First virus in 2 years...

[aztecx]

I believe there may have been 3 viruses that were attached to the infected file I executed but here are samples of two of them. One is a dump while the other is just the original file that was copied into the temp folder at execution.

Anyways I've attached a rar file with the two infected files. Anyone that collects malware enjoy.

Anyways as I'm still in the process of trying to remove it so hopefully I don't run into any big difficulties.

PASS - aztecx

Malware.rar

[CodeExplorer]

You may want to rename your file from exe to vir or something: just to make sure that nobody will infect their computer!

Dumped - Trojan.Fakealert.3753 ?

http://www.virustotal.com/ro/analisis/a8d7...e0dc1933e1c238d

http://virusscan.jotti.org/en/scanresult/4...2a39780400da1db

silent.vir:

http://www.virustotal.com/ro/analisis/cde6...3114f386f64ae02

threatexpert on Dumped.vir:

http://www.threatexpert.com/report.aspx?md...de850ebb098cf33

threatexpert on silent.vir:

http://www.threatexpert.com/report.aspx?md...5961f1806b515d1

Edited May 21, 2009 by CodeRipper

[aztecx]

Ok I'm pretty sure i've removed it completely. Anyways one of the viruses actually makes changes to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

and modifies two registry entries in there to make sure you arn't able to change your desktop background. This didn't actually show up in anubis which kind of sucks.

All my restore points have been deleted by the virus and the only one in existence has been created after infection.

The virus makes a number of connection attempts to one domain and one IP address.

(and no i was not downloading p**n haha)

www.lovelyp**novideo.netRegistration Service Provided By: Triple8 Network
Contact: 
Visit: www.888.netDomain name: 206.netRegistrant Contact:
   Triple8 Network
   Sys Admin ()   Fax: 
   1225 W.190th St., 240
   Gardena, CA 90248
   USAdministrative Contact:
   NA
   Louis R Vazquez ()
   +1.3105335855
   Fax: +1.3105335845
   350 S. Crenshaw Blvd.
   Suite A202
   Torrance, CA 90503
   USTechnical Contact:
   Triple8 Network
   Sys Admin ()
   +1.8005459902
   Fax: +1.3105161162
   1225 W.190th St., 240
   Gardena, CA 90248
   USStatus: LockedName Servers:
   NS1.888.net
   NS2.888.netCreation date: 23 May 1996 04:00:00
Expiration date: 24 May 2010 04:00:00

206.51.235.145OrgName:	NOC4Hosts Inc. 
OrgID:	  NOC4H
Address:	4465 W. Gandy Blvd
Address:	Suite 812
City:	   Tampa
StateProv:  FL
PostalCode: 33611
Country:	USReferralServer: rwhois://rwhois.noc4hosts.com:4321/NetRange:   206.51.224.0 - 206.51.239.255 
CIDR:	   206.51.224.0/20 
NetName:	NOC4HOSTS
NetHandle:  NET-206-51-224-0-1
Parent:	 NET-206-0-0-0-0
NetType:	Direct Assignment
NameServer: NS.NOC4HOSTS.COM
NameServer: NS2.NOC4HOSTS.COM
Comment:	
RegDate:	2004-04-30
Updated:	2004-04-30OrgAbuseHandle: NAA7-ARIN
OrgAbuseName:   Noc4Hosts Abuse Admin 
OrgAbusePhone:  +1-877-801-1443
OrgAbuseEmail:  abuse@noc4hosts.comOrgTechHandle: IPADM158-ARIN
OrgTechName:   IP Admin 
OrgTechPhone:  +1-877-801-1443
OrgTechEmail:  noc@noc4hosts.com

Edited May 21, 2009 by aztecx

[CodeExplorer]

I send these viruses to Kaspersky and here is the result:

Dumped.vir: This file is corrupted.

silent.vir: Trojan-Downloader.Win32.Delf.ppy

silent.vir is a trojan so you don't have what to clear from that file:

the hole file is malicious!