|
Registered User
Join Date: Sep 2008
Posts: 13
OS: windows xp sp2
|
Re: Google search redirected..sometimes
File ws2_32.dll received on 2009.07.07 13:02:18 (UTC)
Current status: finished
Result: 8/41 (19.51%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.07.07 Trojan.Win32.Patched!IK
AhnLab-V3 5.0.0.2 2009.07.07 -
AntiVir 7.9.0.204 2009.07.07 -
Antiy-AVL 2.0.3.1 2009.07.07 -
Authentium 5.1.2.4 2009.07.07 -
Avast 4.8.1335.0 2009.07.06 -
AVG 8.5.0.386 2009.07.07 Win32/Patched
BitDefender 7.2 2009.07.07 Trojan.Patched.EM
CAT-QuickHeal 10.00 2009.07.07 -
ClamAV 0.94.1 2009.07.07 -
Comodo 1538 2009.07.02 -
DrWeb 5.0.0.12182 2009.07.07 -
eSafe 7.0.17.0 2009.07.06 -
eTrust-Vet 31.6.6601 2009.07.07 -
F-Prot 4.4.4.56 2009.07.06 -
F-Secure 8.0.14470.0 2009.07.07 -
Fortinet 3.117.0.0 2009.07.03 -
GData 19 2009.07.07 Trojan.Patched.EM
Ikarus T3.1.1.64.0 2009.07.07 Trojan.Win32.Patched
Jiangmin 11.0.706 2009.07.07 -
K7AntiVirus 7.10.785 2009.07.06 -
Kaspersky 7.0.0.125 2009.07.07 -
McAfee 5668 2009.07.06 -
McAfee+Artemis 5668 2009.07.06 -
McAfee-GW-Edition 6.8.5 2009.07.07 Heuristic.LooksLike.Trojan.Patched.H
Microsoft 1.4803 2009.07.07 Trojan:Win32/Patched.L
NOD32 4222 2009.07.07 -
Norman 6.01.09 2009.07.07 -
nProtect 2009.1.8.0 2009.07.07 -
Panda 10.0.0.14 2009.07.06 -
PCTools 4.4.2.0 2009.07.07 -
Prevx 3.0 2009.07.07 -
Rising 21.37.14.00 2009.07.07 -
Sophos 4.43.0 2009.07.07 Mal/WSHack-A
Sunbelt 3.2.1858.2 2009.07.07 -
Symantec 1.4.4.12 2009.07.07 -
TheHacker 6.3.4.3.364 2009.07.06 -
TrendMicro 8.950.0.1094 2009.07.07 -
VBA32 3.12.10.7 2009.07.07 -
ViRobot 2009.7.7.1822 2009.07.07 -
VirusBuster 4.6.5.0 2009.07.06 -
Additional information
File size: 82432 bytes
MD5 : 9f4a1642f792de1035e9fcf698d439f3
SHA1 : 46342942cafad52d157e533e0e3629cf25ba1f94
SHA256: dc0bf1805aafbcb99bf5583d6eb8902426a8d87cd215226e993b95f49d47ad76
PEInfo: PE Structure information
( base data )
entrypointaddress.: 0x141A1
timedatestamp.....: 0x4802A164 (Mon Apr 14 02:12:20 2008)
machinetype.......: 0x14C (Intel I386)
( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x12153 0x12200 6.48 614dcfc35742ce1988d5ab7c8164961a
.data 0x14000 0x914 0xA00 5.91 855e5a6b0bd2fa86408cabe4befc1e92
.rsrc 0x15000 0x3F8 0x400 3.43 5ff68b649c14d167754073f671ef1ef1
.reloc 0x16000 0xDC8 0xE00 6.45 c841caa0b58d513a706567eff650ba0f
( 5 imports )
> advapi32.dll: RegNotifyChangeKeyValue, RegDeleteKeyA, RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegCreateKeyExA, RegCloseKey, RegEnumKeyExA
> kernel32.dll: GetTickCount, QueryPerformanceCounter, lstrcmpA, HeapReAlloc, HeapFree, HeapAlloc, InterlockedCompareExchange, IsBadWritePtr, GetEnvironmentVariableA, GetComputerNameA, GetVersionExA, GetSystemDirectoryA, GetWindowsDirectoryA, WaitForMultipleObjectsEx, ResetEvent, IsBadReadPtr, TlsSetValue, GetHandleInformation, ExpandEnvironmentStringsA, InterlockedExchange, GetCurrentThreadId, TlsAlloc, GetSystemInfo, HeapCreate, GetProcessHeap, HeapDestroy, TlsFree, lstrlenA, lstrcpyA, IsBadCodePtr, GetProcAddress, CreateEventA, GetModuleFileNameA, LoadLibraryA, CreateThread, FreeLibrary, WaitForSingleObject, CloseHandle, FreeLibraryAndExitThread, EnterCriticalSection, SetEvent, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, SwitchToThread, SetLastError, DelayLoadFailureHook, TlsGetValue, InterlockedDecrement, GetLastError, WideCharToMultiByte, MultiByteToWideChar, InitializeCriticalSection, DeleteCriticalSection, InterlockedIncrement, LeaveCriticalSection
> msvcrt.dll: __isascii, isspace, _except_handler3, sprintf, _adjust_fdiv, malloc, _initterm, free, _stricmp, fclose, fgets, atoi, strchr, fopen, wcscpy, strtoul, wcscmp, wcslen, wcschr
> ntdll.dll: RtlIpv4StringToAddressW, RtlIpv6StringToAddressExW, RtlIpv4StringToAddressA
> ws2help.dll: WahCompleteRequest, WahQueueUserApc, WahEnableNonIFSHandleSupport, WahDisableNonIFSHandleSupport, WahCreateSocketHandle, WahNotifyAllProcesses, WahCreateNotificationHandle, WahWaitForNotification, WahOpenCurrentThread, WahCloseThread, WahInsertHandleContext, WahRemoveHandleContext, WahDestroyHandleContextTable, WahCreateHandleContextTable, WahEnumerateHandleContexts, WahCloseApcHelper, WahCloseHandleHelper, WahCloseNotificationHandleHelper, WahOpenNotificationHandleHelper, WahOpenHandleHelper, WahOpenApcHelper, WahCloseSocketHandle, WahReferenceContextByHandle
( 1 exports )
> FreeAddrInfoW, GetAddrInfoW, GetNameInfoW, WEP, WPUCompleteOverlappedRequest, WSAAccept, WSAAddressToStringA, WSAAddressToStringW, WSAAsyncGetHostByAddr, WSAAsyncGetHostByName, WSAAsyncGetProtoByName, WSAAsyncGetProtoByNumber, WSAAsyncGetServByName, WSAAsyncGetServByPort, WSAAsyncSelect, WSACancelAsyncRequest, WSACancelBlockingCall, WSACleanup, WSACloseEvent, WSAConnect, WSACreateEvent, WSADuplicateSocketA, WSADuplicateSocketW, WSAEnumNameSpaceProvidersA, WSAEnumNameSpaceProvidersW, WSAEnumNetworkEvents, WSAEnumProtocolsA, WSAEnumProtocolsW, WSAEventSelect, WSAGetLastError, WSAGetOverlappedResult, WSAGetQOSByName, WSAGetServiceClassInfoA, WSAGetServiceClassInfoW, WSAGetServiceClassNameByClassIdA, WSAGetServiceClassNameByClassIdW, WSAHtonl, WSAHtons, WSAInstallServiceClassA, WSAInstallServiceClassW, WSAIoctl, WSAIsBlocking, WSAJoinLeaf, WSALookupServiceBeginA, WSALookupServiceBeginW, WSALookupServiceEnd, WSALookupServiceNextA, WSALookupServiceNextW, WSANSPIoctl, WSANtohl, WSANtohs, WSAProviderConfigChange, WSARecv, WSARecvDisconnect, WSARecvFrom, WSARemoveServiceClass, WSAResetEvent, WSASend, WSASendDisconnect, WSASendTo, WSASetBlockingHook, WSASetEvent, WSASetLastError, WSASetServiceA, WSASetServiceW, WSASocketA, WSASocketW, WSAStartup, WSAStringToAddressA, WSAStringToAddressW, WSAUnhookBlockingHook, WSAWaitForMultipleEvents, WSApSetPostRoutine, WSCDeinstallProvider, WSCEnableNSProvider, WSCEnumProtocols, WSCGetProviderPath, WSCInstallNameSpace, WSCInstallProvider, WSCUnInstallNameSpace, WSCUpdateProvider, WSCWriteNameSpaceOrder, WSCWriteProviderOrder, __WSAFDIsSet, accept, bind, closesocket, connect, freeaddrinfo, getaddrinfo, gethostbyaddr, gethostbyname, gethostname, getnameinfo, getpeername, getprotobyname, getprotobynumber, getservbyname, getservbyport, getsockname, getsockopt, htonl, htons, inet_addr, inet_ntoa, ioctlsocket, listen, ntohl, ntohs, recv, recvfrom, select, send, sendto, setsockopt, shutdown, socket
TrID : File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
ssdeep: 1536:aRqRCJAJcBuyg2A1htxvSrqtkBx5sALnR4lxCyqgY5:aR05JKBA1hrvSrMkBx5swR41j
PEiD : -
RDS : NSRL Reference Data Set
-
ATENTION ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.
|