|
Moderator, Analyst, Security Team
Join Date: Oct 2006
Location: Důn Čideann,Scotland.
Posts: 5,093
OS: XP
|
Re: IE Popups, system slow, Symantec Fails to Detect Cause
Hello again
Quote:
From virustotal:
Additional information
File size: 84310 bytes
MD5...: 1532a88c79ecaa85d4fa7795d432f07b
SHA1..: fe0f5ec8473b746a97feaecdbb54d7eaa648f169
SHA256: 731141446ccc9cda32d0cc007196651936575abe51a24d81740a6e4865eb610b
SHA512: cee5d6fc089ded158dbe0cb73167f95c15d3d7e7dc9ef20c472b79fc453b5f2c
53be84c504801bb3a0409fbb3ea735af34f4b926f337ea8dd8bf53772a9a4d56
ssdeep: 1536:GRvLphwAO2PH1srwmJIe2BalMTns3p1yc+v6MwiVoqvGv:GlpOI2wmJIWp1
y/vXwuo7
PEiD..: -
TrID..: File type identification
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x403228
timedatestamp.....: 0x48efcdbf (Fri Oct 10 21:48:47 2008)
machinetype.......: 0x14c (I386)
( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x5ac0 0x5c00 6.48 7f9f3d20cb836b74a551c2b25f308d2f
.rdata 0x7000 0x1190 0x1200 5.18 db16645055619c0cc73276ff5c3adb75
.data 0x9000 0x3997d8 0x400 4.71 831527cd097dfd3ec0ab4666ab81e7d3
.ndata 0x3a3000 0xa000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x3ad000 0x4170 0x4200 6.41 59c6fbf5e62caf2da599c468d70951c7
( 8 imports )
> KERNEL32.dll: CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetFileTime, GetTempPathA, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetWindowsDirectoryA
> USER32.dll: EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow
> GDI32.dll: SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject
> SHELL32.dll: SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation
> ADVAPI32.dll: RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA
> COMCTL32.dll: ImageList_AddMasked, ImageList_Destroy, -, ImageList_Create
> ole32.dll: CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
> VERSION.dll: GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA
|
Is this all you got from virustotal, i was expecting something like this:
Quote:
AhnLab-V3 2008.12.2.2 2008.12.02 -
AntiVir 7.9.0.36 2008.12.02 DR/Dldr.Small.agns
Authentium 5.1.0.4 2008.12.02 -
Avast 4.8.1281.0 2008.12.02 Win32:Trojan-gen {Other}
AVG 8.0.0.199 2008.12.03 Downloader.Generic_r.BT
BitDefender 7.2 2008.12.03 Trojan.Downloader.Small.ABER
CAT-QuickHeal 10.00 2008.12.03 -
ClamAV 0.94.1 2008.12.02 -
DrWeb 4.44.0.09170 2008.12.03 Trojan.Siggen.1115
eSafe 7.0.17.0 2008.12.02 Win32.Small.agns
|
Looking at the link below, copy the information from all the vendors and paste that into your reply. You can also bookmark the link and post that instead.
http://www.virustotal.com/analisis/c...e4b5b5394b7e04
i`ll need you to go to Virustotal again and scan that file again, post the results when finished.
__________________
Member of ASAP since 2007
Member of UNITE since 2008
**Notice to BT customers**
BT to dump Phorm, see Here for more information. No DPI
If we have helped you in anyway, please consider Donating
|