endurer - 2008-9-2 14:12:00
附件: 您所在的用户组无法下载或查看附件解压密码：virus
O23 - 服务: OSEvent (OSEvent) - C:\WINDOWS\system32\s.exe| 2008-8-8 4:9:38(自动)
文件说明符 : C:\WINDOWS\system32\s.exe
属性 : A--R
数字签名:否
PE文件:是
语言 : 中文(中国)
文件版本 : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
说明 : Windows Progman Group Converter
版权 : Copyright Zhongsou(C) 2005
产品版本 : 5.1.2600.2180
产品名称 : Microsoft(R) Windows(R) Operating System
公司名称 : Microsoft Corporation
内部名称 : GrpConv
创建时间 : 2008-8-8 12:9:38
修改时间 : 2008-7-26 9:48:34
大小 : 98304 字节 96.0 KB
MD5 : e989fd3e1b34e9beb26c6d9744143b5e
SHA1: BA27F06F5C76B7DD78D80414ADC9DC97E2647BC0
CRC32: 443ca0a9
文件 s.exe 接收于 2008.09.02 07:56:02 (CET)
| 反病毒引擎 | 版本 | 最后更新 | 扫描结果 |
| AhnLab-V3 | 2008.9.2.0 | 2008.09.02 | - |
| AntiVir | 7.8.1.23 | 2008.09.01 | - |
| Authentium | 5.1.0.4 | 2008.09.02 | - |
| Avast | 4.8.1195.0 | 2008.09.01 | - |
| AVG | 8.0.0.161 | 2008.09.01 | - |
| BitDefender | 7.2 | 2008.09.02 | - |
| CAT-QuickHeal | 9.50 | 2008.08.29 | - |
| ClamAV | 0.93.1 | 2008.09.02 | - |
| DrWeb | 4.44.0.09170 | 2008.09.01 | - |
| eSafe | 7.0.17.0 | 2008.09.01 | - |
| eTrust-Vet | 31.6.6062 | 2008.09.01 | - |
| Ewido | 4.0 | 2008.09.01 | - |
| F-Prot | 4.4.4.56 | 2008.09.02 | - |
| F-Secure | 7.60.13501.0 | 2008.09.02 | - |
| Fortinet | 3.14.0.0 | 2008.09.02 | - |
| GData | 19 | 2008.09.02 | - |
| Ikarus | T3.1.1.34.0 | 2008.09.02 | Trojan.Win32.Jhee.V |
| K7AntiVirus | 7.10.435 | 2008.09.01 | - |
| Kaspersky | 7.0.0.125 | 2008.09.02 | - |
| McAfee | 5374 | 2008.09.01 | - |
| Microsoft | 1.3807 | 2008.09.02 | Trojan:Win32/Jhee.V |
| NOD32v2 | 3406 | 2008.09.02 | - |
| Norman | 5.80.02 | 2008.09.01 | - |
| Panda | 9.0.0.4 | 2008.09.02 | - |
| PCTools | 4.4.2.0 | 2008.09.01 | - |
| Prevx1 | V2 | 2008.09.02 | Malware Downloader |
| Rising | 20.60.02.00 | 2008.09.02 | - |
| Sophos | 4.33.0 | 2008.09.02 | - |
| Sunbelt | 3.1.1592.1 | 2008.08.30 | - |
| Symantec | 10 | 2008.09.02 | - |
| TheHacker | 6.3.0.8.069 | 2008.09.01 | - |
| TrendMicro | 8.700.0.1004 | 2008.09.02 | TROJ_JHEE.BU |
| VBA32 | 3.12.8.4 | 2008.09.01 | - |
| ViRobot | 2008.9.1.1359 | 2008.09.01 | - |
| VirusBuster | 4.5.11.0 | 2008.09.01 | - |
| Webwasher-Gateway | 6.6.2 | 2008.09.01 | - |
| 附加信息 |
| File size: 98304 bytes |
| MD5...: e989fd3e1b34e9beb26c6d9744143b5e |
| SHA1..: ba27f06f5c76b7dd78d80414adc9dc97e2647bc0 |
| SHA256: 106ab625564ca6909f70cc3e935530043046c5435275f642c48cdf66a2e02a68 |
| SHA512: be682cd2432cf677db5a1511f8626a2f898e12ec56bd0ca438ab4a38aa143bf1 717e21d0aab5f47121e39bfbc88a9dd8ea8c2b0a1dd6e9573c74880fdae52240 |
| PEiD..: Armadillo v1.71 |
| TrID..: File type identification Win64 Executable Generic (59.6%) Win32 Executable MS Visual C++ (generic) (26.2%) Win32 Executable Generic (5.9%) Win32 Dynamic Link Library (generic) (5.2%) Generic Win/DOS Executable (1.3%) |
| PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x40777e timedatestamp.....: 0x488a8272 (Sat Jul 26 01:48:34 2008) machinetype.......: 0x14c (I386) ( 4 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xea15 0xf000 6.56 bc21b827dc08dc0a38b7f037cbacd830 .rdata 0x10000 0x20a0 0x3000 3.53 5d06b741269a1ab50e725000971ad5b4 .data 0x13000 0x5da8 0x4000 1.80 cf3cbe4050c51c06a50c399959f21f72 .rsrc 0x19000 0x3a8 0x1000 1.01 d4e889dabc877175e20b2ef2f4be76dd ( 2 imports ) > KERNEL32.dll: GetModuleHandleA, GetEnvironmentVariableA, SetStdHandle, IsBadCodePtr, IsBadReadPtr, ReadFile, Sleep, GetLastError, GetModuleFileNameA, GetShortPathNameA, CreateProcessA, CreateDirectoryA, LoadLibraryA, GetProcAddress, FreeLibrary, GetWindowsDirectoryA, GetVersionExA, CloseHandle, CreateToolhelp32Snapshot, Process32First, Process32Next, OpenProcess, MultiByteToWideChar, WideCharToMultiByte, RtlUnwind, RaiseException, GetCommandLineA, GetVersion, ExitProcess, HeapFree, HeapAlloc, HeapReAlloc, TerminateProcess, GetCurrentProcess, LCMapStringA, LCMapStringW, GetCPInfo, HeapSize, GetACP, GetOEMCP, SetUnhandledExceptionFilter, UnhandledExceptionFilter, FreeEnvironmentStringsA, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, WriteFile, VirtualAlloc, IsBadWritePtr, SetFilePointer, FlushFileBuffers, GetStringTypeA, GetStringTypeW > ADVAPI32.dll: ControlService, RegQueryInfoKeyA, SetServiceStatus, RegisterServiceCtrlHandlerA, StartServiceCtrlDispatcherA, DeleteService, StartServiceA, QueryServiceStatus, CreateServiceA, ChangeServiceConfig2A, RegCreateKeyA, RegSetValueExA, RegCloseKey, OpenSCManagerA, OpenServiceA, CloseServiceHandle, DeregisterEventSource, GetUserNameA, CreateProcessAsUserA, OpenProcessToken ( 0 exports ) |
| Prevx info: http://info.prevx.com/aboutprogr ... 16D663C340007832D56 |
| ThreatExpert info: http://www.threatexpert.com/repo ... 9beb26c6d9744143b5e |
用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; Maxthon; .NET CLR 1.1.4322; .NET CLR 2.0.50727)