MyPhoto23.zip / Trojan.Win32.Inject.emg

[Malekal_morte]

Se propage par le fichier contenant le fichier MyPhoto23.zip (se trouve dans %windir%) contenant le fichier MyPhoto023.JPG-www.myspace.com

Message de propagation :

Wouldn't this picture just look great as my new default?
do you think we look good in this picture? I just edited you into the background
there is NO way i'd get banned for posting this picture right?
This isn't too kinky for myspace right?
This is seriously the definition of sexy! Just take a peek if you dare!
I found the strangest picture ever on this dating site... It REALLY looks like you!

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [nVidia Application Drivers] nvidiav32.exe

Fichier 1.exe reçu le 2008.07.30 12:26:31 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 6/35 (17.15%)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.7.29.1 2008.07.30 -
AntiVir 7.8.1.12 2008.07.30 -
Authentium 5.1.0.4 2008.07.30 -
Avast 4.8.1195.0 2008.07.29 -
AVG 8.0.0.130 2008.07.30 Dropper.Generic.AADX
BitDefender 7.2 2008.07.30 -
CAT-QuickHeal 9.50 2008.07.29 -
ClamAV 0.93.1 2008.07.30 -
DrWeb 4.44.0.09170 2008.07.30 Trojan.MulDrop.18183
eSafe 7.0.17.0 2008.07.29 -
eTrust-Vet 31.6.5995 2008.07.30 -
Ewido 4.0 2008.07.29 -
F-Prot 4.4.4.56 2008.07.30 -
F-Secure 7.60.13501.0 2008.07.30 -
Fortinet 3.14.0.0 2008.07.30 -
GData 2.0.7306.1023 2008.07.30 -
Ikarus T3.1.1.34.0 2008.07.30 VirTool.Win32.DelfInject.AF
Kaspersky 7.0.0.125 2008.07.30 -
McAfee 5349 2008.07.29 -
Microsoft 1.3704 2008.07.28 VirTool:Win32/DelfInject.gen!AF
NOD32v2 3309 2008.07.30 Win32/AutoRun.UB
Norman 5.80.02 2008.07.30 -
Panda 9.0.0.4 2008.07.29 -
PCTools 4.4.2.0 2008.07.30 -
Prevx1 V2 2008.07.30 -
Rising 20.55.22.00 2008.07.30 -
Sophos 4.31.0 2008.07.30 -
Sunbelt 3.1.1537.1 2008.07.29 -
Symantec 10 2008.07.30 -
TheHacker 6.2.96.389 2008.07.25 -
TrendMicro 8.700.0.1004 2008.07.30 -
VBA32 3.12.8.1 2008.07.29 -
ViRobot 2008.7.30.1317 2008.07.30 -
VirusBuster 4.5.11.0 2008.07.29 Packed/newStub
Webwasher-Gateway 6.6.2 2008.07.30 -
Information additionnelle
File size: 43008 bytes
MD5...: 6c5381604b3768f31e96cafd63d2835e
SHA1..: 68c4e13a5adc0b1c36a45290c1c3a224c258a4da

[Malekal_morte]

Scan VirusTotal deux jours après :

Complete scanning result of "1.exe", processed in VirusTotal at 08/01/2008 13:49:35 (CET).

[ file data ]
* name..: 1.exe
* size..: 43008
* md5...: 6c5381604b3768f31e96cafd63d2835e
* sha1..: 68c4e13a5adc0b1c36a45290c1c3a224c258a4da
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.7.29.1/20080801 found [Win32/MSNBot.worm.43008]
AntiVir 7.8.1.15/20080801 found [BDS/Delf.duj]
Authentium 5.1.0.4/20080731 found nothing
Avast 4.8.1195.0/20080731 found [Win32:Trojan-gen {Other}]
AVG 8.0.0.156/20080801 found [Dropper.Generic.AADX]
BitDefender 7.2/20080801 found [Trojan.Delf.Inject.AO]
CAT-QuickHeal 9.50/20080731 found [Trojan.Inject.emg]
ClamAV 0.93.1/20080801 found nothing
DrWeb 4.44.0.09170/20080801 found [Trojan.MulDrop.18183]
eSafe 7.0.17.0/20080729 found nothing
eTrust-Vet 31.6.5999/20080731 found [Win32/SillyAutorun.LL]
Ewido 4.0/20080801 found nothing
F-Prot 4.4.4.56/20080731 found nothing
F-Secure 7.60.13501.0/20080801 found [Trojan.Win32.Inject.emg]
Fortinet 3.14.0.0/20080801 found [PossibleThreat]
GData 2.0.7306.1023/20080801 found [Trojan.Win32.Inject.emg]
Ikarus T3.1.1.34.0/20080801 found [VirTool.Win32.DelfInject.AF]
K7AntiVirus 7.10.399/20080731 found [Trojan.Win32.Inject.eim]
Kaspersky 7.0.0.125/20080801 found [Trojan.Win32.Inject.emg]
McAfee 5351/20080731 found nothing
Microsoft 1.3704/20080728 found [VirTool:Win32/DelfInject.gen!AF]
NOD32v2 3317/20080801 found [Win32/AutoRun.UB]
Norman 5.80.02/20080801 found nothing
Panda 9.0.0.4/20080801 found nothing
PCTools 4.4.2.0/20080801 found nothing
Prevx1 V2/20080801 found nothing
Rising 20.55.42.00/20080801 found nothing
Sophos 4.31.0/20080801 found nothing
Sunbelt 3.1.1537.1/20080801 found nothing
Symantec 10/20080801 found nothing
TheHacker 6.2.96.391/20080731 found nothing
TrendMicro 8.700.0.1004/20080801 found nothing
VBA32 3.12.8.2/20080801 found [Trojan.Win32.Inject.eke]
ViRobot 2008.8.1.1321/20080801 found [Trojan.Win32.Inject.43008.M]
VirusBuster 4.5.11.0/20080731 found [Packed/newStub]
Webwasher-Gateway 6.6.2/20080801 found [Trojan.Backdoor.Delf.duj]