1 reply to this topic

[ctrlaltdelete]

domain; pilotcodec.com

File pilotcodec1000.exe received on 08.01.2007 22:26:30 (CET)

Antivirus Version Last Update Result
AhnLab-V3 2007.8.2.0 2007.08.01 Win-Trojan/Xema.variant
AntiVir 7.4.0.54 2007.08.01 TR/DNSChanger.76041
Authentium 4.93.8 2007.08.01 is a security risk or a \"backdoor\" program
Avast 4.7.1029.0 2007.08.01 Win32:Trojan-gen. {Other}
AVG 7.5.0.476 2007.08.01 Downloader.Zlob.DEZ
BitDefender 7.2 2007.08.01 DeepScan:Generic.Zlob.7.41F1B32B
CAT-QuickHeal 9.00 2007.08.01 -
ClamAV 0.91 2007.08.01 -
DrWeb 4.33 2007.08.01 -
eSafe 7.0.15.0 2007.07.31 Win32.Zlob.acn
eTrust-Vet 31.1.5024 2007.08.01 -
Ewido 4.0 2007.08.01 -
FileAdvisor 1 2007.08.01 -
Fortinet 2.91.0.0 2007.08.01 W32/DNSChanger.JC!tr
F-Prot 4.3.2.48 2007.08.01 W32/Trojan.AWMQ
F-Secure 6.70.13030.0 2007.08.01 Zlob.AIZJ
Ikarus T3.1.1.8 2007.08.01 Generic.Zlob.7
Kaspersky 4.0.2.24 2007.08.01 -
McAfee 5088 2007.08.01 Puper
Microsoft 1.2704 2007.08.01 TrojanDownloader:Win32/Zlob!C29C
NOD32v2 2430 2007.07.31 Win32/TrojanDownloader.Zlob
Norman 5.80.02 2007.08.01 Zlob.AIZJ
Panda 9.0.0.4 2007.08.01 Adware/XXXAccess
Rising 19.34.22.00 2007.08.01 Trojan.Win32.Agent.ilq
Sophos 4.19.0 2007.08.01 -
Sunbelt 2.2.907.0 2007.08.01 -
Symantec 10 2007.08.01 Trojan.Zlob
TheHacker 6.1.7.160 2007.08.01 -
VBA32 3.12.2.2 2007.07.31 Trojan.Win32.TrojanDownloader.Zlob
VirusBuster 4.3.26:9 2007.08.01 -
Webwasher-Gateway 6.0.1 2007.08.01 Trojan.DNSChanger.76041

Additional information
File size: 76041 bytes
MD5: 60fa8565f19c38a85e55b1439eedebc5
SHA1: 1e5b225e98e5709dba5aae85d72d8f7c00a5aff9
packers: BINARYRES


Update;

Variants (also bigger file) on higher numbers pilotcodec(until 1500).exe

File pilotcodec1234.exe received on 08.01.2007 23:13:07 (CET)

Result: 13/32 (40.63%) <-- Nice feature

Antivirus Version Last Update Result
AhnLab-V3 2007.8.2.0 2007.08.01 -
AntiVir 7.4.0.54 2007.08.01 TR/DNSChanger.CA.4
Authentium 4.93.8 2007.08.01 -
Avast 4.7.1029.0 2007.08.01 -
AVG 7.5.0.476 2007.08.01 -
BitDefender 7.2 2007.08.01 DeepScan:Generic.Zlob.7.1FED44BB
CAT-QuickHeal 9.00 2007.08.01 -
ClamAV 0.91 2007.08.01 Trojan.Dropper-1385
DrWeb 4.33 2007.08.01 -
eSafe 7.0.15.0 2007.07.31 Win32.DNSChanger.jc
eTrust-Vet 31.1.5024 2007.08.01 -
Ewido 4.0 2007.08.01 -
FileAdvisor 1 2007.08.01 -
Fortinet 2.91.0.0 2007.08.01 W32/DNSChanger.JC!tr
F-Prot 4.3.2.48 2007.08.01 -
F-Secure 6.70.13030.0 2007.08.01 Trojan.Win32.DNSChanger.jc
Ikarus T3.1.1.8 2007.08.01 -
Kaspersky 4.0.2.24 2007.08.01 Trojan.Win32.DNSChanger.jc
McAfee 5088 2007.08.01 -
Microsoft 1.2704 2007.08.01 TrojanDownloader:Win32/Zlob.AMG
NOD32v2 2431 2007.08.01 -
Norman 5.80.02 2007.08.01 DNSChanger.gen9
Panda 9.0.0.4 2007.08.01 -
Prevx1 V2 2007.08.01 Generic.Dropper.xCodec
Rising 19.34.22.00 2007.08.01 -
Sophos 4.19.0 2007.08.01 -
Sunbelt 2.2.907.0 2007.08.01 -
Symantec 10 2007.08.01 Trojan.Zlob
TheHacker 6.1.7.160 2007.08.01 Trojan/DNSChanger.ik
VBA32 3.12.2.2 2007.07.31 -
VirusBuster 4.3.26:9 2007.08.01 -
Webwasher-Gateway 6.0.1 2007.08.01 Trojan.DNSChanger.CA.4

Additional information
File size: 211913 bytes
MD5: 9a76f608c964f1d0413d1f951d3ca77d
SHA1: 8e970ad0d6863c7ed647cbef05d9b930880e3fd9
packers: BINARYRES, BINARYRES
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5...797880005C7A56E

Prevx is back on VT, but the link isn't working.

This one does; http://info.prevx.com/aboutprogramtext.asp...797880030F1FBB7


I did test a few from that domain, they were all different...

[SwampDiner]

Already removed
Named:XXXAccess