VirSCAN VirSCAN

1, You can UPLOAD any files, but there is 20Mb limit per file.
2, VirSCAN supports Rar/Zip decompression, but it must be less than 20 files.
3, Aplikace VirSCAN může skenovat komprimované soubory s heslem 'infected'nebo'virus'.

Language
Server load
Server Load

  Main Menu
VirSCAN  HOME VirSCAN  go Virscan.org VirSCAN  Report VirSCAN  Virus report VirSCAN  Behavior report VirSCAN  Help VirSCAN VirSCAN  Submit Bugs VirSCAN  Contact us VirSCAN  URL detection VirSCAN  API VirSCAN  uploader for windows(test)
  Powered By
a-squared
a-squared
a-squared
 
File information
Safety rating:75
Behavior list
Basic Information
MD5:907afd72073e9031c00e561cf8ee13a6
file type:zip
Production company:
version:
Shell or compiler information:
Subfile information:frontend.zip / big file / zip
backend.zip / 5ce8cb6c03786fd32bb186882e467219 / zip
templates.zip / b67f202d868b6464dc5278b832794b94 / zip
en-GB.com_community.ini / 674f841bf30ac8ecb184c8cd907b772a / Unknown
hash.ini / 2ac64b89e016f215843934860347d054 / Unknown
all_plugins.zip / eaaa117b934b4f191c776d0cfcb93584 / zip
en-GB.com_community.ini / ba4a3b3f56460be1d6a05811eac05cae / Unknown
install-bg-4.jpg / 84e1b9d6b6dd59ecba6bf3771e11b9de / Unknown
bootstrap.css / 29faab8dde7e2581c7c19e4f8f75ee66 / Unknown
all_modules.zip / 8488dd1d4405450d43e34c1705e0d2b0 / zip
bootstrap.min.css / d793b7386a783d0c682ea0718021077e / Unknown
bootstrap.js / c37968e682cc0dd043799ed029f018f7 / Windows Script
installer.updater.php / 954323491e37a177fb86fafb7b4367bd / Unknown
logo.png / 56aab5482c5be4d9bd4c9c2ee0275538 / Unknown
installer.php / 1468317ae2179f7a45f8c5164cc3e08a / Unknown
azrul.zip / 3f8c8dbe666032aa90ba57b802bbc2f0 / zip
defaultItems.php / f80d35950908f08a20e1324085c08f36 / Unknown
bootstrap.min.js / d01e3a1948f9426854ad63b9eef80a77 / Windows Script
bootstrap-responsive.css / ab837d64d4f57108d6f8fca9fd519528 / Unknown
Key behavior
Behavior description:设置特殊文件夹属性
details:C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache
Process behavior
Behavior description:创建本地线程
details:TargetProcess: iexplore.exe, InheritedFromPID = 2128, ProcessID = 2172, ThreadID = 2296, StartAddress = 6359727B, Parameter = 00259580
TargetProcess: iexplore.exe, InheritedFromPID = 2128, ProcessID = 2172, ThreadID = 2300, StartAddress = 7C930230, Parameter = 00000000
TargetProcess: iexplore.exe, InheritedFromPID = 2128, ProcessID = 2172, ThreadID = 2304, StartAddress = 6302B849, Parameter = 02F00D00
TargetProcess: iexplore.exe, InheritedFromPID = 2128, ProcessID = 2172, ThreadID = 2328, StartAddress = 77E56C7D, Parameter = 002745D0
TargetProcess: iexplore.exe, InheritedFromPID = 2128, ProcessID = 2172, ThreadID = 2332, StartAddress = 77E56C7D, Parameter = 00274660
TargetProcess: iexplore.exe, InheritedFromPID = 2128, ProcessID = 2172, ThreadID = 2404, StartAddress = 5DE05A52, Parameter = 0027E030
File behavior
Behavior description:创建文件
details:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\wpad[1].dat
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\html5[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\dnserrordiagoff[1]
Behavior description:修改文件内容
details:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\html5[1].js ---> Offset = 0
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\html5[1].js ---> Offset = 1024
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\html5[1].js ---> Offset = 1042
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\html5[1].js ---> Offset = 1060
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\html5[1].js ---> Offset = 1078
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\dnserrordiagoff[1] ---> Offset = 0
Behavior description:覆盖已有文件
details:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\dnserrordiagoff[1]
Behavior description:设置特殊文件夹属性
details:C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Feeds Cache
Behavior description:删除文件
details:C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\wpad[1].dat
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\C1OS62RY\html5[1].js
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\IUKHR8T2\dnserrordiagoff[2]
Network behavior
Behavior description:联网打开网址
details:InternetOpenUrlA: http://**.133.40.**:128/wpad.dat, hInternet = 0x00cc0010, Flags = 0x00000010
Behavior description:连接指定站点
details:InternetConnectA: ServerName = ht****om, PORT = 80, UserName = , Password = , hSession = 0x00cc0004, hConnect = 0x00cc0008, Flags = 0x00000000
InternetConnectA: ServerName = **.133.40.**, PORT = 128, UserName = , Password = , hSession = 0x00cc0010, hConnect = 0x00cc0014, Flags = 0x00000010
Behavior description:打开HTTP连接
details:InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489), hSession = 0x00cc0004
InternetOpenA: UserAgent: Mozilla/4.0 (compatible; MSIE 8.0; Win32; Trident/4.0), hSession = 0x00cc0010
Behavior description:建立到一个指定的套接字连接
details:URL: wpad, IP: **.133.40.**:128, SOCKET = 0x00000578
URL: ht****om, IP: **.133.40.**:80, SOCKET = 0x00000568
Behavior description:读取网络文件
details:hFile = 0x00cc0018, BytesToRead =4010, BytesRead = 4010.
Behavior description:发送HTTP包
details:GET /wpad.dat HTTP/1.1 Accept: */* User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32; Trident/4.0) Host: **.133.40.**:128
GET /svn/trunk/html5.js HTTP/1.1 Accept: */* Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729; .NET4.0C; .NET4.0E; KB974489) Accept-Encoding: gzip, deflate Host: ht****om Connection: Keep-Alive
Behavior description:打开HTTP请求
details:HttpOpenRequestA: ht****om:80/svn/trunk/html5.js, hConnect = 0x00cc0008, hRequest = 0x00cc000c, Verb: GET, Referer: , Flags = 0x00400000
HttpOpenRequestA: **.133.40.**:128/wpad.dat, hConnect = 0x00cc0014, hRequest = 0x00cc0018, Verb: GET, Referer: , Flags = 0x00000010
Behavior description:按名称获取主机地址
details:GetAddrInfoW: computer
GetAddrInfoW: wpad
GetAddrInfoW: ht****om
Registry behavior
Behavior description:修改注册表
details:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Count
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\Time
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\LoadTime
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore\LoadTimeCount
Behavior description:删除注册表键值
details:\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer
\REGISTRY\USER\S-*\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL
Other behavior
Behavior description:创建互斥体
details:Local\!PrivacIE!SharedMemory!Mutex
SmartScreen_UrsCacheMutex_2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2High_S-*
RasPbFile
MSCTF.Shared.MUTEX.ELH
MSCTF.Shared.MUTEX.IKI
MSCTF.Shared.MUTEX.EGJ
Behavior description:创建事件对象
details:EventName = Global\crypt32LogoffEvent
EventName = DINPUTWINMM
EventName = Global\userenv: User Profile setup event
EventName = MSCTF.SendReceive.Event.IKI.IC
EventName = MSCTF.SendReceiveConection.Event.IKI.IC
EventName = MSCTF.SendReceiveConection.Event.EGJ.IC
EventName = MSCTF.SendReceive.Event.EGJ.IC
Behavior description:查找指定窗口
details:NtUserFindWindowEx: [Class,Window] = [MS_AutodialMonitor,]
NtUserFindWindowEx: [Class,Window] = [MS_WebCheckMonitor,]
NtUserFindWindowEx: [Class,Window] = [Shell_TrayWnd,]
NtUserFindWindowEx: [Class,Window] = [CicLoaderWndClass,]
NtUserFindWindowEx: [Class,Window] = [OleMainThreadWndClass,]
Behavior description:隐藏指定窗口
details:[Window,Class] = [缩放级别,ToolbarWindow32]
[Window,Class] = [,msctls_progress32]
Behavior description:窗口信息
details:Pid = 2128, Hwnd=0x202b0, Text = 导航栏, ClassName = WorkerW.
Pid = 2128, Hwnd=0x702c0, Text = 地址组合控制, ClassName = ToolbarWindow32.
Pid = 2128, Hwnd=0x302b6, Text = 页面控制, ClassName = ToolbarWindow32.
Pid = 2128, Hwnd=0x102e8, Text = 搜索..., ClassName = Edit.
Pid = 2128, Hwnd=0x102ec, Text = 搜索组合控制, ClassName = ToolbarWindow32.
Pid = 2128, Hwnd=0x102ee, Text = 搜索控制, ClassName = ToolbarWindow32.
Pid = 2128, Hwnd=0x10308, Text = 命令栏, ClassName = ToolbarWindow32.
Pid = 2128, Hwnd=0x10300, Text = 收藏夹命令栏, ClassName = ToolbarWindow32.
Pid = 2128, Hwnd=0x102f4, Text = LinksBand, ClassName = LinksBandClass.
Pid = 2128, Hwnd=0x102fc, Text = 收藏夹栏, ClassName = ToolbarWindow32.
Pid = 2128, Hwnd=0x102f8, Text = 添加到收藏夹栏, ClassName = ToolbarWindow32.
Pid = 2172, Hwnd=0x1031e, Text = ITBarHost, ClassName = InternetToolbarHost.
Pid = 2172, Hwnd=0x10320, Text = 菜单栏, ClassName = WorkerW.
Pid = 2172, Hwnd=0x10332, Text = 缩放级别, ClassName = ToolbarWindow32.
Pid = 2128, Hwnd=0x202b2, Text = Windows Internet Explorer, ClassName = IEFrame.
Run screenshot
VirSCAN

About VirSCAN | Privacy Policy | Contact us | Links | Help VirSCAN
中国反网络病毒联盟
Powered By CentOSpol

京ICP备11007605号-12

 pol

京公网安备 11010802020746号