[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
RE: New Virus?
I find http://sandbox.norman.no/live.html very useful for determining
unknown files. It gives you quite nice information about it.
Here is an example of output you will get with this:
Report created: 15.08.2005 23:38:35
Automatic Sandbox analysis of unknown malware (W32/Downloader)
[ General information ]
* Creating several executable files on hard-drive.
* File length: 38982 bytes.
[ Changes to filesystem ]
* Deletes file autorun.inf.
* Creates file C:\WINDOWS\System\CSRSS.EXE.
* Creates file C:\TEMP\upd_0001.exe.
[ Changes to registry ]
* Creates value ".svchost"="C:\WINDOWS\System\CSRSS.EXE" in key
[ Network services ]
* Opens URL: http://medabop.com/u/upd_0001.exe.
[ Security issues ]
* Starting downloaded file - potential security problem.
[ Process/window information ]
* Creates a mutex 3676C64A-W454-122E-BFC6-083C2BF4S551.
* Will automatically restart after boot (I'll be back...).
From: Alex Arndt [mailto:aarndt@xxxxxxxxxx]
Sent: 15. august 2005 21:50
To: incidents@xxxxxxxxxxxxxxxxxx; focus-virus@xxxxxxxxxxxxxxxxxx
Subject: New Virus?
I just received an e-mail (subject: test) with a ZIP archive attachment
claims to be from "MAILER-DAEMON@xxxxxxxxxx", but it in reality from IP
ZIP Attachment, when opened contains an .EXE file that is attempting to
like a .DOC file by using a number of spaces in it. Filename in the
received is "aarndt@xxxxxxxxxxxxxx
This is likely a Trojan or other backdoor program. The interesting thing
that my AV software (which is the free CA anti-virus provided by Rogers
Yahoo) is not picking it up, nor is the Symantec-based AV scanning that
Rogers uses on inbound e-mail.
I will be forwarding the e-mail to AV vendors as a sample. Just figured
give everyone a heads-up just in case...
FYI, a quick Google search of the .EXE filename came up with nothing. In
fact, I got this error message when I tried to search for
<SAMPLE WEB PAGE>
... but we can't process your request right now. A computer virus or
application is sending us automated requests, and it appears that your
computer or network has been infected.
We'll restore your access as quickly as possible, so try again soon. In
meantime, you might want to run a virus checker or spyware remover to
sure that your computer is free of viruses and other spurious software.
We apologize for the inconvenience, and hope we'll see you again on
</SAMPLE WEB PAGE>
I hope this information proves useful,
CISSP, GCIA, GCIH
"Within all order is the potential for chaos..."