Suite VIRUS DETECTE PAR AVIRA (pour FoxRiver)Résolu/Fermé

Question

Bonjour,

Voici le 1er rapport:

Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.24 	2009.08.01 	-
AhnLab-V3 	5.0.0.2 	2009.08.01 	-
AntiVir 	7.9.0.238 	2009.07.31 	APPL/KillApp.A
Antiy-AVL 	2.0.3.7 	2009.07.31 	-
Authentium 	5.1.2.4 	2009.08.01 	-
Avast 	4.8.1335.0 	2009.07.31 	-
AVG 	8.5.0.406 	2009.08.01 	-
BitDefender 	7.2 	2009.08.01 	-
CAT-QuickHeal 	10.00 	2009.07.30 	-
ClamAV 	0.94.1 	2009.08.01 	-
Comodo 	1836 	2009.08.01 	-
DrWeb 	5.0.0.12182 	2009.08.01 	-
eSafe 	7.0.17.0 	2009.07.30 	-
eTrust-Vet 	31.6.6650 	2009.08.01 	-
F-Prot 	4.4.4.56 	2009.08.01 	-
F-Secure 	8.0.14470.0 	2009.07.31 	-
Fortinet 	3.120.0.0 	2009.08.01 	-
GData 	19 	2009.08.01 	-
Ikarus 	T3.1.1.64.0 	2009.08.01 	-
Jiangmin 	11.0.800 	2009.08.01 	-
K7AntiVirus 	7.10.808 	2009.08.01 	-
Kaspersky 	7.0.0.125 	2009.08.01 	-
McAfee 	5694 	2009.07.31 	potentially unwanted program ProcKill-BU
McAfee+Artemis 	5694 	2009.07.31 	potentially unwanted program ProcKill-BU
McAfee-GW-Edition 	6.8.5 	2009.08.01 	Riskware.KillApp.A
Microsoft 	1.4903 	2009.08.01 	-
NOD32 	4296 	2009.08.01 	-
Norman 	6.01.09 	2009.07.31 	-
nProtect 	2009.1.8.0 	2009.08.01 	-
Panda 	10.0.0.14 	2009.08.01 	-
PCTools 	4.4.2.0 	2009.08.01 	-
Prevx 	3.0 	2009.08.01 	-
Rising 	21.40.44.00 	2009.07.31 	-
Sophos 	4.44.0 	2009.08.01 	Kill It
Sunbelt 	3.2.1858.2 	2009.07.31 	-
Symantec 	1.4.4.12 	2009.08.01 	-
TheHacker 	6.3.4.3.375 	2009.08.01 	-
TrendMicro 	8.950.0.1094 	2009.07.31 	-
VBA32 	3.12.10.9 	2009.08.01 	-
ViRobot 	2009.7.31.1863 	2009.07.31 	-
VirusBuster 	4.6.5.0 	2009.07.31 	-
Information additionnelle
File size: 55296 bytes
MD5   : fb9f5efc10280f3659dce48069725c3c
SHA1  : 71b68fb0e9ef62251687a509ee1b210e032ca3ef
SHA256: 0dfc621ceda95d297c34951272311e1f7f433d07810da65b233bf7241ada68ad
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp.....: 0x37E16202 (Thu Sep 16 23:32:50 1999)
machinetype.......: 0x14C (Intel I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xA000 0x9200 6.60 5b6c86dd42883b5c46ade2a84fbd4a65
.data 0xB000 0x6000 0x2800 4.82 f1b174cc040cf4e6468a05adc66905c6
.tls 0x11000 0x1000 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b
.rdata 0x12000 0x1000 0x200 0.21 0df4bd0c02c5a4849424e4ac5ac9bd03
.idata 0x13000 0x1000 0x600 5.01 5950269e1f31a7fe07fb4f9c630299df
.edata 0x14000 0x1000 0x200 1.23 d5a5ecc0449f4ea96b58398cab9eebb8
.rsrc 0x15000 0x1000 0x200 0.93 a4bb7cd7f55ec165cd12688bb9c882c0
.reloc 0x16000 0x1000 0xA00 6.17 1c52ff4322b660d14cce8352e373d17a

( 2 imports )

> kernel32.dll: CloseHandle, CreateFileA, CreateToolhelp32Snapshot, EnterCriticalSection, ExitProcess, GetACP, GetCPInfo, GetCommandLineA, GetCurrentThreadId, GetEnvironmentStrings, GetFileType, GetLastError, GetLocalTime, GetModuleFileNameA, GetModuleHandleA, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetStdHandle, GetStringTypeW, GetVersion, GetVersionExA, GlobalMemoryStatus, HeapAlloc, HeapFree, InitializeCriticalSection, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, OpenProcess, Process32First, Process32Next, RaiseException, RtlUnwind, SetConsoleCtrlHandler, SetFilePointer, SetHandleCount, Sleep, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualFree, VirtualQuery, WideCharToMultiByte, WriteFile
> user32.dll: EnumThreadWindows, EnumWindows, GetWindowModuleFileNameA, MessageBoxA, PostMessageA, wsprintfA

( 1 exports )

> __GetExceptDLLinfo, ___CPPdebugHook
TrID  : File type identification
DOS Executable Borland C++ (39.2%)
Win32 Executable Generic (25.7%)
Win32 Dynamic Link Library (generic) (22.8%)
Generic Win/DOS Executable (6.0%)
DOS Executable Generic (6.0%)
ThreatExpert: https://www.symantec.com?md5=fb9f5efc10280f3659dce48069725c3c
ssdeep: 768:clLBQVqMXdcotA2XPCtCcBbbdpv/h62grynogB5cVY6laJQGMGyDNtXoso:sQV5HA26TBHzv/02CynDB5SJlbGMGAV
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=34D45A33003571DDD8AB004020A30600771CB58D
PEiD  : -
RDS   : NSRL Reference Data Set
-

Et le 2ème :

Antivirus 	Version 	Dernière mise à jour 	Résultat
a-squared 	4.5.0.24 	2009.07.31 	-
AhnLab-V3 	5.0.0.2 	2009.07.31 	-
AntiVir 	7.9.0.238 	2009.07.31 	APPL/ACLSet
Antiy-AVL 	2.0.3.7 	2009.07.31 	-
Authentium 	5.1.2.4 	2009.07.31 	-
Avast 	4.8.1335.0 	2009.07.31 	-
AVG 	8.5.0.406 	2009.07.31 	-
BitDefender 	7.2 	2009.08.01 	-
CAT-QuickHeal 	10.00 	2009.07.30 	-
ClamAV 	0.94.1 	2009.08.01 	-
Comodo 	1832 	2009.08.01 	-
DrWeb 	5.0.0.12182 	2009.08.01 	-
eSafe 	7.0.17.0 	2009.07.30 	-
eTrust-Vet 	31.6.6650 	2009.08.01 	-
F-Prot 	4.4.4.56 	2009.07.31 	-
F-Secure 	8.0.14470.0 	2009.07.31 	-
Fortinet 	3.120.0.0 	2009.08.01 	-
GData 	19 	2009.08.01 	-
Ikarus 	T3.1.1.64.0 	2009.07.31 	-
Jiangmin 	11.0.800 	2009.08.01 	-
K7AntiVirus 	7.10.807 	2009.07.31 	-
Kaspersky 	7.0.0.125 	2009.08.01 	-
McAfee 	5694 	2009.07.31 	-
McAfee+Artemis 	5694 	2009.07.31 	-
McAfee-GW-Edition 	6.8.5 	2009.08.01 	Riskware.ACLSet
Microsoft 	1.4903 	2009.08.01 	-
NOD32 	4295 	2009.07.31 	-
Norman 	6.01.09 	2009.07.31 	-
nProtect 	2009.1.8.0 	2009.08.01 	-
Panda 	10.0.0.14 	2009.07.31 	-
PCTools 	4.4.2.0 	2009.07.31 	-
Prevx 	3.0 	2009.08.01 	-
Rising 	21.40.44.00 	2009.07.31 	-
Sophos 	4.44.0 	2009.08.01 	-
Sunbelt 	3.2.1858.2 	2009.07.31 	-
Symantec 	1.4.4.12 	2009.08.01 	-
TheHacker 	6.3.4.3.375 	2009.08.01 	-
TrendMicro 	8.950.0.1094 	2009.07.31 	-
VBA32 	3.12.10.9 	2009.07.31 	-
ViRobot 	2009.7.31.1863 	2009.07.31 	-
VirusBuster 	4.6.5.0 	2009.07.31 	-
Information additionnelle
File size: 258048 bytes
MD5   : 19bb0722fdbeb638df3b66b1ac1552f1
SHA1  : 7d9f036a3b49b9b9c6b0eb41b789837e188a8da0
SHA256: 4c3e18a58be2b15784a3460c7d49f1b50755dd3ccef8003d15aa7b2ae847e748
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x16DDD
timedatestamp.....: 0x40191F8E (Thu Jan 29 15:58:22 2004)
machinetype.......: 0x14C (Intel I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2BA54 0x2C000 6.53 0e320b2a7b5012aba48fc1e36ac1cdf2
.rdata 0x2D000 0xD7EC 0xE000 4.57 1d8214904ba63e4c2e811352cda3fbe8
.data 0x3B000 0x5478 0x2000 3.41 3dcc9a9fd1a4ba4b3188e9ca9184b0b4
.rsrc 0x41000 0x10C0 0x2000 2.05 770862aecb9d6b7145778829e1ff2f45

( 0 imports )


( 0 exports )
TrID  : File type identification
Win32 Executable MS Visual C++ (generic) (53.1%)
Windows Screen Saver (18.4%)
Win32 Executable Generic (12.0%)
Win32 Dynamic Link Library (generic) (10.6%)
Generic Win/DOS Executable (2.8%)
ThreatExpert: https://www.symantec.com?md5=19bb0722fdbeb638df3b66b1ac1552f1
ssdeep: 6144:0d2ixsDAM3VUVuQxBNua1sT4Q74QcnCxY:kxcVQxzB1sRcC
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=412FD6A3002BA635F0420308557DD800C5E297BD
PEiD  : -
RDS   : NSRL Reference Data Set

( Symantec )

Symantec Endpoint Protection 11.0: setacl.exe


Merci pour ton analyse.

A tout'

FoxRiver · Answer

ok.. alor laisse tomber c'est des faux positifs car a chaque fois seul avira et mcafee les détectent et pas d'autres grandes pointures comme G-DATA ou kaspersky ou encore Avast dont les résultats sont proches d'avira..

voila a+

Suite VIRUS DETECTE PAR AVIRA (pour FoxRiver)

1 réponse

Discussions similaires

Newsletters