File size 70,656 bytes
MD5: 76A4263444E2DA0AD720F83CA560BC5E
SHA-1: B6E756EB714C17D1A570909B1C58964F5021BFF0
================================================
...
| Antivirus | Version | Last Update | Result |
|---|---|---|---|
| a-squared | 4.5.0.48 | 2010.01.11 | - |
| AhnLab-V3 | 5.0.0.2 | 2010.01.10 | - |
| AntiVir | 7.9.1.134 | 2010.01.11 | TR/Crypt.XPACK.Gen |
| Antiy-AVL | 2.0.3.7 | 2010.01.11 | - |
| Authentium | 5.2.0.5 | 2010.01.10 | - |
| Avast | 4.8.1351.0 | 2010.01.10 | - |
| AVG | 9.0.0.725 | 2010.01.11 | Win32/Cryptor |
| BitDefender | 7.2 | 2010.01.11 | - |
| CAT-QuickHeal | 10.00 | 2010.01.11 | - |
| ClamAV | 0.94.1 | 2010.01.11 | - |
| Comodo | 3545 | 2010.01.11 | - |
| DrWeb | 5.0.1.12222 | 2010.01.11 | - |
| eSafe | 7.0.17.0 | 2010.01.10 | - |
| eTrust-Vet | 35.2.7229 | 2010.01.11 | - |
| F-Prot | 4.5.1.85 | 2010.01.10 | - |
| F-Secure | 9.0.15370.0 | 2010.01.11 | Suspicious:W32/Malware!Gemini |
| Fortinet | 4.0.14.0 | 2010.01.09 | - |
| GData | 19 | 2010.01.11 | - |
| Ikarus | T3.1.1.80.0 | 2010.01.11 | - |
| Jiangmin | 13.0.900 | 2010.01.11 | - |
| K7AntiVirus | 7.10.943 | 2010.01.09 | - |
| Kaspersky | 7.0.0.125 | 2010.01.11 | - |
| McAfee | 5857 | 2010.01.10 | - |
| McAfee+Artemis | 5857 | 2010.01.10 | - |
| McAfee-GW-Edition | 6.8.5 | 2010.01.11 | Heuristic.LooksLike.Trojan.PCK.Tdss.B |
| Microsoft | 1.5302 | 2010.01.11 | - |
| NOD32 | 4760 | 2010.01.11 | - |
| Norman | 6.04.03 | 2010.01.10 | - |
| nProtect | 2009.1.8.0 | 2010.01.11 | - |
| Panda | 10.0.2.2 | 2010.01.10 | - |
| PCTools | 7.0.3.5 | 2010.01.11 | - |
| Rising | 22.30.00.05 | 2010.01.11 | - |
| Sophos | 4.49.0 | 2010.01.11 | Sus/UnkPack-C |
| Sunbelt | 3.2.1858.2 | 2010.01.10 | Packed.Win32.TDSS.aa.3 (v) |
| Symantec | 20091.2.0.41 | 2010.01.11 | - |
| TheHacker | 6.5.0.3.146 | 2010.01.11 | - |
| TrendMicro | 9.120.0.1004 | 2010.01.11 | - |
| VBA32 | 3.12.12.1 | 2010.01.11 | - |
| ViRobot | 2010.1.11.2130 | 2010.01.11 | - |
| VirusBuster | 5.0.21.0 | 2010.01.10 | - |
--------------------------------------------------------------------------------
Files Created
%System32%\drivers\H8SRTd.sys
%System32%\system32\H8SRTyqaimejbpo.dll
%System32%\system32\H8SRTonklkwjqdf.dat
%System32% = C:\WINDOWS\system32
Keys added
HKLM\SOFTWARE\InstallShield
HKLM\SOFTWARE\InstallShield\Driver
HKLM\SOFTWARE\InstallShield\Driver\11
HKLM\SOFTWARE\InstallShield\Driver\11\Intel32
HKLM\SYSTEM\ControlSet001\Services\HDAudBus
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Security
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Enum
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Security
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Enum
Values added
HKLM\SOFTWARE\InstallShield\Driver\11\Intel32\
Folder: "C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\"
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Enum\
0: "PCI\VEN_8086&DEV_27D8&SUBSYS_303B17AA&REV_01\3&11583659&0&D8"
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Enum\
Count: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Enum\
NextInstance: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Security\
Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Type: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Start: 0x00000003
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\ErrorControl: 0x00000001
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Tag: 0x00000007
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\
ImagePath: "system32\DRIVERS\HDAudBus.sys"
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\
DisplayName: "Microsoft UAA Bus Driver for High Definition Audio"
HKLM\SYSTEM\ControlSet001\Services\HDAudBus\Group: "Extended Base"
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Enum\
0: "PCI\VEN_8086&DEV_27D8&SUBSYS_303B17AA&REV_01\3&11583659&0&D8"
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Enum\
Count: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Enum\
NextInstance: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Security\Security: 01 00 14 80 90 00 00 00 9C 00 00 00 14 00 00 00 30 00 00 00 02 00 1C 00 01 00 00 00 02 80 14 00 FF 01 0F 00 01 01 00 00 00 00 00 01 00 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 FD 01 02
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Type: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Start: 0x00000003
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\ErrorControl: 0x00000001
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Tag: 0x00000007
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\
ImagePath: "system32\DRIVERS\HDAudBus.sys"
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\
DisplayName: "Microsoft UAA Bus Driver for High Definition Audio"
HKLM\SYSTEM\CurrentControlSet\Services\HDAudBus\Group: "Extended Base"
Values modified
HKLM\SYSTEM\ControlSet001\Services\wscsvc\Start: 0x00000004
HKLM\SYSTEM\CurrentControlSet\Services\wscsvc\Start: 0x00000004
...
No comments:
Post a Comment