begood Posted November 23, 2009 Report Posted November 23, 2009 Virustotal. MD5: 975b3b8757223713adf2872481dbb291 Heuristic.Malware HEUR/Malware W32/Banload.E.gen!Eldoradorevin cu mai multe detalii mai tarziuThreatExpert Report: Possible_VirusRezumat :Din cate observ, cauta valoarea ETS din registrii => iti fura tokenul de autentificare pentru a se putea loga pe contul tau yahoo.com. * The following files were created in the system:# Filename(s) File Size File Hash Alias1 %System%\libeay32.dll 1,028,096 bytes MD5: 0xDB003F88A9A7498DD0999214CA4304EBSHA-1: 0x28660092D1D8B9DCC288DF2EEA1CD437D2307E2E (not available)2 [file and pathname of the sample #1] 2,910,208 bytes MD5: 0x975B3B8757223713ADF2872481DBB291SHA-1: 0x9B2462D23E007DD301A7B8D2373583FED9BF6004 (not available)3 %System%\ssleay32.dll 200,704 bytes MD5: 0x1D77A023F3EA2B9442D2C34B8B607E37SHA-1: 0x9E41DCF7F8E42FF146ABE5BC614BFF9129C70229 (not available)4 %System%\YahooAuth2.dll 551,424 bytes MD5: 0xBE6E3784CEE3F7DECE23ED9D4DE5B4A2SHA-1: 0xCD5BB8DC1736564F4D799D30766E9EA1284892B8 (not available)5 %System%\yahooui.exe 644,608 bytes MD5: 0x7DA80FF7E6FA6824C10A0052C5FFFB20SHA-1: 0xA916FA03A6D0A7B6BF489A81088262BDEF780EDC Possible_Virus [Trend Micro]Vreti sa-l analizati ?http://romanisme2009.blogspot.com/Iti cere sa instalezi un addon pentru browser (divix.exe) "cica" pentru a vedea un filmulet. Iar asa te duce pe filebox, (nu mai stiu exact locatia, n-am timp acum de analiza).LE: discutie cica:prieten (infectat): o cunosti? hxxp://romanisme2009.blogspot.com/ )eu: hopaprieten (infectat): brbeu: sau un idiot care s-a logat pe idul astaHide Recent Messages (F3)prieten (infectat): sa intrii sa imi zici ce parere ai ca sigur recunosti personajuLE2 : cred ca sunt primul care a prins (aceasta(?)) versiune de trojan in libertate. (nu era analizat pe virustotal nici pe threatexpert)LE3 : doar pentru SEO.libeay32.dll 1,028,096 bytes MD5: DB003F88A9A7498DD0999214CA4304EBSHA-1: 28660092D1D8B9DCC288DF2EEA1CD437D2307E2E libeay32.dll 2,910,208 bytes MD5: 975B3B8757223713ADF2872481DBB291SHA-1: 9B2462D23E007DD301A7B8D2373583FED9BF6004 ssleay32.dll 200,704 bytes MD5: 1D77A023F3EA2B9442D2C34B8B607E37SHA-1: 9E41DCF7F8E42FF146ABE5BC614BFF9129C70229 (not available)YahooAuth2.dll 551,424 bytes MD5: BE6E3784CEE3F7DECE23ED9D4DE5B4A2SHA-1: CD5BB8DC1736564F4D799D30766E9EA1284892B8 yahooui.exe 644,608 bytes MD5: 7DA80FF7E6FA6824C10A0052C5FFFB20SHA-1: A916FA03A6D0A7B6BF489A81088262BDEF780EDC Possible_Virus [Trend Micro] Quote
immun3 Posted November 24, 2009 Report Posted November 24, 2009 The requested URL could not be retrievedURL:COMPORTAMENT VULGARBlocked by Web Anti-VirusReason: phishing attackClick here if you think the web page has been blocked incorrectly!Generated:5:00:52 PMKaspersky Internet Security 2010 Quote
daatdraqq Posted November 24, 2009 Report Posted November 24, 2009 E bine 'barem ca e facut de un roman Quote
Nytro Posted November 24, 2009 Report Posted November 24, 2009 Nu am avut timp si nu o sa il analizez, sa vad ce face practic, dar am vazut ca are mai multe componente scrise in limbaje de programare diferite, foloseste openssl, functii din librariile de la Yahoo! Messenger, face logarea prin user si parola pe yahoo, de asemenea si prin token, citeste ETS ia Yahoo! User ID din Registry... Asta stiu pentru ca m-am uitat prin executabil cu Notepad++. In mod normal as lua Process Monitor, Wireshark si l-as rula in conditii sigure. Poate face cineva asta... Daca nu are ce face. Quote
immun3 Posted November 25, 2009 Report Posted November 25, 2009 cum se scapa de acest virus??? are un prieten si m-a intrebat Quote
N-W-A Posted November 25, 2009 Report Posted November 25, 2009 nu e deloc nou. conceptul e "fumat"...poate modul de preluare a datelor e nou. Quote
virusz Posted November 25, 2009 Report Posted November 25, 2009 dap, e chiar o porcarie de cativa mega acolo care nu face decat sa trimita un mesaj la fiecare id din lista, id-ul daca il gaseste in pc-ul victima... foloseste http://www.imcomponents.com/ca sa scapi de el stergi:yahooui.exe si yahooatuh2.dll din system32si daca e la startup foloseste autoruns sau msconfigm-am uitat ieri peste el, l-am sters ... dar azi as avea nevoie de YahooAuth2.dll din el, asa ca daca il mai are cineva il rog sa faca un upload undeva...LE: am gasit..., http://dl.fisier.ro/files/fdihmj3mf84ca2r/divix2.exe.html Quote
TheJudger Posted November 25, 2009 Report Posted November 25, 2009 virusz, zi-mi daca gasesti cum trimite mesaj la lista de contacte... Quote
begood Posted November 25, 2009 Author Report Posted November 25, 2009 second mirrorhttp://www.2shared.com/file/9439172/bfc49064/divix3_virus.htmlhahah si kenny il are =) Quote
kenny Posted November 25, 2009 Report Posted November 25, 2009 Era o gluma, ti-am zis dupa.Stefan Nita: o cunosti? COMPORTAMENT VULGAR )BUZZ!!!EU: si tu EU: ai virusStefan Nita: intra ca nu e nici un virusEU: UE cu rahat e virusEU: http://rstcenter.com/forum/18202-nou-virus-libertate-se-propaga-prin-y-im.rstStefan Nita: intra ca nu e nici un virusStefan Nita is typing a message.Stefan Nita: intra ca nu e nici un virusEU: niceStefan Nita: brbEU: lolEU: ce rahatEU: GHITA TE-AU LUAT SI PE TINEEEE Quote
begood Posted November 25, 2009 Author Report Posted November 25, 2009 Stringuri primite de la userul Andreea:"v 4.0 FINAL""sa intrii sa imi zici ce parere ai ca sigur recunosti personaju ;)""alle28alle""o cunosti? ""virusintra ca nu e nici un virusestiuita-te si vrb dupamergetrebuie sa instalezi programu ca sa meargaastavezi daca o cunostifricanu are de ce sa iti fie frica<ding>"http://relay.msg.yahoo.com/relay?token=""Insupported HTTP version" Quote
wvw Posted November 25, 2009 Report Posted November 25, 2009 (edited) (12:46:47 AM) A: o cunosti? o-lume-nebuna-de-tot.blogspot.com )(12:46:47 AM) A has buzzed you!(12:47:03 AM) B: Ah, super-virus. Imi trimite linkuri de blogspot. (12:47:03 AM) A: intra ca nu e nici un virus(12:47:23 AM) B: Foarte tare. Si virusul asta stie sa parseze limbajul natural! (12:47:24 AM) A: intra ca nu e nici un virus(12:49:59 AM) B: Ping-pong. A is typing...(12:55:58 AM) A: sa intrii sa imi zici ce parere ai ca sigur recunosti personaju Edited November 25, 2009 by wvw Quote
BlackRose Posted November 30, 2009 Report Posted November 30, 2009 spl_stefanov (29.11.2009 17:51:00): o cunosti? COMPORTAMENT VULGAR )Mihai ™ M!hai (29.11.2009 17:51:09): daMihai ™ M!hai (29.11.2009 17:51:14): Mihai ™ M!hai (29.11.2009 17:53:03): e un virus frumos rau spl_stefanov (29.11.2009 17:53:03): intra ca nu e nici un virusMihai ™ M!hai (29.11.2009 17:53:04): Mihai ™ M!hai (29.11.2009 17:53:28): serios ?spl_stefanov (29.11.2009 17:53:28): brbMihai ™ M!hai (29.11.2009 17:53:35): hai ca intru acumMihai ™ M!hai (29.11.2009 17:53:37): stai asaspl_stefanov (29.11.2009 17:54:02): sa intrii sa imi zici ce parere ai ca sigur recunosti personajuCe rau poate sa iti faca virusul? Cum poti scapa de el ? Quote
Nytro Posted November 30, 2009 Report Posted November 30, 2009 "intra ca nu e nici un virus""brb"...................Asta zice virusul. Practic nu stiu ce face, dar tabela de importuri e uriasa. Quote
temp Posted November 30, 2009 Report Posted November 30, 2009 (edited) pai se sterge asfel ... start run "taskkill /F /IM yahooui.exe"dupa care stergi %WINDIR%\system32\yahooui.exe%WINDIR%\system32\yahooauth2.dllsi aici HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shellte delogheaza ... are key logger si-ti ia parola si idul ... iti fura tokenul ... poate mai mult ...AH DA ... mai facea ceva cu librariile alea de openSSL dar am uitat ce ... oricum e destul de complex ... main exe e facut in Delphi 7 si are in el ca RES 4 fisiere ... 2 de openssl ... yahooui si yahooauth2.dll ... se foloseste de librariile de la bricksoft pentru logare si raspandire ... Edited November 30, 2009 by temp Quote
Gonzalez Posted November 30, 2009 Report Posted November 30, 2009 Naspa pentru iubitorii de Y!M. -Gonzalez Quote
