From: "Ant" <
[email protected]>
| "David H. Lipman" wrote:
|
[...] Therefore I can NOT conclude that one MIGRATE.DLL
for Eastman Kodak can be falsely declared by AVG as well as another for IE migration.
|
| Fair enough. I was just trying to figure out how IE came to be mentioned.
||
| It turns out that Lofty can't type! His was in fact the Eastman-Kodak
| migrate.dll -- so all's well.
|
Thanx Ant. Which os proof that one needs to state the fully qulaified name and path to a
file and not just a file name.
BTW: That site where you decoded the PHP for me, it is a server for a spam bot network.
The file WIN.EXE changes periodically. Sometimes its is the same file but now using new
compression and sometimes it is a completely different file. I have continued to track the
server and the variations of the file and submitted all variations to the anti malware
vendors. I wonder if XOD, the author of the PHP, is the author of the WIN.EXE file as well.
Yesterday the file was 9KB and Today it is 13KB.
Complete scanning result of "win.exe", processed in VirusTotal at 12/12/2006 03:39:32 (CET).
[ file data ]
* name: win.exe
* size: 13312
* md5.: 1ab44030d29a0b6131413fa2bdc195bd
* sha1: d1d35d9172ea30bc2380485124edacdad26a10a3
[ scan result ]
AntiVir 7.2.0.49/20061211 found nothing
Authentium 4.93.8/20061211 found [Possibly a new variant of
W32/SecRisk-ProcessPatcher-Sml-based!Maximus]
Avast 4.7.892.0/20061211 found nothing
AVG 386/20061211 found nothing
BitDefender 7.2/20061212 found nothing
CAT-QuickHeal 8.00/20061211 found [(Suspicious) - DNAScan]
ClamAV devel-20060426/20061211 found nothing
DrWeb 4.33/20061211 found [MULDROP.Trojan packed by BINARYRES]
eSafe 7.0.14.0/20061211 found nothing
eTrust-InoculateIT 23.73.83/20061212 found nothing
eTrust-Vet 30.3.3244/20061211 found nothing
Ewido 4.0/20061211 found nothing
F-Prot 3.16f/20061211 found [Possibly a new variant of
W32/SecRisk-ProcessPatcher-Sml-based!Maximus]
F-Prot4 4.2.1.29/20061211 found [W32/SecRisk-ProcessPatcher-Sml-based!Maximus]
Fortinet 2.82.0.0/20061211 found nothing
Ikarus T3.1.0.26/20061211 found nothing
Kaspersky 4.0.2.24/20061212 found nothing
McAfee 4916/20061211 found nothing
Microsoft 1.1804/20061212 found nothing
NOD32v2 1915/20061212 found [a variant of Win32/TrojanDownloader.Tiny.NBP]
Norman 5.80.02/20061211 found [W32/Tiny.MQ.dropper]
Panda 9.0.0.4/20061212 found [Suspicious file]
Prevx1 V2/20061212 found nothing
Sophos 4.12.0/20061210 found nothing
Sunbelt 2.2.907.0/20061130 found nothing
TheHacker 6.0.3.131/20061210 found nothing
UNA 1.83/20061211 found nothing
VBA32 3.11.1/20061211 found [suspected of Embedded.Trojan.DownLoader.15213]
VirusBuster 4.3.15:9/20061211 found nothing
[ notes ]
packers: BINARYRES
packers: embedded
norman sandbox: [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: (e-mail address removed) - REMEMBER TO ENCRYPT
IT (E.G. ZIP WITH PASSWORD)**.
* File length: 13312 bytes.
[ Changes to filesystem ]
* Deletes file winntdll.exe.
* Creates file C:\WINDOWS\winntdll.exe.
* Deletes file C:\WINDOWS\gg.dll.
* Creates file C:\WINDOWS\gg.dll.
[ Process/window information ]
* Creates a mutex [t~t~t~t~t~t~t].
* Enumerates running processes.
[ Signature Scanning ]
* C:\WINDOWS\winntdll.exe (2560 bytes) : W32/Tiny.MQ.
BTW: I really think you did great in decoding the PHP file !
(