www.msn-fotolari.info/viewimage.php / Trojan.Win32.Buzus.rvf

[Malekal_morte]

Variante Virus MSN : Picture can not be displayed

Message de propagation :

bu resim seninmi ? hxxp://www.msn-fotolari.info/viewimage.php?id= .

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [Windows Services M7] ctfmon32.exe

VirSCAN.org Scanned Report :
Scanned time : 2008/08/17 22:34:12 (CEST)
Scanner results: 39% Scanner(14/36) found malware!

File Name : viewimage.php
File Size : 83968 byte
File Type : PE32 executable for MS Windows (GUI) Intel 80386 32-bit
MD5 : e8cfee0d6b806782b539573677462894
SHA1 : 14675c8cc5d597c45121c649f9c24db4f0e936dc
Online report : http://virscan.org/report/f2b38905b60db ... b105f.html



Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 3.5.0.22 2008.08.17 2008-08-17 2.60 Trojan.Win32.Buzus.lvg
AhnLab V3 2008.08.15.00 2008.08.15 2008-08-15 1.80 -
AntiVir 7.8.1.19 7.0.6.24 2008-08-16 2.19 TR/Drop.Agent.65024
Arcavir 1.0.5 200808171633 2008-08-17 1.25 -
AVAST! 3.0.1 080817-0 2008-08-17 0.01 -
AVG 7.5.51.442 270.6.4/1617 2008-08-17 1.52 Generic10.BCMK
BitDefender 7.60825.1556497 7.20559 2008-08-18 2.82 Trojan.Injector.AF
CA (VET) 9.0.0.143 31.6.6035 2008-08-15 5.34 -
ClamAV 0.93.3 8051 2008-08-16 0.02 Trojan.SdBot-9299
Comodo 2.11 2.0.0.619 2008-08-17 0.45 -
CP Secure 1.1.0.715 2008.08.18 2008-08-18 6.16 BackDoor.W32.SdBot.amv
Dr.Web 4.44.0.9170 2008.08.17 2008-08-17 3.08 -
ewido 4.0.0.2 2008.08.17 2008-08-17 3.52 -
F-Prot 4.4.4.56 20080817 2008-08-17 0.98 W32/Backdoor2.BXXR (exact)
F-Secure 5.51.6100 2008.08.17.01 2008-08-17 0.04 -
Fortinet 2.81-3.11 9.436 2008-08-18 2.35 -
ViRobot 20080816 2008.08.16 2008-08-16 0.40 -
Ikarus T3.1.01.34 2008.08.17.71292 2008-08-17 3.41 Trojan.Injector.AF
JiangMin 11.0.706 2008.08.17 2008-08-17 1.26 Trojan/Buzus.bva
Kaspersky 5.5.10 2008.08.17 2008-08-17 0.03 -
KingSoft 2008.1.14.15 2008.8.17.15 2008-08-17 2.09 -
McAfee 5.2.00 5362 2008-08-15 2.53 -
Microsoft 1.3807 2008.08.17 2008-08-17 4.23 VirTool:Win32/DelfInject.gen!A
mks_vir 2.01 2008.08.17 2008-08-17 2.64 -
Norman 5.93.01 5.93.00 2008-08-15 4.82 W32/Malware.DGRI
Panda 9.05.01 2008.08.17 2008-08-17 2.14 Suspicious file
Trend Micro 8.700-1004 5.482.22 2008-08-17 0.03 -
Quick Heal 9.50 2008.08.16 2008-08-16 1.76 -
Rising 20.0 20.57.62.00 2008-08-17 1.25 -
Sophos 2.77.0 4.32 2008-08-18 1.86 -
Sunbelt 3.1.1546.1 2193 2008-08-14 0.45 -
Symantec 1.3.0.24 20080817.003 2008-08-17 0.05 -
nProtect 2008-08-14.01 1801264 2008-08-14 3.44 Trojan/W32.Buzus.271872
The Hacker 6.2.96 v00396 2008-08-11 0.41 -
VBA32 3.12.8.3 20080816.1123 2008-08-16 1.08 Net-Worm.Win32.Kolab.afc
VirusBuster 4.5.11.10 10.84.3/598170 2008-08-17 0.83 -

[Malekal_morte]

Complete scanning result of "viewimage.php", processed in VirusTotal at 08/18/2008 13:52:37 (CET).

[ file data ]
* name..: viewimage.php
* size..: 83968
* md5...: e8cfee0d6b806782b539573677462894
* sha1..: 14675c8cc5d597c45121c649f9c24db4f0e936dc
* peid..: -

[ scan result ]
AhnLab-V3 2008.8.15.0/20080818 found nothing
AntiVir 7.8.1.19/20080818 found [TR/Drop.Agent.65024]
Authentium 5.1.0.4/20080818 found [W32/Backdoor2.BXXR]
Avast 4.8.1195.0/20080817 found nothing
AVG 8.0.0.161/20080818 found [Generic10.BCMK]
BitDefender 7.2/20080818 found [Trojan.Injector.AF]
CAT-QuickHeal 9.50/20080816 found nothing
ClamAV 0.93.1/20080818 found [Trojan.SdBot-9299]
DrWeb 4.44.0.09170/20080818 found nothing
eSafe 7.0.17.0/20080817 found nothing
eTrust-Vet 31.6.6035/20080815 found nothing
Ewido 4.0/20080818 found nothing
F-Prot 4.4.4.56/20080818 found [W32/Backdoor2.BXXR]
Fortinet 3.14.0.0/20080818 found [PossibleThreat]
GData 2.0.7306.1023/20080818 found [Trojan.Win32.Buzus.rvf]
Ikarus T3.1.1.34.0/20080818 found [Trojan.Injector.AF]
K7AntiVirus 7.10.417/20080818 found [Trojan.Win32.Buzus.lvg]
Kaspersky 7.0.0.125/20080818 found [Trojan.Win32.Buzus.rvf]
McAfee 5362/20080815 found nothing
Microsoft 1.3807/20080818 found [VirTool:Win32/DelfInject.gen!A]
NOD32v2 3364/20080818 found nothing
Norman 5.80.02/20080815 found [W32/Malware.DGRI]
Panda 9.0.0.4/20080817 found nothing
PCTools 4.4.2.0/20080817 found nothing
Rising 20.58.02.00/20080818 found nothing
Sophos 4.32.0/20080818 found nothing
Sunbelt 3.1.1546.1/20080815 found nothing
Symantec 10/20080818 found nothing
TheHacker 6.3.0.5.053/20080818 found nothing
TrendMicro 8.700.0.1004/20080818 found nothing
VBA32 3.12.8.3/20080818 found [Net-Worm.Win32.Kolab.afc]
ViRobot 2008.8.18.1339/20080818 found [Spyware.Buzus.83968]
VirusBuster 4.5.11.0/20080818 found nothing
Webwasher-Gateway 6.6.2/20080818 found [Trojan.Drop.Agent.65024]