full-disclosure - MSN Messanger Virus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue Dec 13 18:41:20 2005
From: iago at valhallalegends.com (Ron)
Subject: MSN Messanger Virus

Damnit, you posted that while I was cleaning up the results.

FWIW, here's my columnized version of virustotal.com's output:

Antivirus     Version        Update      Result
AntiVir       6.33.0.61      12.13.2005  TR/Dldr.Banload.ID.4
Avast         4.6.695.0      12.13.2005  no virus found
AVG           718            12.08.2005  no virus found
Avira         6.33.0.61      12.13.2005  TR/Dldr.Banload.ID.4
BitDefender   7.2            12.13.2005 
GenPack:Trojan.Downloader.Banload.ID
CAT-QuickHeal 8.00           12.13.2005  TrojanDownloader.Banload.id
ClamAV        devel-20051108 12.12.2005  no virus found
DrWeb         4.33           12.13.2005  Trojan.DownLoader.5891
eTrust-Iris   7.1.194.0      12.13.2005  no virus found
eTrust-Vet    12.3.3.0       12.13.2005  no virus found
Fortinet      2.54.0.0       12.12.2005  W32/Banker.ID!dldr
F-Prot        3.16c          12.12.2005  no virus found
Ikarus        0.2.59.0       12.13.2005  no virus found
Kaspersky     4.0.2.24       12.13.2005  Trojan-Downloader.Win32.Banload.id
McAfee        4649           12.13.2005  PWS-Banker.dldr
NOD32v2       1.1320         12.12.2005  probably unknown NewHeur_PE virus
Norman        5.70.10        12.13.2005  no virus found
Panda         8.02.00        12.13.2005  Trj/Nabload.R
Sophos        4.00.0         12.13.2005  no virus found
Symantec      8.0            12.13.2005  no virus found
TheHacker     5.9.1.054      12.13.2005  no virus found
VBA32         3.10.5         12.13.2005  Trojan-Downloader.Win32.Banload.id


Bernardo Quintero wrote:
>> Mira las fotos >>> http://hometown.aol.com.au/miralafoto/imagens001.exe
>>
>> I've run a couple of virus scanners on this file with none of them being
>> able to figure out what it is.  Anyone have any clues?  Also, I'm having
> 
> http://www.virustotal.com
> 
> Scan results
> File: imagens001.exe
> Date: 12/13/2005 19:30:16 (CET)
> ----
> AntiVir 6.33.0.61/20051213 found [TR/Dldr.Banload.ID.4]
> Avast 4.6.695.0/20051213 found nothing
> AVG 718/20051208 found nothing
> Avira 6.33.0.61/20051213 found [TR/Dldr.Banload.ID.4]
> BitDefender 7.2/20051213 found [GenPack:Trojan.Downloader.Banload.ID]
> CAT-QuickHeal 8.00/20051213 found [TrojanDownloader.Banload.id]
> ClamAV devel-20051108/20051212 found nothing
> DrWeb  4.33/20051213 found [Trojan.DownLoader.5891]
> eTrust-Iris 7.1.194.0/20051213 found nothing
> eTrust-Vet 12.3.3.0/20051213 found nothing
> Fortinet 2.54.0.0/20051212 found [W32/Banker.ID!dldr]
> F-Prot 3.16c/20051212 found nothing
> Ikarus 0.2.59.0/20051213 found nothing
> Kaspersky 4.0.2.24/20051213 found [Trojan-Downloader.Win32.Banload.id]
> McAfee 4649/20051213 found [PWS-Banker.dldr]
> NOD32v2 1.1320/20051212 found [probably unknown NewHeur_PE virus]
> Norman 5.70.10/20051213 found nothing
> Panda 8.02.00/20051213 found [Trj/Nabload.R]
> Sophos 4.00.0/20051213 found nothing
> Symantec 8.0/20051213 found nothing
> TheHacker 5.9.1.054/20051213 found nothing
> VBA32 3.10.5/20051213 found [Trojan-Downloader.Win32.Banload.id]
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>