明朝 姑娘不必设防，我是瞎子 长时间站立有什么危害 男生说下一站立马回头 下一站立马回头什么梗 孕妇家中站立产子 产妇家中站立分娩 长时间站立脚疼妙招 站立分娩自己接生 靠墙站立能减肥吗 每天靠墙站立有什么好处 日本人站立后背式进入动态 一只熊站立大吼gif 饭后站立半小时能减肥吗 站立起跑姿势图解 孕妇一人站立分娩 站笼 滚笼机价格 电热水笼头 笼多音字注音并组词 狗笼怎么装 仓储笼仓库笼 锁链狗笼跪爬项圈 石笼网片价格 第一章御奴塔笼中 站群服务器 免费站群管理系统 站群系统软件 网站站群系统 站群如何建立 站群优化公司 站群工具 女站神的黑包群 站群论坛 网站站群建设 站群软件系统 站群系统哪个好 站群营销 站群优化 龙少站群 站群vps 群雪卓玛 站群方案

程序博客网，程序员的互联网技术博客家园。csdn论坛精品 msdn技术资料都在这里