VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

Language
Server load
Server Load

File information
Safety rating:80
Behavior list
Basic Information
MD5:565592d342e241eb6fca351f9c810ae3
file type:Nsis
Production company:Piriform Ltd
version:2.0.0.0---2.0.0.0
Shell or compiler information:
Subfile information:CCleaner64.exe / big file / EXE
CCleaner.exe / db1654adb276501c44db0fe5e8a0841d / EXE
PF-Toolbar-W78.exe / c5628cd068bb80ab24b741ffe4042138 / Nsis
PF-Chrome-W78.exe / 989cba8f5ae4fb9574379c28729ce849 / Nsis
GoogleUpdateSetup_1.3.21.123.exedumpFile / 82683411c04a7e11c93628a32a8b80f7 / EXE
GoogleUpdateSetup_1.3.21.123.exedumpFile / 82683411c04a7e11c93628a32a8b80f7 / EXE
gcapi_dll.dll / d496480a00abde0655c0fdce9530b43e / DLL
uninst.exe / f7eff976455b0911933484ad7687e726 / Nsis
pfWWW.dll / 1bf8a77ace38e746320dc8d67b2e7236 / DLL
[NSIS].nsi / 267cb698b5a055dcfdd373816ef5056f / Unknown
gtapi_signed.dll / 61bc40d1fad9e0faa9a07219b90ba0e4 / DLL
lang-1043.dll / 167982b7385ff805f63d60821021dcad / DLL
lang-1032.dll / f4aa27b162b3edb280fa6bff61d37718 / DLL
lang-1034.dll / 3f02a380229c88048dfad216ac6ae9a5 / DLL
lang-1036.dll / 3e02ed6637de2f6e423d02decf45a6ff / DLL
lang-1027.dll / 34232c9b0b181d19c69db989006b3529 / DLL
lang-1109.dll / a98e8c6ad027f3d46ac303c0a8e6bdb2 / DLL
lang-9999.dll / 7e516044ddd1b752fe1f34ad6366728b / DLL
lang-3098.dll / 0617b95c40cb9b578b0a6fa78b2ff079 / DLL
Key behavior
Behavior description:隐藏指定窗口
details:[Window,Class] = [,Button]
File behavior
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.MarshalInterface.FileMap.APK..GJKHF
MSCTF.MarshalInterface.FileMap.APK.B.GJKHF
MSCTF.MarshalInterface.FileMap.APK.C.GJKHF
MSCTF.MarshalInterface.FileMap.APK.D.GJKHF
MSCTF.MarshalInterface.FileMap.APK.E.GJKHF
MSCTF.MarshalInterface.FileMap.APK.F.GJKHF
MSCTF.MarshalInterface.FileMap.APK.G.GJKHF
Behavior description:创建可执行文件
details:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\System.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\UserInfo.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\gtapi_signed.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\gcapi_dll.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\pfWWW.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\ButtonEvent.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\nsDialogs.dll
Behavior description:修改文件内容
details:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\gcombo\ComboOffer.html---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\g\gcombo\combo-offer.png---> Offset = 16384
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\modern-header.bmp---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\modern-wizard.bmp---> Offset = 0
Registry behavior
Behavior description:修改注册表
details:\REGISTRY\MACHINE\SOFTWARE\Google\Google Toolbar\test
Behavior description:删除注册表键值
details:\REGISTRY\MACHINE\SOFTWARE\Google\Google Toolbar\test
\REGISTRY\MACHINE\SOFTWARE\Google\No Toolbar Offer Until\Piriform Ltd
\REGISTRY\MACHINE\SOFTWARE\Google\No Chrome Offer Until\Piriform Ltd
Behavior description:删除注册表键
details:\REGISTRY\MACHINE\SOFTWARE\Google\Google Toolbar
Other behavior
Behavior description:创建互斥体
details:CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
MSCTF.Shared.MUTEX.AEH
Behavior description:查找指定窗口
details:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
Behavior description:隐藏指定窗口
details:[Window,Class] = [,Button]
Behavior description:打开图片文件
details:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\modern-header.bmp
\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsw6.tmp\modern-wizard.bmp
Behavior description:获取系统权限
details:SE_LOAD_DRIVER_PRIVILEGE
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
中国反网络病毒联盟
Powered By CentOSpol

京ICP备11007605号-12

pol

京公网安备 11010802020746号