Trojan.Win32.Agent.vwv / hxxp://www.turnwood.net/

[Malekal_morte]

Message de propagation :

Could I upload this picture of you into my new album? hxxp://www.turnwood.net/UserFiles/5320/view.ph ... to010.jpeg
Do you mind if I show this picture of you to my friends? hxxp://www.turnwood.net/UserFiles/5320/view.ph ... to010.jpeg
How do we look together? I think my picture editing skills are getting better:) hxxp://www.turnwood.net/UserFiles/5320/view.ph ... to010.jpeg
Would I get banned for posting this on facebook? hxxp://www.turnwood.net/UserFiles/5320/view.ph ... to010.jpeg
Does this look good enough for my new default picture? hxxp://www.turnwood.net/UserFiles/5320/view.ph ... to010.jpeg
This is the definition of sexy. Don't you think? hxxp://www.turnwood.net/UserFiles/5320/view.ph ... to010.jpeg

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [System Config Boot] syscgboot.exe

Fichier newphoto010.jpeg reçu le 2008.07.25 12:25:24 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 10/35 (28.58%)


Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.25.1 2008.07.25 -
AntiVir 7.8.1.12 2008.07.25 -
Authentium 5.1.0.4 2008.07.24 -
Avast 4.8.1195.0 2008.07.25 -
AVG 8.0.0.130 2008.07.25 Injector.AD
BitDefender 7.2 2008.07.25 -
CAT-QuickHeal 9.50 2008.07.24 -
ClamAV 0.93.1 2008.07.25 -
DrWeb 4.44.0.09170 2008.07.25 BackDoor.Bifrost.842
eSafe 7.0.17.0 2008.07.24 Suspicious File
eTrust-Vet 31.6.5980 2008.07.24 -
Ewido 4.0 2008.07.24 -
F-Prot 4.4.4.56 2008.07.24 -
F-Secure 7.60.13501.0 2008.07.25 Trojan.Win32.Agent.vwv
Fortinet 3.14.0.0 2008.07.25 -
GData 2.0.7306.1023 2008.07.25 Trojan.Win32.Agent.vwv
Ikarus T3.1.1.34.0 2008.07.25 Virus.Win32.Downloader.LL
Kaspersky 7.0.0.125 2008.07.25 Trojan.Win32.Agent.vwv
McAfee 5346 2008.07.24 -
Microsoft 1.3704 2008.07.24 VirTool:Win32/DelfInject.gen!AF
NOD32v2 3298 2008.07.25 Win32/AutoRun.QN
Norman 5.80.02 2008.07.24 -
Panda 9.0.0.4 2008.07.24 -
PCTools 4.4.2.0 2008.07.24 -
Prevx1 V2 2008.07.25 -
Rising 20.54.42.00 2008.07.25 -
Sophos 4.31.0 2008.07.25 -
Sunbelt 3.1.1536.1 2008.07.18 -
Symantec 10 2008.07.25 -
TheHacker 6.2.96.389 2008.07.25 -
TrendMicro 8.700.0.1004 2008.07.25 PAK_Generic.001
VBA32 3.12.8.1 2008.07.24 -
ViRobot 2008.7.25.1310 2008.07.25 -
VirusBuster 4.5.11.0 2008.07.24 -
Webwasher-Gateway 6.6.2 2008.07.25 -
Information additionnelle
File size: 33792 bytes
MD5...: 8aa361406673945dbf9375c61a82fc60
SHA1..: cc47aaac288888e4e5e1368c91643ca90a899ae7

[Malekal_morte]

You mind if I upload this picture to my new album on facebook? hxxp://www.turnwood.net/UserFiles/93204/edit.p ... ture09.jpg
Would I get banned for posting this on myspace? hxxp://www.turnwood.net/UserFiles/93204/edit.p ... ture09.jpg
Some people are saying my new hair is rediculous... I don't think the color is that crazy, what about you? hxxp://www.turnwood.net/UserFiles/93204/edit.p ... ture09.jpg
Do you think this pic would look good as my new default? hxxp://www.turnwood.net/UserFiles/93204/edit.p ... ture09.jpg
Have you seen the party pictures from last weekend? Here is the best one hxxp://www.turnwood.net/UserFiles/93204/edit.p ... ture09.jpg
I bet you didn't know I'm taking photoshop classes! Check out my latest work of art! hxxp://www.turnwood.net/UserFiles/93204/edit.p ... ture09.jpg

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [nVidia System Drivers] nvsys32.exe

Fichier myPicture009.jpg reçu le 2008.07.28 12:58:15 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 3/35 (8.58%)
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.26.0 2008.07.28 -
AntiVir 7.8.1.12 2008.07.28 HEUR/Crypted.E
Authentium 5.1.0.4 2008.07.28 -
Avast 4.8.1195.0 2008.07.27 -
AVG 8.0.0.130 2008.07.28 -
BitDefender 7.2 2008.07.28 -
CAT-QuickHeal 9.50 2008.07.25 -
ClamAV 0.93.1 2008.07.28 -
DrWeb 4.44.0.09170 2008.07.28 -
eSafe 7.0.17.0 2008.07.27 -
eTrust-Vet 31.6.5983 2008.07.26 -
Ewido 4.0 2008.07.28 -
F-Prot 4.4.4.56 2008.07.28 -
F-Secure 7.60.13501.0 2008.07.28 -
Fortinet 3.14.0.0 2008.07.26 -
GData 2.0.7306.1023 2008.07.28 -
Ikarus T3.1.1.34.0 2008.07.28 -
Kaspersky 7.0.0.125 2008.07.28 -
McAfee 5347 2008.07.25 -
Microsoft 1.3704 2008.07.28 VirTool:Win32/DelfInject.gen!AF
NOD32v2 3302 2008.07.28 -
Norman 5.80.02 2008.07.25 -
Panda 9.0.0.4 2008.07.28 -
PCTools 4.4.2.0 2008.07.27 -
Prevx1 V2 2008.07.28 Malicious Software
Rising 20.55.02.00 2008.07.28 -
Sophos 4.31.0 2008.07.28 -
Sunbelt 3.1.1536.1 2008.07.25 -
Symantec 10 2008.07.28 -
TheHacker 6.2.96.389 2008.07.25 -
TrendMicro 8.700.0.1004 2008.07.28 -
VBA32 3.12.8.1 2008.07.27 -
ViRobot 2008.7.26.1311 2008.07.28 -
VirusBuster 4.5.11.0 2008.07.27 -
Webwasher-Gateway 6.6.2 2008.07.28 -
Information additionnelle
File size: 43008 bytes
MD5...: 410743f1715248bcdcc909573c867b18
SHA1..: 22586746dff5e012c8578e144f414ed1f3174eee

Ajouté en Trojan.Win32.Inject.eim par Kaspersky :

Hello,

myPicture009.jpgd - Trojan.Win32.Inject.eim

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.

[Malekal_morte]

You mind if I upload this picture to my new album on facebook? hxxp://www.turnwood.net/UserFiles/93204/edit.p ... re006.JPEG
Would I get banned for posting this on myspace? hxxp://www.turnwood.net/UserFiles/93204/edit.p ... re006.JPEG
Some people are saying my new hair is rediculous... I don't think the color is that crazy, what about you? hxxp://www.turnwood.net/UserFiles/93204/edit.p ... re006.JPEG
Do you think this pic would look good as my new default? hxxp://www.turnwood.net/UserFiles/93204/edit.p ... re006.JPEG
Have you seen the party pictures from last weekend? Here is the best one hxxp://www.turnwood.net/UserFiles/93204/edit.p ... re006.JPEG
I bet you didn't know I'm taking photoshop classes! Check out new latest work of art! hxxp://www.turnwood.net/UserFiles/93204/edit.p ... re006.JPEG

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [nVidia Display Drivers (x86)] nvsys86.exe

Fichier picture06.jpg reçu le 2008.07.29 08:55:08 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 5/35 (14.29%)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.29.1 2008.07.29 -
AntiVir 7.8.1.12 2008.07.28 HEUR/Crypted.E
Authentium 5.1.0.4 2008.07.29 -
Avast 4.8.1195.0 2008.07.28 -
AVG 8.0.0.130 2008.07.28 -
BitDefender 7.2 2008.07.29 -
CAT-QuickHeal 9.50 2008.07.28 -
ClamAV 0.93.1 2008.07.29 -
DrWeb 4.44.0.09170 2008.07.29 -
eSafe 7.0.17.0 2008.07.28 -
eTrust-Vet 31.6.5991 2008.07.29 -
Ewido 4.0 2008.07.28 -
F-Prot 4.4.4.56 2008.07.28 -
F-Secure 7.60.13501.0 2008.07.29 -
Fortinet 3.14.0.0 2008.07.29 -
GData 2.0.7306.1023 2008.07.29 -
Ikarus T3.1.1.34.0 2008.07.29 -
Kaspersky 7.0.0.125 2008.07.29 -
McAfee 5348 2008.07.28 -
Microsoft 1.3704 2008.07.28 VirTool:Win32/DelfInject.gen!AF
NOD32v2 3305 2008.07.29 Win32/Injector.BW
Norman 5.80.02 2008.07.28 -
Panda 9.0.0.4 2008.07.28 -
PCTools 4.4.2.0 2008.07.29 -
Prevx1 V2 2008.07.29 Malicious Software
Rising 20.55.11.00 2008.07.29 -
Sophos 4.31.0 2008.07.29 -
Sunbelt 3.1.1536.1 2008.07.28 -
Symantec 10 2008.07.29 -
TheHacker 6.2.96.389 2008.07.25 -
TrendMicro 8.700.0.1004 2008.07.29 -
VBA32 3.12.8.1 2008.07.28 -
ViRobot 2008.7.26.1311 2008.07.28 -
VirusBuster 4.5.11.0 2008.07.28 Packed/newStub
Webwasher-Gateway 6.6.2 2008.07.29 -
Information additionnelle
File size: 43008 bytes
MD5...: 0a40131f40a84a7a252c2652af149a52
SHA1..: ab5c12ec8ce581a046dd21a6115dc8ab1904534f