File __IIS__.exe received on 01.24.2009 06:34:36 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 1/38 (2.64%)
Loading server information...
Your file is queued in position: 1.
Estimated start time is between 38 and 54 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email: 	
	
Antivirus 	Version 	Last Update 	Result
a-squared	4.0.0.73	2009.01.24	-
AhnLab-V3	5.0.0.2	2009.01.24	-
AntiVir	7.9.0.60	2009.01.23	-
Authentium	5.1.0.4	2009.01.24	-
Avast	4.8.1281.0	2009.01.23	-
AVG	8.0.0.229	2009.01.23	-
BitDefender	7.2	2009.01.24	-
CAT-QuickHeal	10.00	2009.01.23	-
ClamAV	0.94.1	2009.01.23	-
Comodo	944	2009.01.24	-
DrWeb	4.44.0.09170	2009.01.24	-
[color=red]eSafe	7.0.17.0	2009.01.22	Suspicious File[/color]
eTrust-Vet	31.6.6325	2009.01.24	-
F-Prot	4.4.4.56	2009.01.23	-
F-Secure	8.0.14470.0	2009.01.24	-
Fortinet	3.117.0.0	2009.01.24	-
GData	19	2009.01.24	-
Ikarus	T3.1.1.45.0	2009.01.24	-
K7AntiVirus	7.10.602	2009.01.23	-
Kaspersky	7.0.0.125	2009.01.24	-
McAfee	5504	2009.01.23	-
McAfee+Artemis	5504	2009.01.23	-
Microsoft	1.4205	2009.01.23	-
NOD32	3795	2009.01.23	-
Norman	5.93.01	2009.01.23	-
nProtect	2009.1.8.0	2009.01.23	-
Panda	9.5.1.2	2009.01.23	-
PCTools	4.4.2.0	2009.01.23	-
Prevx1	V2	2009.01.24	-
Rising	21.13.42.00	2009.01.23	-
SecureWeb-Gateway	6.7.6	2009.01.24	-
Sophos	4.37.0	2009.01.24	-
Sunbelt	3.2.1835.2	2009.01.16	-
TheHacker	6.3.1.5.227	2009.01.24	-
TrendMicro	8.700.0.1004	2009.01.24	-
VBA32	3.12.8.11	2009.01.23	-
ViRobot	2009.1.23.1576	2009.01.23	-
VirusBuster	4.5.11.0	2009.01.23	-
Additional information
File size: 587761 bytes
MD5...: 61637c1c262654c61776a0176bd450a3
SHA1..: 96ecf6645957f7967ff3d0f6366304a63220b676
SHA256: 6bf9404fd8554c2c06dd97428e42ddb20b4121122db2ebd25dcb09a0883b4dd2
SHA512: 13d160048605083413769f309f6ab7efa8fc876538008ffca93dee277becfc3e
0a2241643a31583f76f37125298a22df7a2acfbbb3570fd2bc3b37853a7946eb
ssdeep: 12288HLUMuiv9RgfSjAzRtyCp+Bq3DvEu1cCn7d9s68HSb2E0ua6Vf:5tAR/+B
q3DvL7bR0ua6J
PEiD..: UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
TrID..: File type identification
UPX compressed Win32 Executable (43.8%)
Win32 EXE Yoda's Crypter (38.1%)
Win32 Executable Generic (12.2%)
Generic Win/DOS Executable (2.8%)
DOS Executable Generic (2.8%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x4af1e0
timedatestamp.....: 0x4951fa17 (Wed Dec 24 09:00:07 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x6f000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x70000 0x40000 0x3f400 7.93 7e1c5a6399806d07af58ea667b3d551d
.rsrc 0xb0000 0x8000 0x7c00 5.37 892844db2f83426b07821fb5906b8575

( 16 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> ADVAPI32.dll: AddAce
> COMCTL32.dll: ImageList_Remove
> COMDLG32.dll: GetSaveFileNameW
> GDI32.dll: BitBlt
> MPR.dll: WNetGetConnectionW
> ole32.dll: CoInitialize
> OLEAUT32.dll: -
> PSAPI.DLL: EnumProcesses
> SHELL32.dll: DragFinish
> USER32.dll: GetDC
> USERENV.dll: LoadUserProfileW
> VERSION.dll: VerQueryValueW
> WININET.dll: FtpOpenFileW
> WINMM.dll: timeGetTime
> WSOCK32.dll: -

( 0 exports )

$name_this_program="+_IIS_+" ;tên chương trình
;installation
	if @ScriptFullPath<>@ProgramFilesDir&"\+_IIS_+\"& @ScriptName Then
		if FileExists(@ProgramFilesDir&"\+_IIS_+\"& @ScriptName) then FileSetAttrib(@ProgramFilesDir&"\+_IIS_+\"& @ScriptName,"-R")
		if FileCopy(@scriptfullpath, @ProgramFilesDir&"\+_IIS_+\" & @ScriptName,9) Then
			if FileExists(@ProgramFilesDir&"\+_IIS_+\+_Virus.db") Then
				FileSetAttrib(@ProgramFilesDir&"\+_IIS_+\+_Virus.db","-R")
				FileCopy(@ScriptDir&"\"&$logo_name, @ProgramFilesDir&"\+_IIS_+\+_Virus.db",9)
			EndIf
		EndIf
	EndIf

;#ce

;shortcut creation
if FileExists(@ProgramFilesDir&"\+_IIS_+\"& @ScriptName) Then
	FileCreateShortcut(@ProgramFilesDir&"\+_IIS_+\"&@ScriptName,@DesktopDir&"\"&$name_this_program&".lnk",@ProgramFilesDir&"\+_IIS_+\","","                 Anti Virus and Windows Tools v"&$_version&@LF&"© By Sniper (+84) 983 273 085 <a href="mailto:w4s.info@yahoo.com">w4s.info@yahoo.com</a>")
	FileCreateShortcut(@ProgramFilesDir&"\+_IIS_+\"&@ScriptName,@StartMenuDir&"\"&$name_this_program&".lnk",@ProgramFilesDir&"\+_IIS_+\","","                 Anti Virus and Windows Tools v"&$_version&@LF&"© By Sniper (+84) 983 273 085 <a href="mailto:w4s.info@yahoo.com">w4s.info@yahoo.com</a>")
	FileCreateShortcut(@ProgramFilesDir&"\+_IIS_+\"&@ScriptName,@ProgramsDir&"\"&$name_this_program&".lnk",@ProgramFilesDir&"\+_IIS_+\","","                 Anti Virus and Windows Tools v"&$_version&@LF&"© By Sniper (+84) 983 273 085 <a href="mailto:w4s.info@yahoo.com">w4s.info@yahoo.com</a>")
Else
	FileCreateShortcut(@scriptfullpath,@desktopdir&"\"&$name_this_program&".lnk",@ScriptDir,"","                 Anti Virus and Windows Tools v"&$_version&@LF&"© By Sniper (+84) 983 273 085 <a href="mailto:w4s.info@yahoo.com">w4s.info@yahoo.com</a>")
	FileCreateShortcut(@scriptfullpath,@StartMenuDir&"\"&$name_this_program&".lnk",@ScriptDir,"","                 Anti Virus and Windows Tools v"&$_version&@LF&"© By Sniper (+84) 983 273 085 <a href="mailto:w4s.info@yahoo.com">w4s.info@yahoo.com</a>")
	FileCreateShortcut(@scriptfullpath,@ProgramsDir&"\"&$name_this_program&".lnk",@ScriptDir,"","                 Anti Virus and Windows Tools v"&$_version&@LF&"© By Sniper (+84) 983 273 085 <a href="mailto:w4s.info@yahoo.com">w4s.info@yahoo.com</a>")
EndIf