tinypic.no/D9000.JPG_tinypic.com / Trojan.Win32.Pakes.jti

[Malekal_morte]

Message de propagation :

sexy? hxxp://tinypic.no/D9000.JPG_tinypic.com
New sexy? hxxp://tinypic.no/D9000.JPG_tinypic.com
WOW :P hxxp://tinypic.no/D9000.JPG_tinypic.com

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [Windows UDP Control Center] ehSched.exe

Complete scanning result of "D9000.JPG_tinypic.com", processed in VirusTotal at 07/09/2008 17:35:27 (CET).

[ file data ]
* name..: D9000.JPG_tinypic.com
* size..: 43520
* md5...: bf22762933d02820e55c3c38a6dc623c
* sha1..: 47fae4d2fabde3576169c9863bb62690450c044c
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.7.9.2/20080709 found nothing
AntiVir 7.8.0.64/20080709 found nothing
Authentium 5.1.0.4/20080708 found nothing
Avast 4.8.1195.0/20080709 found nothing
AVG 7.5.0.516/20080709 found nothing
BitDefender 7.2/20080709 found nothing
CAT-QuickHeal 9.50/20080709 found nothing
ClamAV 0.93.1/20080709 found nothing
DrWeb 4.44.0.09170/20080709 found nothing
eSafe 7.0.17.0/20080708 found nothing
eTrust-Vet 31.6.5940/20080709 found nothing
Ewido 4.0/20080709 found nothing
F-Prot 4.4.4.56/20080708 found nothing
F-Secure 7.60.13501.0/20080708 found nothing
Fortinet 3.14.0.0/20080709 found nothing
GData 2.0.7306.1023/20080709 found nothing
Ikarus T3.1.1.26.0/20080709 found nothing
Kaspersky 7.0.0.125/20080709 found nothing
McAfee 5334/20080708 found nothing
Microsoft 1.3704/20080709 found [VirTool:Win32/DelfInject.gen!AF]
NOD32v2 3255/20080709 found nothing
Norman 5.80.02/20080709 found nothing
Panda 9.0.0.4/20080708 found nothing
Prevx1 V2/20080709 found nothing
Rising 20.52.22.00/20080709 found nothing
Sophos 4.31.0/20080709 found nothing
Sunbelt 3.1.1509.1/20080704 found nothing
Symantec 10/20080709 found nothing
TheHacker 6.2.96.374/20080707 found nothing
TrendMicro 8.700.0.1004/20080709 found nothing
VBA32 3.12.6.8/20080708 found nothing
VirusBuster 4.5.11.0/20080709 found nothing
Webwasher-Gateway 6.6.2/20080709 found nothing

[Malekal_morte]

Le scan trois jours après :

Complete scanning result of "D9000.JPG_tinypic.com", processed in VirusTotal at 07/12/2008 14:15:11 (CET).

[ file data ]
* name: D9000.JPG_tinypic.com
* size: 43520
* md5.: bf22762933d02820e55c3c38a6dc623c
* sha1: 47fae4d2fabde3576169c9863bb62690450c044c
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.7.11.0/20080711 found nothing
AntiVir 7.8.0.64/20080711 found [TR/Agent.43520.17]
Authentium 5.1.0.4/20080711 found nothing
Avast 4.8.1195.0/20080712 found nothing
AVG 7.5.0.516/20080712 found [Dropper.Delf.BCU]
BitDefender 7.2/20080712 found nothing
CAT-QuickHeal 9.50/20080711 found nothing
ClamAV 0.93.1/20080711 found nothing
DrWeb 4.44.0.09170/20080712 found nothing
eSafe 7.0.17.0/20080703 found nothing
eTrust-Vet 31.6.5949/20080712 found nothing
Ewido 4.0/20080712 found nothing
F-Prot 4.4.4.56/20080711 found nothing
F-Secure 7.60.13501.0/20080712 found nothing
Fortinet 3.14.0.0/20080712 found [PossibleThreat]
GData 2.0.7306.1023/20080712 found nothing
Ikarus T3.1.1.26/20080712 found [VirTool.Win32.DelfInject.AF]
Kaspersky 7.0.0.125/20080712 found nothing
McAfee 5337/20080711 found nothing
Microsoft 1.3704/20080712 found nothing
NOD32v2 3263/20080711 found [Win32/Injector.BJ]
Norman 5.80.02/20080711 found nothing
Panda 9.0.0.4/20080712 found nothing
Prevx1 V2/20080712 found nothing
Rising 20.52.52.00/20080712 found nothing
Sophos 4.31.0/20080712 found nothing
Sunbelt 3.1.1536.1/20080712 found nothing
Symantec 10/20080712 found nothing
TheHacker 6.2.96.376/20080710 found nothing
TrendMicro 8.700.0.1004/20080711 found nothing
VBA32 3.12.6.9/20080712 found nothing
VirusBuster 4.5.11.0/20080711 found nothing
Webwasher-Gateway 6.6.2/20080711 found [Trojan.Agent.43520.17]

[Malekal_morte]

Complete scanning result of "D9000.JPG_tinypic.com", processed in VirusTotal at 07/17/2008 09:43:37 (CET).

[ file data ]
* name..: D9000.JPG_tinypic.com
* size..: 43520
* md5...: bf22762933d02820e55c3c38a6dc623c
* sha1..: 47fae4d2fabde3576169c9863bb62690450c044c
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.7.17.0/20080717 found nothing
AntiVir 7.8.0.68/20080717 found [TR/Agent.43520.17]
Authentium 5.1.0.4/20080716 found nothing
Avast 4.8.1195.0/20080717 found [Win32:Trojan-gen {Other}]
AVG 7.5.0.516/20080717 found [Dropper.Delf.BCU]
BitDefender 7.2/20080717 found nothing
CAT-QuickHeal 9.50/20080716 found nothing
ClamAV 0.93.1/20080717 found nothing
DrWeb 4.44.0.09170/20080717 found nothing
eSafe 7.0.17.0/20080716 found nothing
eTrust-Vet 31.6.5961/20080717 found nothing
Ewido 4.0/20080716 found nothing
F-Prot 4.4.4.56/20080716 found nothing
F-Secure 7.60.13501.0/20080717 found [Trojan.Win32.Pakes.jti]
Fortinet 3.14.0.0/20080717 found [PossibleThreat]
GData 2.0.7306.1023/20080717 found [Trojan.Win32.Pakes.jti]
Ikarus T3.1.1.26.0/20080717 found [VirTool.Win32.DelfInject.AF]
Kaspersky 7.0.0.125/20080717 found [Trojan.Win32.Pakes.jti]
McAfee 5340/20080716 found nothing
Microsoft 1.3704/20080717 found [Worm:Win32/Pushbot.GR]
NOD32v2 3272/20080717 found [Win32/Injector.BJ]
Norman 5.80.02/20080716 found nothing
Panda 9.0.0.4/20080716 found nothing
Prevx1 V2/20080717 found nothing
Rising 20.53.30.00/20080717 found nothing
Sophos 4.31.0/20080717 found nothing
Sunbelt 3.1.1536.1/20080715 found nothing
Symantec 10/20080717 found nothing
TheHacker 6.2.96.381/20080716 found nothing
TrendMicro 8.700.0.1004/20080717 found nothing
VBA32 3.12.8.0/20080717 found nothing
VirusBuster 4.5.11.0/20080716 found nothing
Webwasher-Gateway 6.6.2/20080717 found [Trojan.Agent.43520.17]