Photo16.zip / Worm.Win32.AutoRun.ei

[Malekal_morte]

Se propage par le fichier contenant le fichier Photo16.zip (se trouve dans %windir%) contenant le fichier photo0016.JPEG-www.facebook.com

Message de propagation :

I just can't believe this is real... What do you think?
You missed out on a crazy party Saturday! Just look at the picture I took!
Would you mind if I shared this picture of you with a some friends of mine?
My account won't get closed if I use this as my default picture right?
Have you seen my latest work of art? I just created it with Photoshop!
There is NO way this is a real picture right? It just looks too insane!

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [MSN Auto-Updater] msnupdates.exe

[Malekal_morte]

Fichier euSp4.exe reçu le 2008.07.02 09:55:05 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 1/33 (3.04%)


Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.2.0 2008.07.02 -
AntiVir 7.8.0.59 2008.07.02 -
Authentium 5.1.0.4 2008.07.01 -
Avast 4.8.1195.0 2008.07.01 -
AVG 7.5.0.516 2008.07.01 -
BitDefender 7.2 2008.07.02 -
CAT-QuickHeal 9.50 2008.06.30 -
ClamAV 0.93.1 2008.07.02 -
DrWeb 4.44.0.09170 2008.07.02 -
eSafe 7.0.17.0 2008.07.01 -
eTrust-Vet 31.6.5919 2008.07.02 -
Ewido 4.0 2008.07.01 -
F-Prot 4.4.4.56 2008.07.01 -
F-Secure 7.60.13501.0 2008.07.01 -
Fortinet 3.14.0.0 2008.07.02 -
GData 2.0.7306.1023 2008.07.01 -
Ikarus T3.1.1.26.0 2008.07.02 VirTool.Win32.Injector.D
Kaspersky 7.0.0.125 2008.07.02 -
McAfee 5329 2008.07.01 -
Microsoft None 2008.07.02 -
NOD32v2 3234 2008.07.02 -
Norman 5.80.02 2008.07.01 -
Panda 9.0.0.4 2008.07.01 -
Prevx1 V2 2008.07.02 -
Rising 20.51.21.00 2008.07.02 -
Sophos 4.30.0 2008.07.02 -
Sunbelt 3.1.1509.1 2008.07.01 -
Symantec 10 2008.07.02 -
TheHacker 6.2.96.366 2008.07.02 -
TrendMicro 8.700.0.1004 2008.07.02 -
VBA32 3.12.6.8 2008.07.01 -
VirusBuster 4.5.11.0 2008.07.01 -
Webwasher-Gateway 6.6.2 2008.07.02 -
Information additionnelle
File size: 42496 bytes
MD5...: a5b7d933a84fdf5ab912472f43d4e0d5
SHA1..: 7daecc90888cab971bcfe78eac1d6d698f278af4

[Malekal_morte]

Scan quelques jours après.... :

Complete scanning result of "euSp4.exe", processed in VirusTotal at 07/08/2008 01:28:46 (CET).

[ file data ]
* name..: euSp4.exe
* size..: 42496
* md5...: a5b7d933a84fdf5ab912472f43d4e0d5
* sha1..: 7daecc90888cab971bcfe78eac1d6d698f278af4
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.7.8.0/20080707 found nothing
AntiVir 7.8.0.64/20080707 found [TR/Inject.IU.2]
Authentium 5.1.0.4/20080707 found nothing
Avast 4.8.1195.0/20080707 found nothing
AVG 7.5.0.516/20080707 found [Worm/Generic.IMW]
BitDefender 7.2/20080708 found [Trojan.Inject.IU]
CAT-QuickHeal 9.50/20080707 found nothing
ClamAV 0.93.1/20080708 found nothing
DrWeb 4.44.0.09170/20080707 found [Win32.HLLW.Autoruner.2296]
eSafe 7.0.17.0/20080707 found nothing
eTrust-Vet 31.6.5934/20080707 found nothing
Ewido 4.0/20080707 found nothing
F-Prot 4.4.4.56/20080707 found nothing
F-Secure 7.60.13501.0/20080708 found nothing
Fortinet 3.14.0.0/20080707 found [PossibleThreat]
GData 2.0.7306.1023/20080708 found [Worm.Win32.AutoRun.eil]
Ikarus T3.1.1.26.0/20080707 found [VirTool.Win32.Injector.D]
Kaspersky 7.0.0.125/20080708 found [Worm.Win32.AutoRun.eil]
McAfee 5333/20080707 found nothing
Microsoft 1.3704/20080708 found [Worm:Win32/Slenfbot.YQ]
NOD32v2 3248/20080707 found [Win32/AutoRun.RM]
Norman 5.80.02/20080707 found nothing
Panda 9.0.0.4/20080708 found [Trj/Hosts.AE]
Prevx1 V2/20080708 found [Fraudulent Security Program]
Rising 20.51.60.00/20080706 found nothing
Sophos 4.31.0/20080707 found nothing
Sunbelt 3.1.1509.1/20080704 found nothing
Symantec 10/20080708 found [Trojan.Dropper]
TheHacker 6.2.96.374/20080707 found nothing
TrendMicro 8.700.0.1004/20080707 found nothing
VBA32 3.12.6.8/20080707 found [Win32.HLLW.Autoruner.2296]
VirusBuster 4.5.11.0/20080707 found nothing
Webwasher-Gateway 6.6.2/20080707 found [Trojan.Inject.IU.2]