NEWIMAGE18 / Trojan.Win32.Agent.xqq

[Malekal_morte]

Se propage par le fichier contenant le fichier NEWIMAGE18.zip (se trouve dans %windir%) contenant le fichier NEWIMAGE0018.JPEG_www.tinypic.scr

Message de propagation :

I just started taking photoshop classes, how are my editing skills?
I found this picture on SexyCams.com it can't be you right?
This is the definition of sexy. You just have to take a peek!!
My account won't get removed for posting this right?

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [Security System] securesys.exe

Fichier 0x08.exe reçu le 2008.08.10 09:19:03 (CET)
Situation actuelle: en cours de chargement ... mis en file d'attente en attente en cours d'analyse terminé NON TROUVE ARRETE
Résultat: 13/36 (36.12%)

Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.8.9.0 2008.08.08 -
AntiVir 7.8.1.19 2008.08.09 TR/Crypt.CFI.Gen
Authentium 5.1.0.4 2008.08.10 -
Avast 4.8.1195.0 2008.08.09 -
AVG 8.0.0.156 2008.08.09 BackDoor.Ircbot.FCO
BitDefender 7.2 2008.08.10 -
CAT-QuickHeal 9.50 2008.08.08 -
ClamAV 0.93.1 2008.08.10 Trojan.Agent-40556
DrWeb 4.44.0.09170 2008.08.09 Trojan.Inject.3688
eSafe 7.0.17.0 2008.08.07 -
eTrust-Vet 31.6.6021 2008.08.08 -
Ewido 4.0 2008.08.09 -
F-Prot 4.4.4.56 2008.08.10 -
F-Secure 7.60.13501.0 2008.08.10 -
Fortinet 3.14.0.0 2008.08.10 PossibleThreat
GData 2.0.7306.1023 2008.08.10 -
Ikarus T3.1.1.34.0 2008.08.10 VirTool.Win32.DelfInject.AF
K7AntiVirus 7.10.408 2008.08.09 Trojan.Win32.Agent.xqq
Kaspersky 7.0.0.125 2008.08.10 -
McAfee 5357 2008.08.08 -
Microsoft 1.3807 2008.08.10 VirTool:Win32/DelfInject.gen!AF
NOD32v2 3343 2008.08.10 Win32/IRCBot.AAH
Norman 5.80.02 2008.08.08 -
Panda 9.0.0.4 2008.08.09 -
PCTools 4.4.2.0 2008.08.09 -
Prevx1 V2 2008.08.10 Malicious Software
Rising 20.56.41.00 2008.08.08 -
Sophos 4.32.0 2008.08.10 -
Sunbelt 3.1.1538.1 2008.08.09 -
Symantec 10 2008.08.10 -
TheHacker 6.2.96.395 2008.08.08 -
TrendMicro 8.700.0.1004 2008.08.08 -
VBA32 3.12.8.3 2008.08.09 Trojan.Win32.Agent.xsn
ViRobot 2008.8.8.1329 2008.08.08 Trojan.Win32.Agent.52736.C
VirusBuster 4.5.11.0 2008.08.09 -
Webwasher-Gateway 6.6.2 2008.08.09 Trojan.Crypt.CFI.Gen
Information additionnelle
File size: 68608 bytes
MD5...: 4abe32c69c71593278d1be6497ec73db
SHA1..: 93fe9a1865934abe6db1531b0917aa2f5d17cffb

[Malekal_morte]

Complete scanning result of "0x08.exe", processed in VirusTotal at 08/11/2008 16:06:56 (CET).

[ file data ]
* name..: 0x08.exe
* size..: 68608
* md5...: 4abe32c69c71593278d1be6497ec73db
* sha1..: 93fe9a1865934abe6db1531b0917aa2f5d17cffb
* peid..: BobSoft Mini Delphi -> BoB / BobSoft

[ scan result ]
AhnLab-V3 2008.8.12.0/20080811 found nothing
AntiVir 7.8.1.19/20080811 found [TR/Crypt.CFI.Gen]
Authentium 5.1.0.4/20080811 found nothing
Avast 4.8.1195.0/20080811 found [Win32:Trojan-gen {Other}]
AVG 8.0.0.156/20080811 found [BackDoor.Ircbot.FCO]
BitDefender 7.2/20080811 found nothing
CAT-QuickHeal 9.50/20080808 found nothing
ClamAV 0.93.1/20080811 found [Trojan.Agent-40556]
DrWeb 4.44.0.09170/20080811 found [Trojan.Inject.3688]
eSafe 7.0.17.0/20080811 found nothing
eTrust-Vet 31.6.6021/20080808 found nothing
Ewido 4.0/20080811 found nothing
F-Prot 4.4.4.56/20080811 found nothing
F-Secure 7.60.13501.0/20080811 found nothing
Fortinet 3.14.0.0/20080811 found [PossibleThreat]
GData 2.0.7306.1023/20080811 found nothing
Ikarus T3.1.1.34.0/20080811 found [VirTool.Win32.DelfInject.AF]
K7AntiVirus 7.10.411/20080811 found [Trojan.Win32.Agent.xqq]
Kaspersky 7.0.0.125/20080811 found nothing
McAfee 5357/20080808 found nothing
Microsoft 1.3807/20080811 found [VirTool:Win32/DelfInject.gen!AF]
NOD32v2 3345/20080811 found [Win32/IRCBot.AAH]
Norman 5.80.02/20080811 found [W32/Smalltroj.FUVV]
Panda 9.0.0.4/20080810 found nothing
PCTools 4.4.2.0/20080811 found nothing
Prevx1 V2/20080811 found [Malicious Software]
Rising 20.57.02.00/20080811 found nothing
Sophos 4.32.0/20080811 found nothing
Sunbelt 3.1.1538.1/20080809 found nothing
Symantec 10/20080811 found nothing
TheHacker 6.2.96.395/20080808 found nothing
TrendMicro 8.700.0.1004/20080811 found nothing
VBA32 3.12.8.3/20080810 found [Trojan.Win32.Agent.xsn]
ViRobot 2008.8.11.1331/20080811 found [Trojan.Win32.Agent.52736.C]
VirusBuster 4.5.11.0/20080810 found nothing
Webwasher-Gateway 6.6.2/20080811 found [Trojan.Crypt.CFI.Gen]