Logghfghdfh

Switches begin
Switches end
Starting v4.2.0.27
FBUserToken: '332255490304934'
FBLocale: 'es_LA'
FBAttackId: '0'
User is Admin: YES
Vista or Higher: YES
IsWow64: YES
GetWorkDir: C:\Users\luiggi\AppData\Local\Temp\FBScanner_492860155
InitReport
SendReport_Init
Request query: 1443300579261932/malware_scanner
Request body: access_token=1443300579261932|cfedb1bd1113405e097902a8602d76ed&use
r_token=332255490304934&report={"report_type": "SCANNER_INIT",}&report_sig=BE40D
6EE5B9F256F5E45F79F4BD0B156&fwd_ip=127.0.0.1&version=4.2.0.27
Response: {"status":true}
# product=FBAV
# version=8
# FBAV_user_token=332255490304934
# FBAV_user_locale=es_LA
# FBAV_attack_id=0
# FBAV_status=0
# flags=3
# ESET.exe=4.3.0.27
# EOSSerial=6ecc73b0c1a8234a8e8cc5dd57d6da15
# end=init
# utc_time=2015-02-26 23:22:14
# local_time=2015-02-26 17:22:14 (-0600, Hora estndar central (Mxico))
# country="Chile"
# osver=6.2.9200 NT
INIT report sent to ESET
ExtractEsetsApi OK
r_token=332255490304934&report={"report_type": "SCANNER_PROGRESS","progress": 0,
}&report_sig=2B743F651544C758D4C21A49EB3CF23E&fwd_ip=127.0.0.1&version=4.2.0.27
Updating
Update Init
Update Download
}&report_sig=2B743F651544C758D4C21A49EB3CF23E&fwd_ip=127.0.0.1&version=4.2.0.27
}&report_sig=3DC900E65697E57238D5A919F32752B0&fwd_ip=127.0.0.1&version=4.2.0.27
}&report_sig=75A0CE906A36623A73C4ED76B6A0217A&fwd_ip=127.0.0.1&version=4.2.0.27
}&report_sig=3F8375609AB7F90439B42912269A53FD&fwd_ip=127.0.0.1&version=4.2.0.27
}&report_sig=3F8375609AB7F90439B42912269A53FD&fwd_ip=127.0.0.1&version=4.2.0.27
}&report_sig=B83D224A31F8D89576CEF0F835090260&fwd_ip=127.0.0.1&version=4.2.0.27
}&report_sig=6549E52B04F5AEF9EC9A5F5686A2AE29&fwd_ip=127.0.0.1&version=4.2.0.27
}&report_sig=FBACAFCD06E447A3452AD6479A1B4251&fwd_ip=127.0.0.1&version=4.2.0.27
}&report_sig=4240B5BB56D2736A78A996E9141278B3&fwd_ip=127.0.0.1&version=4.2.0.27
r_token=332255490304934&report={"report_type": "SCANNER_PROGRESS","progress": 10
,}&report_sig=AC171CBE639BC332E608EF298CB67001&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=EBDD954BFD00365A56399C4CE273139A&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=866AF33B0280EA61B17A3A36D3449D78&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=65F462285C29B03D265EE11A1AC06AB6&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=88B6B60B4797206A650127491C5C7B8E&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=88B6B60B4797206A650127491C5C7B8E&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=F03CDC54B63E3A0EDB6743119E6F2AFD&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=A1EE68F783791D7539778E705CD79F6A&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=BCCE58E7B42B5B9894C1B0A33C679EB8&fwd_ip=127.0.0.1&version=4.2.0.27
Update Finalize
,}&report_sig=BCCE58E7B42B5B9894C1B0A33C679EB8&fwd_ip=127.0.0.1&version=4.2.0.27
Updated modules version: 22665
# product=FBAV
# version=8
# FBAV_user_token=332255490304934
# FBAV_attack_id=0
# FBAV_status=0
# flags=3
# ESET.exe=4.3.0.27
# end=Updated
# utc_time=2015-02-26 23:22:14
# country="Chile"
# osver=6.2.9200 NT
UPDATED report sent to ESET
Initialize Scan
Scan
Scanner engine: 22665
,}&report_sig=6D15D3E1FF90784432A863B9D218F145&fwd_ip=127.0.0.1&version=4.2.0.27
Scanner engine: 22665
,}&report_sig=683999D8CE197C185692803FAF784D60&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=15C59BA62A56DADB58E6965C0FDCCEB6&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=043A37AA6E3791CBD945A869C44E880C&fwd_ip=127.0.0.1&version=4.2.0.27
r_token=332255490304934&report={"report_type": "SCANNER_DATA","event_type": "DET
ECTED","sample_name": "a variant of MSIL/Swiwgim.A worm","sample_id": "a variant
of MSIL/Swiwgim.A worm","sample_hashes": {"SHA1": "CFF583D0595CC17E4021375A1721
E8E054E79802",},}&report_sig=9E4336E376F83FC928FC7E5E747CD011&fwd_ip=127.0.0.1&v
ersion=4.2.0.27
r_token=332255490304934&report={"report_type": "SCANNER_DATA","event_type": "CLE
ANUP_SUCCESS","sample_name": "a variant of MSIL/Swiwgim.A worm","sample_id": "a
variant of MSIL/Swiwgim.A worm","sample_hashes": {"SHA1": "CFF583D0595CC17E40213
75A1721E8E054E79802",},}&report_sig=758CB68CE7FAB6E440886EA8285F376E&fwd_ip=127.
0.0.1&version=4.2.0.27
ECTED","sample_name": "a variant of Win32/PriceGong.A potentially unwanted appli

cation","sample_id": "a variant of Win32/PriceGong.A potentially unwanted applic
ation","sample_hashes": {"SHA1": "B5C93DA0C608B26C9487ABC49CCB643C9A15ED33",},}&
report_sig=7F2942E36C91DE6B88B80CFA5FD2EBF5&fwd_ip=127.0.0.1&version=4.2.0.27
ANUP_SUCCESS","sample_name": "a variant of Win32/PriceGong.A potentially unwante
d application","sample_id": "a variant of Win32/PriceGong.A potentially unwanted
application","sample_hashes": {"SHA1": "B5C93DA0C608B26C9487ABC49CCB643C9A15ED3
3",},}&report_sig=566F68087CFB3689B477444E82C85588&fwd_ip=127.0.0.1&version=4.2.
0.27
ECTED","sample_name": "Win64/Toolbar.Conduit.B potentially unwanted application"
,"sample_id": "Win64/Toolbar.Conduit.B potentially unwanted application","sample
_hashes": {"SHA1": "BE40C0251D66829CF63FD4341CACA785CAF5CD73",},}&report_sig=A1F
7102AFA268E974A726029CCF0B2F3&fwd_ip=127.0.0.1&version=4.2.0.27
ANUP_SUCCESS","sample_name": "Win64/Toolbar.Conduit.B potentially unwanted appli
cation","sample_id": "Win64/Toolbar.Conduit.B potentially unwanted application",
"sample_hashes": {"SHA1": "BE40C0251D66829CF63FD4341CACA785CAF5CD73",},}&report_
sig=AD05ACD7C81CF38B8FC8BFC8209282C7&fwd_ip=127.0.0.1&version=4.2.0.27
ECTED","sample_name": "Win32/Toolbar.Conduit.X potentially unwanted application"
,"sample_id": "Win32/Toolbar.Conduit.X potentially unwanted application","sample
_hashes": {"SHA1": "0F7B6B96202643D88E6428C62CA0BADC6D38D140",},}&report_sig=BDD
C35BB5758A37E1A62565458376A8A&fwd_ip=127.0.0.1&version=4.2.0.27
ANUP_SUCCESS","sample_name": "Win32/Toolbar.Conduit.X potentially unwanted appli
cation","sample_id": "Win32/Toolbar.Conduit.X potentially unwanted application",
"sample_hashes": {"SHA1": "0F7B6B96202643D88E6428C62CA0BADC6D38D140",},}&report_
sig=6A3F4C18FD0212B71B6EF290F78E8B41&fwd_ip=127.0.0.1&version=4.2.0.27
ECTED","sample_name": "a variant of Win32/Toolbar.Conduit.P potentially unwanted
application","sample_id": "a variant of Win32/Toolbar.Conduit.P potentially unw
anted application","sample_hashes": {"SHA1": "547EF42FB35708E8C39FE6D04DBF3DEDD9
1E73DB",},}&report_sig=317B043A5A80BDE602482CBBFDBD6F7D&fwd_ip=127.0.0.1&version
=4.2.0.27
ANUP_SUCCESS","sample_name": "a variant of Win32/Toolbar.Conduit.P potentially u
nwanted application","sample_id": "a variant of Win32/Toolbar.Conduit.P potentia
lly unwanted application","sample_hashes": {"SHA1": "547EF42FB35708E8C39FE6D04DB

F3DEDD91E73DB",},}&report_sig=9D79A09846BCC63F6A6314A8B9AF8CE1&fwd_ip=127.0.0.1&
version=4.2.0.27
ECTED","sample_name": "a variant of Win32/Toolbar.Conduit.X potentially unwanted
application","sample_id": "a variant of Win32/Toolbar.Conduit.X potentially unw
anted application","sample_hashes": {"SHA1": "6C02BC376864DF0440DE70DED3A65938D6
295795",},}&report_sig=19A8E3201E4D24A50F708722817938CE&fwd_ip=127.0.0.1&version
=4.2.0.27
ANUP_SUCCESS","sample_name": "a variant of Win32/Toolbar.Conduit.X potentially u
nwanted application","sample_id": "a variant of Win32/Toolbar.Conduit.X potentia
lly unwanted application","sample_hashes": {"SHA1": "6C02BC376864DF0440DE70DED3A
65938D6295795",},}&report_sig=35359E05A7800DFDB3B8C7DEC054B93A&fwd_ip=127.0.0.1&
version=4.2.0.27
ECTED","sample_name": "a variant of MSIL/Kryptik.LM trojan","sample_id": "a vari
ant of MSIL/Kryptik.LM trojan","sample_hashes": {"SHA1": "367BFFC0AE89ACCA929EDD
7FB7D4F58FBBBFF744",},}&report_sig=0DC07B45178FFAC4CCBC77DE99F191BF&fwd_ip=127.0
.0.1&version=4.2.0.27
ANUP_SUCCESS","sample_name": "a variant of MSIL/Kryptik.LM trojan","sample_id":
"a variant of MSIL/Kryptik.LM trojan","sample_hashes": {"SHA1": "367BFFC0AE89ACC
A929EDD7FB7D4F58FBBBFF744",},}&report_sig=9E5A59889D6E406AC3402371DF850232&fwd_i
p=127.0.0.1&version=4.2.0.27
ant of MSIL/Kryptik.LM trojan","sample_hashes": {"SHA1": "367BFFC0AE89ACCA929EDD
7FB7D4F58FBBBFF744",},}&report_sig=0DC07B45178FFAC4CCBC77DE99F191BF&fwd_ip=127.0
.0.1&version=4.2.0.27
"a variant of MSIL/Kryptik.LM trojan","sample_hashes": {"SHA1": "367BFFC0AE89ACC
A929EDD7FB7D4F58FBBBFF744",},}&report_sig=9E5A59889D6E406AC3402371DF850232&fwd_i
p=127.0.0.1&version=4.2.0.27
ant of MSIL/Kryptik.LM trojan","sample_hashes": {"SHA1": "7203F9CE4FF62ED752CEA9
F8B9B02A23D8C09C73",},}&report_sig=67B64004D9FA8B85406C97C184C466F2&fwd_ip=127.0
.0.1&version=4.2.0.27
"a variant of MSIL/Kryptik.LM trojan","sample_hashes": {"SHA1": "7203F9CE4FF62ED
752CEA9F8B9B02A23D8C09C73",},}&report_sig=DB1FECB99EA849C3723DB08FD2F0A466&fwd_i
p=127.0.0.1&version=4.2.0.27
ECTED","sample_name": "a variant of Win32/DepoDownloader.A potentially unwanted
application","sample_id": "a variant of Win32/DepoDownloader.A potentially unwan
ted application","sample_hashes": {"SHA1": "B7E20CF4C754502E1818CD3ABAFF32935DE7

0800",},}&report_sig=4E92C5CB52F02736FE371F87945D1753&fwd_ip=127.0.0.1&version=4
.2.0.27
ANUP_SUCCESS","sample_name": "a variant of Win32/DepoDownloader.A potentially un
wanted application","sample_id": "a variant of Win32/DepoDownloader.A potentiall
y unwanted application","sample_hashes": {"SHA1": "B7E20CF4C754502E1818CD3ABAFF3
2935DE70800",},}&report_sig=D51643BAB19BB8EA50E5F6F311450CCB&fwd_ip=127.0.0.1&ve
rsion=4.2.0.27
ECTED","sample_name": "a variant of MSIL/Spy.Keylogger.FP trojan","sample_id": "
a variant of MSIL/Spy.Keylogger.FP trojan","sample_hashes": {"SHA1": "184464C2A5
600DFF7D4FDF80F6CBC52E3014ACEB",},}&report_sig=7CB5477C4131A2CB9F14CAA2B7B698A5&
fwd_ip=127.0.0.1&version=4.2.0.27
ANUP_SUCCESS","sample_name": "a variant of MSIL/Spy.Keylogger.FP trojan","sample
_id": "a variant of MSIL/Spy.Keylogger.FP trojan","sample_hashes": {"SHA1": "184
464C2A5600DFF7D4FDF80F6CBC52E3014ACEB",},}&report_sig=A2FAC2ED5E0E9FDD9A32BA65F0
3C8141&fwd_ip=127.0.0.1&version=4.2.0.27
ECTED","sample_name": "a variant of MSIL/Swiwgim.A worm","sample_id": "a variant
of MSIL/Swiwgim.A worm","sample_hashes": {"SHA1": "64BCA3EF594CFB483D112F57A3B7
1F5842CDBD24",},}&report_sig=6315195DB7C4E6E6108DB0B35A102D07&fwd_ip=127.0.0.1&v
ersion=4.2.0.27
ANUP_SUCCESS","sample_name": "a variant of MSIL/Swiwgim.A worm","sample_id": "a
variant of MSIL/Swiwgim.A worm","sample_hashes": {"SHA1": "64BCA3EF594CFB483D112
F57A3B71F5842CDBD24",},}&report_sig=4AA51A8D61B731BE296AE6A598DE829A&fwd_ip=127.
0.0.1&version=4.2.0.27

ECTED","sample_name": "MSIL/FakeTool.CZ trojan","sample_id": "MSIL/FakeTool.CZ t
rojan","sample_hashes": {"SHA1": "573E55A864A880F342F127294F0EFCB86127C432",},}&
report_sig=CC18E7A41F8DA03B886E6C7847DB03C2&fwd_ip=127.0.0.1&version=4.2.0.27
ANUP_SUCCESS","sample_name": "MSIL/FakeTool.CZ trojan","sample_id": "MSIL/FakeTo
ol.CZ trojan","sample_hashes": {"SHA1": "573E55A864A880F342F127294F0EFCB86127C43
2",},}&report_sig=44F5206E9E5B67E569CF46FD35A77D71&fwd_ip=127.0.0.1&version=4.2.
0.27
,}&report_sig=2C0252EB82AD3C80EC89A0CB7CAC85F3&fwd_ip=127.0.0.1&version=4.2.0.27
,}&report_sig=E2A70107B3D066CEC3BFB72625E01640&fwd_ip=127.0.0.1&version=4.2.0.27





,}&report_sig=A6B8FCD063352026A7E9D4F37C6B13DA&fwd_ip=127.0.0.1&version=4.2.0.27


0,}&report_sig=38179CAEFE86A682F37B9182AAB91D97&fwd_ip=127.0.0.1&version=4.2.0.2
7
Reporting
# product=FBAV
# version=8
# FBAV_user_token=332255490304934
# FBAV_attack_id=0
# FBAV_status=0
# flags=3
# ESET.exe=4.3.0.27
# EOSSerial=6ecc73b0c1a8234a8e8cc5dd57d6da15
# engine=22665
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# sfx_checked=true
# utc_time=2015-02-26 23:22:14
# country="Chile"
# lang=1033
# osver=6.2.9200 NT
# compatibility_mode_1='Norton Internet Security'
# compatibility_mode=3595 16777213 100 91 0 186699607 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 76907961 84415534 0 0
# scanned=79048
# found=13
# cleaned=13
# scan_time=2635
sh=BF995A87B7E8F553A886D828AC01ACF390207C75 ft=0 fh=000000000000005c vn="" ac=S
fn="C:\Users\luiggi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aap
occlcgogkmnckokdopfmhonfmgoek\0.9_0\main.html"
sh=0FB42A8629292967C7B45A8752AC97B303841704 ft=0 fh=000000000000005f vn="" ac=S
fn="C:\Users\luiggi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aap
occlcgogkmnckokdopfmhonfmgoek\0.9_0\main.js"
fn="C:\Users\luiggi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoh
ghmighlieiainnegkcijnfilokake\0.9_0\main.html"
sh=FFE9A28CDE2E130F64CCB51A76DF3A453464BE19 ft=0 fh=000000000000005b vn="" ac=S
fn="C:\Users\luiggi\AppData\Local\Google\Chrome\User Data\Default\Extensions\aoh
ghmighlieiainnegkcijnfilokake\0.9_0\main.js"
fn="C:\Users\luiggi\AppData\Local\Google\Chrome\User Data\Default\Extensions\fel
caaldnbdncclmgdcncolpebgiejap\1.1_0\main.html"
sh=C905665276FF5DBA2D052AD4C11588C3172F81F8 ft=0 fh=000000000000005f vn="" ac=S
fn="C:\Users\luiggi\AppData\Local\Google\Chrome\User Data\Default\Extensions\fel
caaldnbdncclmgdcncolpebgiejap\1.1_0\main.js"
sh=B8589AF913BADE1E35D9E1689ED6CF5A54C0A6A5 ft=0 fh=0000000000000f83 vn="" ac=S
fn="C:\Users\luiggi\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkf
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_ADD_CARDS.PNG"
sh=199D9E7988D50EEC45E31982CDDAE3F9A7928FBA ft=0 fh=0000000000001b20 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_ADD_LOGINS.PNG
"
sh=881C578CF949B66AB1E98BDF22004CA164FF2462 ft=0 fh=0000000000000e0c vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_ADD_NOTES.PNG"
sh=7155D7C563D8B94ABEB489D9D68D28F2E46EF933 ft=0 fh=0000000000002d75 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_AMAZON.PNG"
sh=2964A07E5FEF51360D033341C2CC500F130B1FB2 ft=0 fh=0000000000002206 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_EBAY.PNG"
sh=1A0AFB710BA9899D246F1E3080573F7F73E8DC2D ft=0 fh=000000000000415e vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_FACEBOOK.PNG"
sh=F7C695C02C6D14C8DEB820B402596D2BB88AFC40 ft=0 fh=0000000000001f61 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_GMAIL.PNG"
sh=071BC74674A533240E448A4AF7C1FC8E7DCDE064 ft=0 fh=0000000000001a6e vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_LINKEDIN.PNG"
sh=DC90C8F21D205FBFC8DCB84BD05C93EFB805C954 ft=0 fh=00000000000031fd vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_NETFLIX.PNG"
sh=678006C0CB01D9DD866076AEB68E044D41FCE805 ft=0 fh=0000000000001a45 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_TWITTER.PNG"
sh=C7CD68826C983D658E5A8325771677BF56C439E1 ft=0 fh=0000000000001ded vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_YMAIL.PNG"
sh=C644A95468C0D7B250665AA708EDA3850F7AC3E4 ft=0 fh=0000000000003716 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\BOOKMARK_YOUTUBE.PNG"
sh=95615E8C93C4D94B76DC81AC27D4B9EDC68F7E50 ft=0 fh=0000000000000265 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\CLOSE_CLICK_HOMEPAGE.PN
G"
sh=F61497E3060964A8F6762124E1EAB0A69C1F7B7E ft=0 fh=00000000000002b3 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\CLOSE_CLICK_HOVER.PNG"
sh=A9BEF977A260D7191F514D6B09F8C1D21F7D6BFB ft=0 fh=00000000000002a3 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\CLOSE_CLICK_NORMAL.PNG"
sh=230DC555DF0DEA96F77EB28FC715122ECC98F54A ft=0 fh=0000000000000c2f vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\FAVICON_FACEBOOK.PNG"
sh=930DA01233FBDDCD7B01BE1E6ACEC69B8B05549F ft=0 fh=0000000000000cc0 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\FAVICON_GMAIL.PNG"
sh=CF935FCD24CDD275A6C731F82BF00C8DB1984486 ft=0 fh=0000000000000dcd vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\FAVICON_LINKEDIN.PNG"
sh=BE60C4417E4B857AD5C0CC411FE6432D6C532A4B ft=0 fh=0000000000000cf5 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\FAVICON_TWITTER.PNG"
sh=037B0DA74F11EC071A53C80C8927E5D82055B57A ft=0 fh=0000000000000d87 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\FAVICON_YAHOO.PNG"
sh=243B45E0CECD01089CE450CDB3E3D0544AC5FFFF ft=0 fh=0000000000013c84 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\IdentitySafe.html"
sh=DF12D48569BF810F16A0282AB23C13DE56D7395C ft=0 fh=000000000000530d vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\IdentitySafe\IdentitySafeTutorial.ht
ml"
sh=C3F088C1CCC9E6E6006D9062691C39A99D87CFE1 ft=0 fh=0000000000000469 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\RedirectPages\BrowserBadRedirect.htm
l"
sh=7D1A0B97E7A715251B9D97C01C577116F345811E ft=0 fh=0000000000000a83 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\RedirectPages\KBRedirect.css"
sh=11435DE33B174BF81AFC573EE19DE6D2764C4D0F ft=0 fh=0000000000000470 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\RedirectPages\KnownBadRedirect.html"
sh=546015AFEEAA76B308E10559A540FB072204315C ft=0 fh=0000000000000473 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\RedirectPages\PageBadRedirect.html"
sh=F692DF05C41CE11EB0E1719FDAF65A630EE50351 ft=0 fh=00000000000004f6 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\RedirectPages\RedirectPages.js"
sh=3C4F1EEFB5DA90EFEDBDDD87914E239EBCA2404F ft=0 fh=000000000000046b vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\RedirectPages\SuspiciousRedirect.htm
l"
sh=D3933BB41499C71466AEBBD3A0196778751F5637 ft=0 fh=0000000000001a53 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\background.html"
sh=953AA21A6A94623006F4074DA9EB07B6BFC9A62D ft=0 fh=000000000000079d vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\docend.js"
sh=02A91FE560C19ED1E7B4668F68BCE93CD783CBE9 ft=0 fh=0000000000000fc1 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\docstart.js"
sh=DB1D8BF8425CB9B2084A015E2376DBF2D8B574B6 ft=0 fh=0000000000000055 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\isolate.ini"
sh=963AD111CEBEEC8EA1BEB6F5ECB508811CFF07E3 ft=1 fh=00000000000e8b98 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\npcoplgn.dll"
sh=4765C0705929A6CC7AF54E80CF4E48FC79D40832 ft=0 fh=000000000000b252 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\wax.js"
sh=BE9B1A15197F5D80C7CA35FF36D9346E1266AEFF ft=0 fh=0000000000005721 vn="" ac=S
okfffehpeedafpekjeddnmnjhmcmk\2013.0.0.72_0\wcid.js"
sh=A4AC74DD258E8E0689034FAA1B15A5C7C56DC3BB ft=0 fh=00000000000006cd vn="" ac=S
fn="C:\Users\luiggi\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmm
hkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\css\craw_window.css"
sh=8B4EAA74D31EED5B0BABA3CA5460201F6B10DA46 ft=0 fh=000000000000032a vn="" ac=S
hkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\html\craw_window.html"
sh=D591287E341F1E6A5EDA97D95AB240CF2841955F ft=0 fh=000000000001ee95 vn="" ac=S
hkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\craw_background.js"
sh=7526791878FE91ED075382C2B432A43A47EE7DCD ft=0 fh=00000000000264e7 vn="" ac=S
hkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\craw_window.js"
sh=CFF583D0595CC17E4021375A1721E8E054E79802 ft=0 fh=000000000004b3b8 vn="a varia
nt of MSIL/Swiwgim.A worm (deleted)" ac=C fn="C:\Users\luiggi\AppData\Local\Temp
\FBScanner_492860155\966014556742080.exe"
sh=B5C93DA0C608B26C9487ABC49CCB643C9A15ED33 ft=1 fh=0000000000071238 vn="a varia
nt of Win32/PriceGong.A potentially unwanted application (cleaned by deleting)"
ac=C fn="C:\Users\luiggi\AppData\LocalLow\uTorrentBar_ES\plugins\{5E1360DC-8FA840df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll"
sh=BE40C0251D66829CF63FD4341CACA785CAF5CD73 ft=1 fh=0000000000132920 vn="Win64/T
oolbar.Conduit.B potentially unwanted application (cleaned by deleting)" ac=C fn
="C:\Users\luiggi\AppData\LocalLow\uTorrentBar_ES\hk64tbuTor.dll"
sh=0F7B6B96202643D88E6428C62CA0BADC6D38D140 ft=1 fh=0000000000102720 vn="Win32/T
oolbar.Conduit.X potentially unwanted application (cleaned by deleting)" ac=C fn
="C:\Users\luiggi\AppData\LocalLow\uTorrentBar_ES\hktbuTor.dll"
sh=547EF42FB35708E8C39FE6D04DBF3DEDD91E73DB ft=1 fh=0000000000051520 vn="a varia
nt of Win32/Toolbar.Conduit.P potentially unwanted application (cleaned by delet
ing)" ac=C fn="C:\Users\luiggi\AppData\LocalLow\uTorrentBar_ES\ldrtbuTor.dll"
sh=6C02BC376864DF0440DE70DED3A65938D6295795 ft=1 fh=00000000004efb20 vn="a varia
nt of Win32/Toolbar.Conduit.X potentially unwanted application (cleaned by delet
ing)" ac=C fn="C:\Users\luiggi\AppData\LocalLow\uTorrentBar_ES\tbuTor.dll"

sh=367BFFC0AE89ACCA929EDD7FB7D4F58FBBBFF744 ft=1 fh=0000000000082c00 vn="a varia
nt of MSIL/Kryptik.LM trojan (cleaned by deleting)" ac=C fn="C:\Users\luiggi\App
Data\dfecj.exe"
sh=367BFFC0AE89ACCA929EDD7FB7D4F58FBBBFF744 ft=1 fh=0000000000082c00 vn="a varia
Data\fkrel.exe"
sh=7203F9CE4FF62ED752CEA9F8B9B02A23D8C09C73 ft=1 fh=000000000007cc00 vn="a varia
Data\fkujv.exe"
sh=B7E20CF4C754502E1818CD3ABAFF32935DE70800 ft=1 fh=00000000000353d0 vn="a varia
nt of Win32/DepoDownloader.A potentially unwanted application (cleaned by deleti
ng)" ac=C fn="C:\Users\luiggi\Desktop\{265D75E0-3FB2-4F4A-B980-B30F6D833DAC}.tmp
"
sh=184464C2A5600DFF7D4FDF80F6CBC52E3014ACEB ft=0 fh=00000000000043c4 vn="a varia
nt of MSIL/Spy.Keylogger.FP trojan (deleted)" ac=C fn="C:\Users\luiggi\Downloads
\ForceOP.zip"
sh=64BCA3EF594CFB483D112F57A3B71F5842CDBD24 ft=1 fh=000000000007a400 vn="a varia
nt of MSIL/Swiwgim.A worm (cleaned by deleting)" ac=C fn="C:\Users\luiggi\Downlo
ads\Minecraft ForceOP.exe"
sh=573E55A864A880F342F127294F0EFCB86127C432 ft=1 fh=00000000000a2400 vn="MSIL/Fa
keTool.CZ trojan (cleaned by deleting)" ac=C fn="C:\Users\luiggi\Xbox 360 Emulat
or.exe"
EOS report sent
r_token=332255490304934&report={"report_type": "SCANNER_COMPLETE",}&report_sig=9
C734DE4A183E52F911281E9D10DE4BF&fwd_ip=127.0.0.1&version=4.2.0.27
FB Complete sent
Finalizing
Cleaning up
RecursiveRemoveDirectoryAndAllFiles: C:\Users\luiggi\AppData\Local\Temp\FBScanne
r_492860155\Modules\

Logghfghdfh

Transféré par

Informations du document

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Logghfghdfh

Transféré par

Droits d'auteur :

Formats disponibles

Switches begin

ECTED","sample_name": "a variant of Win32/PriceGong.A potentially unwanted appli

lly unwanted application","sample_hashes": {"SHA1": "547EF42FB35708E8C39FE6D04DB

ted application","sample_hashes": {"SHA1": "B7E20CF4C754502E1818CD3ABAFF32935DE7

Request query: 1443300579261932/malware_scanner

Request query: 1443300579261932/malware_scanner

Request query: 1443300579261932/malware_scanner

Request query: 1443300579261932/malware_scanner

Request query: 1443300579261932/malware_scanner

Request query: 1443300579261932/malware_scanner

Request query: 1443300579261932/malware_scanner

Request query: 1443300579261932/malware_scanner

ing)" ac=C fn="C:\Users\luiggi\AppData\LocalLow\uTorrentBar_ES\tbuTor.dll"

Vous aimerez peut-être aussi