MediaTubeCodec_ver1.971.45.exe [md5:1a34c39]

mofunzone

File:	MediaTubeCodec_ver1.971.45.exe
Status:	INFECTED/MALWARE
MD5:	1a34c39a2a3b13554c638590f9db652d
Packers detected:	-
Bit9 reports:	File not found
Scanner results
Scan taken on 17 Apr 2008 23:07:41 (GMT)
A-Squared	Found  nothing
AntiVir	Found  nothing
ArcaVir	Found Heur.W32
Avast	Found  nothing
AVG Antivirus	Found  nothing
BitDefender	Found  nothing
ClamAV	Found  nothing
CPsecure	Found  nothing
Dr.Web	Found  nothing
F-Prot Antivirus	Found  nothing
F-Secure Anti-Virus	Found  nothing
Fortinet	Found  nothing
Ikarus	Found  nothing
Kaspersky Anti-Virus	Found  nothing
NOD32	Found  nothing
Norman Virus Control	Found  nothing
Panda Antivirus	Found  nothing
Sophos Antivirus	Found Mal/EncPk-DA
VirusBuster	Found  nothing
VBA32	Found Downloader.Zlob.8 (probable variant)

HC303

上报红伞。

天下无毒

解压运行红伞+微点都不报 但是自动下载了许多木马程序! 这个时候红伞+微点  杀...............

[ 本帖最后由 天下无毒 于 2008-4-18 07:54 编辑 ]

sam.to

上报卡巴

挪威的冬天

金山 0

hyxuzhimin

红伞 微点都过？？？好强的木马呀？

solcroft

丢上网盘试一试的结果

Nblock

MEDIATUBECODEC_VER1.971.45.EXE
协议类型:TCP
本地地址:0.0.0.0
本地端口:2266
远端地址:85.255.120.234(乌克兰)  远端地址:77.91.227.179(美国)
远端端口:80

微点发现未知后门+木马

后门LGMXVPATNPA.DLL
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{F97B50CB-E441-427A-967E-0300347AD03E} (Default)   

E:\MEDIATUBECODEC_VER1.971.45.EXE
木马程序生成以下文件:
1) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\NSD1A.TMP\BLOWFISH.DLL
2) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\AC8ZT2\QTVGLPED.DLL
3) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\AC8ZT2\OMLBPKAW.DLL
4) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\AC8ZT2\RTQMEKWG.EXE
5) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\AC8ZT2\PMSOARBF.DLL
6) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\AC8ZT2\NPQTSRAK.EXE
7) C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LOCAL SETTINGS\TEMP\AC8ZT2\LGMXVPATNPA.DLL
是否删除木马程序及其衍生物?

[ 本帖最后由 Nblock 于 2008-4-18 16:32 编辑 ]

sam.to

Hello,

dongle.exe_ - Trojan-PSW.Win32.OnLineGames.xtz,
yzznabofpg.exe_ - Trojan.Win32.Agent.ewe,
MediaTubeCodec_ver1.971.45.exe_ - Trojan-Downloader.Win32.Zlob.ljh

These files are already detected. Please update your antivirus bases.

zwjabb.exe_ - Trojan.Win32.Pakes.crh,
explorer32.exe_ - Trojan.Win32.Obfuscated.yg,
file.exe_ - Trojan-Downloader.Win32.Agent.nhz

New malicious software was found in these files. Detection will be included in the next update. Thank you for your help.

Please quote all when answering.

--
Best regards, Kirill Erakhtin
Virus analyst, Kaspersky Lab.
e-mail: newvirus@kaspersky.com
http://www.kaspersky.com/

http://www.kaspersky.com/virusscanner - free online virus scanner.
http://www.kaspersky.com/helpdesk.html - technical support.

saber123

ASPack 2.12 -> Alexey Solodovnikov

反汇编工作还没有做完。。