Malekal's forum

[Malekal_morte]

hxxp://nonfathighestlocate.cn:8080/load.php - (82.208.58.199)

File rncsys32.exe received on 2009.06.03 14:35:04 (UTC)
Current status: finished
Result: 2/40 (5.00%)
Compact Compact
Print results Print results
Antivirus Version Last Update Result
a-squared 4.0.0.101 2009.06.03 -
AhnLab-V3 5.0.0.2 2009.06.03 -
AntiVir 7.9.0.180 2009.06.03 -
Antiy-AVL 2.0.3.1 2009.06.03 -
Authentium 5.1.2.4 2009.06.03 -
Avast 4.8.1335.0 2009.06.02 -
AVG 8.5.0.339 2009.06.03 -
BitDefender 7.2 2009.06.03 -
CAT-QuickHeal 10.00 2009.06.03 -
ClamAV 0.94.1 2009.06.03 -
Comodo 1245 2009.06.03 -
DrWeb 5.0.0.12182 2009.06.03 -
eSafe 7.0.17.0 2009.06.03 Suspicious File
eTrust-Vet 31.6.6537 2009.06.03 -
F-Prot 4.4.4.56 2009.06.03 -
F-Secure 8.0.14470.0 2009.06.03 -
Fortinet 3.117.0.0 2009.06.03 -
GData 19 2009.06.03 -
Ikarus T3.1.1.59.0 2009.06.03 -
K7AntiVirus 7.10.752 2009.06.02 -
Kaspersky 7.0.0.125 2009.06.03 -
McAfee 5634 2009.06.02 -
McAfee+Artemis 5634 2009.06.02 -
McAfee-GW-Edition 6.7.6 2009.05.29 -
Microsoft 1.4701 2009.06.03 -
NOD32 4127 2009.06.03 -
Norman 6.01.05 2009.06.02 -
nProtect 2009.1.8.0 2009.06.03 -
Panda 10.0.0.14 2009.06.02 -
PCTools 4.4.2.0 2009.06.02 -
Prevx 3.0 2009.06.03 Medium Risk Malware
Rising 21.32.24.00 2009.06.03 -
Sophos 4.42.0 2009.06.03 -
Sunbelt 3.2.1858.2 2009.06.03 -
Symantec 1.4.4.12 2009.06.03 -
TheHacker 6.3.4.3.338 2009.06.03 -
TrendMicro 8.950.0.1092 2009.06.03 -
VBA32 3.12.10.6 2009.06.02 -
ViRobot 2009.6.3.1766 2009.06.03 -
VirusBuster 4.6.5.0 2009.06.02 -
Additional information
File size: 19456 bytes
MD5 : faa9809aa45bc4ed679814725a95e45c
SHA1 : 95c426c53221a256ee25c9bce20c6fde3ff006bb

[Malekal_morte]

Code: Tout sélectionner

1244043626.085  10439 192.168.1.25 TCP_MISS/200 217675 GET http://78.109.29.116/new/controller.php?action=bot&entity_list=&uid=1&first=1&guid=1353422705&rnd=981633 - DIRECT/78.109.29.116 text/html
1244043626.967      0 192.168.1.25 TCP_MISS/000 0 GET http://78.109.29.116/new/controller.php?action=report&guid=0&rnd=123&uid=1&entity=1241530597:unique_start;1241643870:unique_start;1243627542:unique_start - DIRECT/78.109.29.116 -
1244043632.208      1 192.168.1.25 TCP_MISS/000 0 POST http://78.109.29.114/good/receiver/online - DIRECT/78.109.29.114 -
1244043647.063    704 192.168.1.25 TCP_MISS/000 0 POST http://mixmediadirect.cn/gate/gate.php - DIRECT/78.109.29.115 -

C:\WINDOWS\Temp\wpv521243627542.exe

et

Process:
Path: C:\WINDOWS\system32\services.exe
PID: 708
Information: Services and Controller app (Microsoft Corporation)
Driver:
Path: C:\WINDOWS\system32\drivers\beep.sys

longtemps qu'on avait pas eu un patch de beep.sys

[Malekal_morte]

mirroir :

Code: Tout sélectionner

1244051058.279    665 192.168.1.63 TCP_MISS/200 19759 GET http://bestlitediscover.cn:8080/load.php?id=0 - DIRECT/82.208.58.199 application/octet-stream

[Malekal_morte]

Code: Tout sélectionner

http://bestlitediscover.cn:8080/load.php?id=0 DIRECT/87.252.2.86
http://bestlitediscover.cn:8080/load.php?id=0 DIRECT/90.156.144.78
http://combinebet.cn:8080/cache/flash.swf DIRECT/87.252.2.86
http://combinebet.cn:8080/cache/flash.swf DIRECT/90.156.144.78
http://combinebet.cn:8080/cache/readme.pdf DIRECT/87.252.2.86
http://combinebet.cn:8080/cache/readme.pdf DIRECT/90.156.144.78
http://combinebet.cn:8080/index.php DIRECT/193.108.81.200
http://combinebet.cn:8080/index.php DIRECT/87.252.2.86
http://combinebet.cn:8080/index.php DIRECT/90.156.144.78
http://gianttoplocate.cn:8080/load.php?id=0 DIRECT/216.154.213.166
http://gianttoplocate.cn:8080/load.php?id=0 DIRECT/87.106.103.122
http://globalnameshop.cn:8080/cache/flash.swf DIRECT/216.154.213.166
http://globalnameshop.cn:8080/cache/flash.swf DIRECT/87.106.103.122
http://globalnameshop.cn:8080/cache/readme.pdf DIRECT/216.154.213.166
http://globalnameshop.cn:8080/cache/readme.pdf DIRECT/87.106.103.122
http://globalnameshop.cn:8080/index.php DIRECT/216.154.213.166
http://globalnameshop.cn:8080/index.php DIRECT/87.106.103.122
http://hugetoplocate.cn:8080/cache/flash.swf DIRECT/87.252.2.86
http://hugetoplocate.cn:8080/cache/readme.pdf DIRECT/87.252.2.86
http://hugetoplocate.cn:8080/index.php DIRECT/87.106.103.122
http://hugetoplocate.cn:8080/index.php DIRECT/87.252.2.86

[Malekal_morte]

Voir aussi : http://www.malekal.com/PWS_Win32.Daurso ... 32.exe.php