myPicture6.zip / Backdoor.Win32.IRCBot.dzf

[Malekal_morte]

Se propage par le fichier contenant le fichier myPicture6.zip (se trouve dans %windir%) contenant le fichier mypicture006.JPG-www.myspace.com

Message de propagation :

would you mind if I share this picture with a few friends?
I just edited you into this picture, does it look good?
This just looks outrageous, it can't be real right?
Can I post this picture of you on my latest blog entry?
Is it ok if I upload this to my new photo album?
Should I set this as my default picture? Or would I get banned?
Do you care if I post this picture on my profile?
You look a little funky, but I think it's a really nice pic.
There is NO way this pic is too sexy for myspace right?

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [Boot Client] bootcli.exe

Fichier 76160_287546_Sp6x.exe reçu le 2008.07.08 00:49:38 (CET)
Situation actuelle: terminé
Résultat: 3/33 (9.09%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.8.0 2008.07.07 -
AntiVir 7.8.0.64 2008.07.07 -
Authentium 5.1.0.4 2008.07.07 -
Avast 4.8.1195.0 2008.07.07 -
AVG 7.5.0.516 2008.07.07 -
BitDefender 7.2 2008.07.07 -
CAT-QuickHeal 9.50 2008.07.07 -
ClamAV 0.93.1 2008.07.08 -
DrWeb 4.44.0.09170 2008.07.07 -
eSafe 7.0.17.0 2008.07.07 -
eTrust-Vet 31.6.5934 2008.07.07 -
Ewido 4.0 2008.07.07 -
F-Prot 4.4.4.56 2008.07.07 -
F-Secure 7.60.13501.0 2008.07.03 -
Fortinet 3.14.0.0 2008.07.07 -
GData 2.0.7306.1023 2008.07.07 -
Ikarus T3.1.1.26.0 2008.07.07 -
Kaspersky 7.0.0.125 2008.07.08 -
McAfee 5333 2008.07.07 -
Microsoft 1.3704 2008.07.08 VirTool:Win32/DelfInject.gen!AF
NOD32v2 3248 2008.07.07 -
Norman 5.80.02 2008.07.07 -
Panda 9.0.0.4 2008.07.08 -
Prevx1 V2 2008.07.08 -
Rising 20.51.60.00 2008.07.06 Trojan.Win32.Delf.ykq
Sophos 4.31.0 2008.07.07 -
Sunbelt 3.1.1509.1 2008.07.04 -
Symantec 10 2008.07.08 Trojan.Dropper
TheHacker 6.2.96.374 2008.07.07 -
TrendMicro 8.700.0.1004 2008.07.07 -
VBA32 3.12.6.8 2008.07.07 -
VirusBuster 4.5.11.0 2008.07.07 -
Webwasher-Gateway 6.6.2 2008.07.07 -
Information additionnelle
File size: 43520 bytes
MD5...: 7a13e8c6dc61608d12773d2b51005d80
SHA1..: df749d17b421b36548395b4de57caca73b118216

[Malekal_morte]

Scan au lendemain :

Complete scanning result of "Sp6x.exe.1", processed in VirusTotal at 07/09/2008 11:35:38 (CET).

[ file data ]
* name: Sp6x.exe.1
* size: 43520
* md5.: 7a13e8c6dc61608d12773d2b51005d80
* sha1: df749d17b421b36548395b4de57caca73b118216
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.7.9.1/20080709 found [Win-Trojan/Agent.43520.EC]
AntiVir 7.8.0.64/20080709 found [Worm/IrcBot.43520.18]
Authentium 5.1.0.4/20080708 found nothing
Avast 4.8.1195.0/20080708 found nothing
AVG 7.5.0.516/20080708 found nothing
BitDefender 7.2/20080709 found [Trojan.Agent.Delf.LB]
CAT-QuickHeal 9.50/20080708 found nothing
ClamAV 0.93.1/20080709 found nothing
DrWeb 4.44.0.09170/20080709 found nothing
eSafe 7.0.17.0/20080703 found nothing
eTrust-Vet 31.6.5940/20080709 found nothing
Ewido 4.0/20080708 found nothing
F-Prot 4.4.4.56/20080708 found nothing
F-Secure 7.60.13501.0/20080708 found nothing
Fortinet 3.14.0.0/20080709 found [PossibleThreat]
GData 2.0.7306.1023/20080709 found [Backdoor.Win32.IRCBot.dzf]
Ikarus T3.1.1.26/20080709 found [VirTool.Win32.DelfInject.AF]
Kaspersky 7.0.0.125/20080709 found [Backdoor.Win32.IRCBot.dzf]
McAfee 5334/20080708 found nothing
Microsoft 1.3704/20080709 found [VirTool:Win32/DelfInject.gen!AF]
NOD32v2 3254/20080709 found [Win32/AutoRun.RM]
Norman 5.80.02/20080708 found nothing
Panda 9.0.0.4/20080708 found [Bck/IRCBot.CCL]
Prevx1 V2/20080709 found [Worm]
Rising 20.52.12.00/20080708 found [Trojan.Win32.Delf.ykq]
Sophos 4.31.0/20080709 found [Troj/IRCbot-ACF]
Sunbelt 3.1.1509.1/20080704 found nothing
Symantec 10/20080709 found [Trojan.Dropper]
TheHacker 6.2.96.374/20080707 found nothing
TrendMicro 8.700.0.1004/20080709 found nothing
VBA32 3.12.6.8/20080708 found nothing
VirusBuster 4.5.11.0/20080708 found nothing
Webwasher-Gateway 6.6.2/20080709 found [Worm.IrcBot.43520.18]