myPhoto11x.zip / Worm.Win32.AutoRun.mxz

[Malekal_morte]

Se propage par le fichier contenant le fichier myPhoto11x.zip (se trouve dans %windir%) contenant le fichier myPhoto11.JPEG_www.myspace.scr

Message de propagation :

I found this picture of u in photobucket, when did u took this?
I think I got a picture from you in imageshack, when was this?
Have you seen this awesome picture of me?
have you used this picture of us for your facebook default pic? its niceeeee !! :P
let me know if you like this picture, I just took it :]
can I like plz upload this picture of us to my new online album?
is it ok if I add this picture of us to my facebook?
I just found your pic double haha!! look at this

L'infection ajoute la ligne suivante sur HijackThis :

O4 - HKLM\..\Run: [Symantec Licensing Source] symlsrc.exe

Fichier VS08091000138-000001 reçu le 2008.09.10 10:22:01 (CET)
Situation actuelle: terminé
Résultat: 6/36 (16.67%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus Version Dernière mise à jour Résultat
AhnLab-V3 2008.9.6.0 2008.09.10 -
AntiVir 7.8.1.28 2008.09.10 -
Authentium 5.1.0.4 2008.09.10 -
Avast 4.8.1195.0 2008.09.10 -
AVG 8.0.0.161 2008.09.09 Dropper.Generic.ABDF
BitDefender 7.2 2008.09.10 -
CAT-QuickHeal 9.50 2008.09.10 -
ClamAV 0.93.1 2008.09.10 -
DrWeb 4.44.0.09170 2008.09.10 Win32.HLLW.Autoruner.2685
eSafe 7.0.17.0 2008.09.09 -
eTrust-Vet 31.6.6080 2008.09.09 Win32/Slenfbot!generic
Ewido 4.0 2008.09.09 -
F-Prot 4.4.4.56 2008.09.09 -
F-Secure 8.0.14332.0 2008.09.10 -
Fortinet 3.112.0.0 2008.09.10 -
GData 19 2008.09.10 -
Ikarus T3.1.1.34.0 2008.09.10 VirTool.Win32.DelfInject.AF
K7AntiVirus 7.10.448 2008.09.09 -
Kaspersky 7.0.0.125 2008.09.10 -
McAfee 5380 2008.09.09 -
Microsoft 1.3903 2008.09.10 VirTool:Win32/Injector.gen!D
NOD32v2 3429 2008.09.09 a variant of Win32/Injector.CR
Norman 5.80.02 2008.09.09 -
Panda 9.0.0.4 2008.09.09 -
PCTools 4.4.2.0 2008.09.09 -
Prevx1 V2 2008.09.10 -
Rising 20.61.21.00 2008.09.10 -
Sophos 4.33.0 2008.09.10 -
Sunbelt 3.1.1616.1 2008.09.09 -
Symantec 10 2008.09.10 -
TheHacker 6.3.0.9.077 2008.09.10 -
TrendMicro 8.700.0.1004 2008.09.10 -
VBA32 3.12.8.5 2008.09.09 -
ViRobot 2008.9.10.1370 2008.09.10 -
VirusBuster 4.5.11.0 2008.09.09 -
Webwasher-Gateway 6.6.2 2008.09.10 -
Information additionnelle
File size: 64000 bytes
MD5...: 1347a5850958dce87216411605fc6943
SHA1..: 4ffea76d2e204520411667bd6ef0f62b0ba4c807

[Malekal_morte]

Antivir :

The file 'x003.exe' has been determined to be 'MALWARE'. Our analysts named the threat TR/Hoster.G. The term "TR/" denotes a trojan horse that is able to spy out data, to violate your privacy or carry out unwanted modifications to the system.Detection will be added to our virus definition file (VDF) with one of the next updates.

[Malekal_morte]

Kaspersky :

Hello,

x003.exe_ - Worm.Win32.AutoRun.mxz

New malicious software was found in this file. It's detection will be included in the next update. Thank you for your help.

Please quote all when answering.