VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

Language
Server load
Server Load

  Main Menu
VirSCAN  HOME VirSCAN  go Virscan.org VirSCAN  Report VirSCAN  Virus report VirSCAN  Behavior report VirSCAN  Help VirSCAN VirSCAN  Submit Bugs VirSCAN  Contact us VirSCAN  URL detection VirSCAN  API VirSCAN  uploader for windows(test)
  Powered By
a-squared
a-squared
a-squared
 
File information
Safety rating:50
Behavior list
Basic Information
MD5:741cd88b8b19e762ea756ded9f138736
file type:Nsis
Production company:
version:2009.12.15.0---2009.12.15.0
Shell or compiler information:
Subfile information:libintl-8.dll / 68c1e52a3849e783fe547c9a81e09cac / DLL
eg.mp3 / b186916b6f81843a91f76f941363aff0 / Unknown
libvorbisenc-2.dll / c346030b64569b3e272cfe34e6ee65e1 / DLL
iconv.dll / e4341fb69cb24cf63e9063f4d8967ebf / DLL
libvorbis-0.dll / 56911ce3824594ba46426d737d7cf986 / DLL
MSVCR70.DLL / 9972a6ed4f2388dbfa8e0a96f6f3fdf1 / DLL
msvcrt.dll / 3845ebe57ad6a4efa5e0194285afaef4 / DLL
Mp3CutHelper.exe / 8e6c38811a16795d168ecaddfe7a123b / EXE
mp3val.exe / f6964e7a8eba867d9b599fd1e0b4c5bd / EXE
libmp3splt-0.dll / 0940f08b3acacf07f66a9ada66857d13 / DLL
libsplt_mp3-0.dll / 616b8d37ea72a07e5e12585da4b9e4e3 / DLL
libmad-0.dll / d3ded038fa5f51487982205605c2336c / DLL
libid3tag.dll / bdc380645c310b13c6d4233924f09610 / DLL
pcre3.dll / 57cac848fa14ae38f14f9441f8933282 / DLL
mp3splt.exe / c0ba1e03e4c82b9349c202321c147c37 / EXE
chord.wav / 78b1d68ea6d2f427749cbb489054efc0 / Unknown
mp3parse.ax / 482dc58e6bd55244ef492d1c88870d8e / DLL
l3codecx.ax / 69a0628bbe1a404b1ba0b6dca7610a06 / DLL
libsplt_ogg-0.dll / 7f20550cc68b928ef20efbcc36e325e4 / DLL
Key behavior
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
MSCTF.MarshalInterface.FileMap.EAM..NDFHH
MSCTF.MarshalInterface.FileMap.EAM.B.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.C.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.D.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.E.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.F.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.G.NDFHH
MSCTF.Shared.SFM.EAM
VIDEOMEMORY
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
Local\!PrivacIE!SharedMem!Counter
MSCTF.MarshalInterface.FileMap.IJN..GBNKH
MSCTF.MarshalInterface.FileMap.IJN.B.GBNKH
Behavior description:在桌面创建快捷方式
details:C:\Documents and Settings\Administrator\桌面\MP3剪切助手(Mp3CutHelper).lnk
Behavior description:设置特殊文件夹属性
details:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
Behavior description:隐藏指定窗口
details:[Window,Class] = [,Button]
[Window,Class] = [Nullsoft Install System v2.27,Static]
[Window,Class] = [Nullsoft Install System v2.27 ,Static]
[Window,Class] = [,Static]
[Window,Class] = [,Auto-Suggest Dropdown]
[Window,Class] = [安装完成,Static]
[Window,Class] = [安装已成功完成。,Static]
[Window,Class] = [MP3剪切助手(Mp3CutHelper) V2.1.5.0 安装 ,#32770]
[Window,Class] = [,Shell Embedding]
[Window,Class] = [,Internet Explorer_Server]
Process behavior
Behavior description:创建新文件进程
details:ImagePath = C:\Program Files\Mp3CutHelper\Mp3CutHelper.exe, CmdLine = "C:\Program Files\Mp3CutHelper\Mp3CutHelper.exe"
Behavior description:枚举进程
details:N/A
File behavior
Behavior description:在系统敏感位置（如开始菜单等)释放链接或快捷方式
details:C:\Documents and Settings\Administrator\「开始」菜单\程序\MP3剪切助手(Mp3CutHelper)\MP3剪切助手(Mp3CutHelper).lnk
C:\Documents and Settings\Administrator\「开始」菜单\程序\MP3剪切助手(Mp3CutHelper)\下载软件最新版.lnk
C:\Documents and Settings\Administrator\「开始」菜单\程序\MP3剪切助手(Mp3CutHelper)\卸载软件.lnk
C:\Documents and Settings\Administrator\「开始」菜单\程序\MP3剪切助手(Mp3CutHelper)\热门软件排行榜.lnk
Behavior description:创建可执行文件
details:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\BrandingURL.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\InstallOptions.dll
C:\Program Files\Mp3CutHelper\iconv.dll
C:\Program Files\Mp3CutHelper\libid3tag.dll
C:\Program Files\Mp3CutHelper\libintl-8.dll
C:\Program Files\Mp3CutHelper\libltdl-7.dll
C:\Program Files\Mp3CutHelper\libmad-0.dll
C:\Program Files\Mp3CutHelper\libmp3splt-0.dll
C:\Program Files\Mp3CutHelper\libogg-0.dll
C:\Program Files\Mp3CutHelper\libsplt_mp3-0.dll
C:\Program Files\Mp3CutHelper\libsplt_ogg-0.dll
C:\Program Files\Mp3CutHelper\libvorbis-0.dll
C:\Program Files\Mp3CutHelper\libvorbisenc-2.dll
C:\Program Files\Mp3CutHelper\libvorbisfile-3.dll
C:\Program Files\Mp3CutHelper\Mp3CutHelper.exe
Behavior description:查找文件
details:FileName = C:\DOCUME~1
FileName = C:\Documents and Settings\ADMINI~1
FileName = C:\Documents and Settings\Administrator\LOCALS~1
FileName = C:\Documents and Settings\Administrator\Local Settings\Temp
FileName = C:\Documents and Settings\Administrator\Local Settings\%temp%
FileName = C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp
FileName = C:\Program Files\Mp3CutHelper
FileName = C:\Program Files
FileName = C:\Documents and Settings
FileName = C:\Documents and Settings\Administrator
FileName = C:\Documents and Settings\Administrator\「开始」菜单
FileName = C:\Documents and Settings\Administrator\「开始」菜单\程序
FileName = C:\Program Files\Mp3CutHelper\Mp3CutHelper.exe
FileName = C:\Documents and Settings\Administrator\My Documents
FileName = C:\Documents and Settings\All Users
Behavior description:在桌面创建快捷方式
details:C:\Documents and Settings\Administrator\桌面\MP3剪切助手(Mp3CutHelper).lnk
Behavior description:修改原系统的可执行文件
details:C:\WINDOWS\system32\l3codecx.ax---> Offset = 35436
Behavior description:写权限映射文件
details:CiceroSharedMemDefaultS-*
MSCTF.MarshalInterface.FileMap.EAM..NDFHH
MSCTF.MarshalInterface.FileMap.EAM.B.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.C.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.D.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.E.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.F.NDFHH
MSCTF.MarshalInterface.FileMap.EAM.G.NDFHH
MSCTF.Shared.SFM.EAM
VIDEOMEMORY
\WINDOWS\system32\zh-cn\ieframe.dll.mui
Local\UrlZonesSM_Administrator
Local\!PrivacIE!SharedMem!Counter
MSCTF.MarshalInterface.FileMap.IJN..GBNKH
MSCTF.MarshalInterface.FileMap.IJN.B.GBNKH
Behavior description:设置特殊文件夹属性
details:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5
C:\Documents and Settings\Administrator\Local Settings\History
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5
C:\Documents and Settings\Administrator\Cookies
Behavior description:修改文件内容
details:C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 36
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\modern-wizard.bmp---> Offset = 32768
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 124
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\modern-header.bmp---> Offset = 0
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 43
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 60
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 277
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 336
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 391
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 399
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 411
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 225
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 360
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\ioSpecial.ini---> Offset = 648
Network behavior
Behavior description:连接指定站点
details:InternetConnectA: ServerName = www.wsgsoft.net, PORT = 80
Behavior description:建立到一个指定的套接字连接
details:127.0.0.1:1033
Behavior description:读取网络文件
details:hFile = 0x00000380, BytesToRead =63, BytesRead = 63.
Behavior description:打开HTTP请求
details:HttpOpenRequestA: www.wsgsoft.net:80/mch/ad.htm, hConnect = 0x00000338
HttpOpenRequestA: www.wsgsoft.net:80/mch/usagelog.php?ver=2.1.5&os=5.1, hConnect = 0x00000374
HttpOpenRequestA: www.wsgsoft.net:80/mch/ver.php?ver=2.1.5&trial=0, hConnect = 0x00000374
Registry behavior
Behavior description:修改注册表
details:\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\Codepage
\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\DisplayName
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Mp3CutHelper.exe\
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MP3剪切助手(Mp3CutHelper)\DisplayName
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MP3剪切助手(Mp3CutHelper)\UninstallString
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MP3剪切助手(Mp3CutHelper)\DisplayIcon
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MP3剪切助手(Mp3CutHelper)\DisplayVersion
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MP3剪切助手(Mp3CutHelper)\URLInfoAbout
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MP3剪切助手(Mp3CutHelper)\Publisher
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{13CEBFE0-256B-44BA-A27B-9F85CBDB972D}\CLSID
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{13CEBFE0-256B-44BA-A27B-9F85CBDB972D}\FilterData
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11d0-BD40-00A0C911CE86}\Instance\{13CEBFE0-256B-44BA-A27B-9F85CBDB972D}\FriendlyName
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13CEBFE0-256B-44BA-A27B-9F85CBDB972D}\
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13CEBFE0-256B-44BA-A27B-9F85CBDB972D}\InprocServer32\
\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13CEBFE0-256B-44BA-A27B-9F85CBDB972D}\InprocServer32\ThreadingModel
Behavior description:修改注册表_延迟重命名项
details:\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\PendingFileRenameOperations
Behavior description:删除注册表键值_IE连接设置
details:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Behavior description:修改注册表_浏览器默认搜索引擎
details:\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope
\REGISTRY\USER\S-*\Software\Microsoft\Internet Explorer\SearchScopes\{24588FA4-10F1-41D7-B19D-6E22361E47FA}\URL
Other behavior
Behavior description:创建互斥体
details:CTF.LBES.MutexDefaultS-*
CTF.Compart.MutexDefaultS-*
CTF.Asm.MutexDefaultS-*
CTF.Layouts.MutexDefaultS-*
CTF.TMD.MutexDefaultS-*
CTF.TimListCache.FMPDefaultS-*MUTEX.DefaultS-*
MSCTF.Shared.MUTEX.ELH
MSCTF.Shared.MUTEX.EAM
AMResourceMutex2
VideoRenderer
Mp3CutHelperMutex
Local\ZonesCounterMutex
Local\ZoneAttributeCacheCounterMutex
Local\ZonesCacheCounterMutex
Local\ZonesLockedCacheCounterMutex
Behavior description:隐藏指定窗口
details:[Window,Class] = [,Button]
[Window,Class] = [Nullsoft Install System v2.27,Static]
[Window,Class] = [Nullsoft Install System v2.27 ,Static]
[Window,Class] = [,Static]
[Window,Class] = [,Auto-Suggest Dropdown]
[Window,Class] = [安装完成,Static]
[Window,Class] = [安装已成功完成。,Static]
[Window,Class] = [MP3剪切助手(Mp3CutHelper) V2.1.5.0 安装 ,#32770]
[Window,Class] = [,Shell Embedding]
[Window,Class] = [,Internet Explorer_Server]
Behavior description:查找指定窗口
details:NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,]
NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
Behavior description:获取系统权限
details:SE_LOAD_DRIVER_PRIVILEGE
Behavior description:窗口信息
details:Pid = 3072, Hwnd=0x202cc, Text = 下一步(&N) >, ClassName = Button.
Pid = 3072, Hwnd=0x202b4, Text = 取消(&C), ClassName = Button.
Pid = 3072, Hwnd=0x202d6, Text = Nullsoft Install System v2.27 , ClassName = Static.
Pid = 3072, Hwnd=0x202d8, Text = Nullsoft Install System v2.27, ClassName = Static.
Pid = 3072, Hwnd=0x202b0, Text = 欢迎使用 MP3剪切助手(Mp3CutHelper) V2.1.5.0 安装向导, ClassName = Static.
Pid = 3072, Hwnd=0x202ae, Text = 此向导将引导你完成 MP3剪切助手(Mp3CutHelper) V2.1.5.0 的安装进程。 在开始安装之前，建议先关闭其他所有应用程序。这将允许“安装, ClassName = Static.
Pid = 3072, Hwnd=0x202a4, Text = MP3剪切助手(Mp3CutHelper) V2.1.5.0 安装, ClassName = #32770.
Pid = 3072, Hwnd=0x202cc, Text = 安装(&I), ClassName = Button.
Pid = 3072, Hwnd=0x302ae, Text = C:\Program Files\Mp3CutHelper, ClassName = Edit.
Pid = 3072, Hwnd=0x302b0, Text = 浏览(&B)..., ClassName = Button.
Pid = 3072, Hwnd=0x402b8, Text = 可用空间: 5.8GB, ClassName = Static.
Pid = 3072, Hwnd=0x402be, Text = 所需空间: 9.8MB, ClassName = Static.
Pid = 3072, Hwnd=0x702c0, Text = 安装程序将把 MP3剪切助手(Mp3CutHelper) V2.1.5.0 安装到下列文件夹。要安装到不同的文件夹，点击 [浏览] 并选择其他文件夹。 点击 [安装, ClassName = Static.
Pid = 3072, Hwnd=0x502ce, Text = 目标文件夹, ClassName = Button(GroupBox).
Pid = 3072, Hwnd=0x202cc, Text = 完成(&F), ClassName = Button.
Behavior description:打开图片文件
details:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\modern-wizard.bmp
\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsb5.tmp\modern-header.bmp
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
中国反网络病毒联盟
Powered By CentOSpol

京ICP备11007605号-12

 pol

京公网安备 11010802020746号