VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

Language
Server load
Server Load

  Main Menu
VirSCAN  HOME VirSCAN  go Virscan.org VirSCAN  Report VirSCAN  Virus report VirSCAN  Behavior report VirSCAN  Help VirSCAN VirSCAN  Submit Bugs VirSCAN  Contact us VirSCAN  URL detection VirSCAN  API VirSCAN  uploader for windows(test)
  Powered By
a-squared
a-squared
a-squared
 
File information
Safety rating:14
Behavior list
Basic Information
MD5:73fbf3236e8ffc89853ba56e7c84aaf2
file type:EXE
Production company:
version:
Shell or compiler information:COMPILER:Microsoft Visual Studio .NET 2005 -- 2008 -> Microsoft Corporation *
Key behavior
Behavior description:跨进程写入数据
details:C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
TargetProcess = [System Process], WriteAddress = 0x00e40000, Size = 8
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\sc.exe
TargetProcess = [System Process], WriteAddress = 0x00cb0000, Size = 8
C:\WINDOWS\system32\services.exe
TargetProcess = [System Process], WriteAddress = 0x00cc0000, Size = 2048
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
TargetProcess = [System Process], WriteAddress = 0x00930000, Size = 8
C:\WINDOWS\system32\spoolsv.exe
TargetProcess = [System Process], WriteAddress = 0x00940000, Size = 2048
C:\WINDOWS\system32\alg.exe
TargetProcess = [System Process], WriteAddress = 0x00c80000, Size = 2048
Behavior description:隐藏指定窗口
details:[Window,Class] = [,BrowserFrameGripperClass]
[Window,Class] = [缩放级别,ToolbarWindow32]
[Window,Class] = [,msctls_progress32]
Behavior description:修改注册表_启动项
details:\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system
Behavior description:常规加载驱动
details:\??\C:\Program Files\AAV\CDriver.sys
Behavior description:创建远程线程
details:C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\alg.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Tencent\QQ\Bin\QQ.exe
C:\Program Files\Tencent\QQ\Bin\TXPlatform.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\PersonalBankPortal.exe
C:\%temp%\1445591337.345473.exe
Behavior description:停止系统服务
details:ServiceName = aav
ServiceName = IPSEC Services
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
AtlDebugAllocator_FileMappingNameStatic3_60c
Internet Explorer Immutable Application State (00000CC8-0000-0000-0000-000000000000)
ie_lcie_LogonMedium
ie_lcie_main_cc8
Isolation Process Registry (993EA80B-7965-11E5-91BE-000000000000)
Isolation Signal Registry (993EA80B-7965-11E5-91BE-000000000000, 0)
Local\IEFrame!GetAsyncKeyStateSharedMem!3272
ie_lcie_ConnHashTable<3272>
DfRoot0003DE608
CTF.AsmListCache.FMPDefaultS-*
AtlDebugAllocator_FileMappingNameStatic3_cc8
Local\Feed Eventing Shared Memory S-*
Behavior description:设置特殊文件夹属性
details:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache
C:\Documents and Settings\Administrator\IECompatCache
Behavior description:创建系统服务
details:[服务创建成功]: aav, C:\Program Files\\AAV\\CDriver.sys
Behavior description:按名称获取主机地址
details:computer
wpad
110.110.110.110
www.yixun.com
Process behavior
Behavior description:隐藏窗口创建进程
details:ImagePath = c:\windows\system32\sc.exe, CmdLine = "c:\windows\system32\sc.exe" stop policyagent
Behavior description:创建进程
details:ImagePath = C:\WINDOWS\system32\Rundll32.exe, CmdLine = Rundll32 C:\WINDOWS\system32\tvvea.dll Exxcute
ImagePath = C:\WINDOWS\system32\net.exe, CmdLine = net stop WinDefend
ImagePath = C:\WINDOWS\system32\net.exe, CmdLine = net stop MpsSvc
ImagePath = C:\WINDOWS\system32\sc.exe, CmdLine = sc config WinDefend start= disabled
ImagePath = C:\WINDOWS\system32\sc.exe, CmdLine = sc config MpsSvc start= disabled
ImagePath = C:\WINDOWS\system32\sc.exe, CmdLine = sc stop ZhuDongFangYu
ImagePath = C:\WINDOWS\system32\sc.exe, CmdLine = sc delete ZhuDongFangYu
ImagePath = C:\WINDOWS\system32\sc.exe, CmdLine = sc stop 360rp
ImagePath = C:\WINDOWS\system32\net1.exe, CmdLine = net1 stop WinDefend
ImagePath = C:\WINDOWS\system32\sc.exe, CmdLine = sc delete 360rp
ImagePath = C:\WINDOWS\system32\net1.exe, CmdLine = net1 stop MpsSvc
ImagePath = C:\WINDOWS\system32\sc.exe, CmdLine = "C:\WINDOWS\system32\sc.exe" stop PolicyAgent
ImagePath = C:\WINDOWS\system32\Rundll32.exe, CmdLine = Rundll32 C:\WINDOWS\system32\kkdha.dll Exucute
ImagePath = C:\Program Files\Internet Explorer\IEXPLORE.EXE, CmdLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.yixun.com/
ImagePath = C:\Program Files\Internet Explorer\IEXPLORE.EXE, CmdLine = "C:\Program Files\Internet Explorer\IEXPLORE.EXE" SCODEF:3272 CREDAT:79873
Behavior description:创建远程线程
details:C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\alg.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Tencent\QQ\Bin\QQ.exe
C:\Program Files\Tencent\QQ\Bin\TXPlatform.exe
C:\WINDOWS\system32\conime.exe
C:\WINDOWS\system32\PersonalBankPortal.exe
C:\%temp%\1445591337.345473.exe
Behavior description:枚举进程
details:N/A
Behavior description:跨进程写入数据
details:C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
TargetProcess = [System Process], WriteAddress = 0x00e40000, Size = 8
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\sc.exe
TargetProcess = [System Process], WriteAddress = 0x00cb0000, Size = 8
C:\WINDOWS\system32\services.exe
TargetProcess = [System Process], WriteAddress = 0x00cc0000, Size = 2048
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
TargetProcess = [System Process], WriteAddress = 0x00930000, Size = 8
C:\WINDOWS\system32\spoolsv.exe
TargetProcess = [System Process], WriteAddress = 0x00940000, Size = 2048
C:\WINDOWS\system32\alg.exe
TargetProcess = [System Process], WriteAddress = 0x00c80000, Size = 2048
File behavior
Behavior description:创建可执行文件
details:C:\WINDOWS\system32\tvvea.dll
C:\Program Files\AAV\CDriver.sys
C:\WINDOWS\system32\kkdha.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\3.tmp
Behavior description:查找文件
details:FileName = C:\WINDOWS
FileName = C:\WINDOWS\system32
FileName = C:\WINDOWS\system32\Rundll32.exe
FileName = C:\WINDOWS\system32\rundll32.exe
FileName = C:\WINDOWS\system32\net.exe
FileName = C:\WINDOWS\system32\sc.exe
FileName = C:\WINDOWS\system32\net1.exe
FileName = C:\WINDOWS\Tasks\*.job
FileName = sc.*
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\sc.*
FileName = C:\WINDOWS\system32\sc.*
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\Local Settings
FileName = C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
AtlDebugAllocator_FileMappingNameStatic3_60c
Internet Explorer Immutable Application State (00000CC8-0000-0000-0000-000000000000)
ie_lcie_LogonMedium
ie_lcie_main_cc8
Isolation Process Registry (993EA80B-7965-11E5-91BE-000000000000)
Isolation Signal Registry (993EA80B-7965-11E5-91BE-000000000000, 0)
Local\IEFrame!GetAsyncKeyStateSharedMem!3272
ie_lcie_ConnHashTable<3272>
DfRoot0003DE608
CTF.AsmListCache.FMPDefaultS-*
AtlDebugAllocator_FileMappingNameStatic3_cc8
Local\Feed Eventing Shared Memory S-*
Behavior description:重命名文件
details:C:\DOCUME~1\ADMINI~1\LOCALS~1\%temp%\1445591338.025626.exe ---> C:\WINDOWS\system32\system.exe
Behavior description:设置特殊文件夹属性
details:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache
C:\Documents and Settings\Administrator\IECompatCache
Behavior description:修改文件内容
details:C:\WINDOWS\system32\wbem\Logs\wbemess.log---> Offset = 5455
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\dnserrordiagoff[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\ErrorPageTemplate[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\errorPageStrings[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\httpErrorPagesScripts[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\6TLOMATB\noConnect[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\bullet[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\background_gradient[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\down[2]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\favcenter[1]---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\tools[2]---> Offset = 0
Network behavior
Behavior description:发送一个已连接的套接字数据
details:SOCKET = 0x00000368, TotalSize = 130, Offset = 0, ReadSize = 130.
Behavior description:联网打开网址
details:InternetOpenUrlA: http://110.110.110.110:80/wpad.dat hInternet = 0x000000f8
InternetOpenUrlA: http://110.110.110.110:80/wpad.dat hInternet = 0x00000414
Behavior description:下载文件
details:URLDownloadToFileW: http://www.live.com/favicon.ico ---> C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
URLDownloadToFileW: https://go.microsoft.com/fwlink/?LinkId=141260 ---> C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Kno4.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Kno4.tmp
Behavior description:建立到一个指定的套接字连接
details:110.110.110.110:80
Behavior description:读取网络文件
details:hFile = 0x000000f8, BytesToRead =4010, BytesRead = 4010.
hFile = 0x00000414, BytesToRead =4010, BytesRead = 4010.
Behavior description:按名称获取主机地址
details:computer
wpad
110.110.110.110
www.yixun.com
Registry behavior
Behavior description:删除注册表键
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Class\{8ECC055D-047F-11D1-A537-0000F8753ED1}\0000
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AAV\0000
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AAV\0000\Control
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AAV
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\aav\Security
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\aav\Enum
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\aav
\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}
\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000
\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile
\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}
Behavior description:修改注册表_服务项
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\aav\Start
Behavior description:删除注册表键值_IE连接设置
details:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Behavior description:修改注册表
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\aav\DeleteFlag
\REGISTRY\MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_AAV\0000\Driver
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesProcessed
\REGISTRY\USER\S-*\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\WINDOWS\system32\sc.exe
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
\REGISTRY\MACHINE\SOFTWARE\Microsoft\ESENT\Process\Rundll32\DEBUG\Trace Level
\REGISTRY\MACHINE\SAM\SAM\Domains\Account\Users\000001F4\F
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-*\RefCount
\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\Recovery\Active\{993EA80E-7965-11E5-91BE-000000000000}
\REGISTRY\USER\S-*\Software\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}\Enable
\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32\
\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\Main\Window_Placement
\REGISTRY\USER\S-*\SessionInformation\ProgramCount
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Count
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time
Behavior description:删除注册表键值
details:\REGISTRY\MACHINE\SOFTWARE\Microsoft\ESENT\Process\Rundll32\DEBUG\Trace Level
\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\0\Expiration
\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\LinksBar\ItemCache\1\Expiration
Behavior description:修改注册表_启动项
details:\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system
Other behavior
Behavior description:创建互斥体
details:SHIMLIB_LOG_MUTEX
CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
SeBebugPrivilege
RasPbFile
Local\!BrowserEmulation!SharedMemory!Mutex
ConnHashTable<3272>_HashTable_Mutex
Behavior description:隐藏指定窗口
details:[Window,Class] = [,BrowserFrameGripperClass]
[Window,Class] = [缩放级别,ToolbarWindow32]
[Window,Class] = [,msctls_progress32]
Behavior description:常规加载驱动
details:\??\C:\Program Files\AAV\CDriver.sys
Behavior description:查找指定窗口
details:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [,MiniSniffer]
NtUserFindWindowEx: [Class,Window] = [TXGuiFoundation,QQ2013]
NtUserFindWindowEx: [Class,Window] = [CTXOPConntion_Class,OP_2269840561]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
NtUserFindWindowEx: [Class,Window] = [Static,]
Behavior description:启动系统服务
details:[服务启动成功]: , aav, \??\C:\Program Files\AAV\CDriver.sys
Behavior description:获取系统权限
details:SE_AUDIT_PRIVILEGE
SE_BACKUP_PRIVILEGE
SE_LOAD_DRIVER_PRIVILEGE
SE_TCB_PRIVILEGE
SE_CHANGE_NOTIFY_PRIVILEGE
Behavior description:枚举窗口
details:N/A
Behavior description:停止系统服务
details:ServiceName = aav
ServiceName = IPSEC Services
Behavior description:创建系统服务
details:[服务创建成功]: aav, C:\Program Files\\AAV\\CDriver.sys
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
中国反网络病毒联盟
Powered By CentOSpol

京ICP备11007605号-12

 pol

京公网安备 11010802020746号