CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
Donations. Become Premium Today! Premium Icon
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Login to check your private messagesLogin to check your private messages   LoginLogin   Your Favorite ForumsSelect FavForums 

MSN Messenger trojan

 
Post new topic   Reply to topic       All -> FavForums -> Web Malware Links [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Mrhero

Trooper
Trooper


Joined: Feb 26, 2007
Posts: 12
Location: Turkey
PostPosted: Sat Jan 12, 2008 9:55 pm    Post subject: MSN Messenger trojan
Reply with quote

Hi this a virus which spreads from MSN Messenger, If you chat with an infected machine it sends this message :

Quote:
bu fotograftaki senmisin hxxp://wxw.members.lycos.nl/hotnaked/?=mrher**@hotmail.com


"bu fotograftaki senmisin" is turkish and it means " Is that you at this photo". And mrher***@hotmail.com is my msn adress.
Back to top
View users profile Send private message
tacktick

MIRT Hunter
Premium Member

Joined: May 19, 2007
Posts: 624
Location: USA
MIRT Premium

PostPosted: Sun Jan 13, 2008 6:18 pm    Post subject:
Reply with quote

That link isnt valid anymore.
I did some net searching and cant find a valid link serving this malware so I cant check it out.
But let us know if you have anything else.


_________________
Analyzing, reporting and removing Malware. Fight the Scourge!
Back to top
View users profile Send private message
Mrhero

Trooper
Trooper


Joined: Feb 26, 2007
Posts: 12
Location: Turkey
PostPosted: Sun Jan 13, 2008 10:53 pm    Post subject:
Reply with quote

new link: hxx
hxxp://membres.lycos.fr/verynaked/?=mrher***@hotmail.com

also i have 2 files from these links. If u wish i can send them to you.
Back to top
View users profile Send private message
tacktick

MIRT Hunter
Premium Member

Joined: May 19, 2007
Posts: 624
Location: USA
MIRT Premium

PostPosted: Sun Jan 13, 2008 11:29 pm    Post subject:
Reply with quote

Thank you, I got a copy of the malware.
It has been put on the listserv.
CastleCops Link/postitle212791-0-0-.html

Code:

File naked391.com received on 01.13.2008 23:59:45 (CET)
Antivirus   Version   Last Update   Result
AhnLab-V3   2008.1.12.10   2008.01.11   -
AntiVir   7.6.0.46   2008.01.13   -
Authentium   4.93.8   2008.01.13   -
Avast   4.7.1098.0   2008.01.13   -
AVG   7.5.0.516   2008.01.13   BackDoor.Ircbot.CSW
BitDefender   7.2   2008.01.13   -
CAT-QuickHeal   9.00   2008.01.12   -
ClamAV   0.91.2   2008.01.13   -
DrWeb   4.44.0.09170   2008.01.13   -
eSafe   7.0.15.0   2008.01.13   suspicious Trojan/Worm
eTrust-Vet   31.3.5451   2008.01.11   -
Ewido   4.0   2008.01.13   -
FileAdvisor   1   2008.01.14   -
Fortinet   3.14.0.0   2008.01.13   -
F-Prot   4.4.2.54   2008.01.13   -
F-Secure   6.70.13030.0   2008.01.13   Trojan.Win32.Agent.dwd
Ikarus   T3.1.1.20   2008.01.13   -
Kaspersky   7.0.0.125   2008.01.13   Trojan.Win32.Agent.dwd
McAfee   5205   2008.01.11   -
Microsoft   1.3109   2008.01.13   Backdoor:Win32/IRCbot.gen!F
NOD32v2   2788   2008.01.13   a variant of Win32/IRCBot.AAL
Norman   5.80.02   2008.01.11   -
Panda   9.0.0.4   2008.01.13   -
Prevx1   V2   2008.01.14   Backdoor.IRCBot.gen
Rising   20.26.62.00   2008.01.13   -
Sophos   4.24.0   2008.01.13   -
Sunbelt   2.2.907.0   2008.01.12   -
Symantec   10   2008.01.13   -
TheHacker   6.2.9.187   2008.01.13   Trojan/Agent.dwd
VBA32   3.12.2.5   2008.01.13   -
VirusBuster   4.3.26:9   2008.01.13   -
Webwasher-Gateway   6.6.2   2008.01.13   -
Additional information
File size: 29184 bytes
MD5: 74eb7339b3dcb5cf7872c3bbd9cf3848
SHA1: 9bf1788775e8976c8c10c721c0eea744594f23a6
PEiD: -
packers: UPX
packers: PE_Patch.UPX, UPX


_________________
Analyzing, reporting and removing Malware. Fight the Scourge!
Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Web Malware Links All times are GMT
Page 1 of 1

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You cannot download files in this forum


Powered by phpBB © 2001 phpBB Group
2002-2008 © Computer Cops LLC dba CastleCops®. All rights reserved.
Acceptable Use Policy. Use signifies your agreement.
143ppm 0.393s (0.083s)
Making cybercriminals unhappy since 2002*
In Memory of Trpm
spacer spacer