BDS.Padodor.v2 - wer weiß was davon?

Rensen

Cool, die Seite kannte ich noch nicht. Ich frage mich nur warum msjarun.exe unterschiedliche Ergebnisse erzeugt. Was meinst du?

Die Ergebnisse:

C:\WINDOWS\Bbabc835.exe
Kaspersky Anti-Virus
Backdoor.Win32.Rbot.gen

C:\WINDOWS\System32\msservice.exe
Kaspersky Anti-Virus
Trojan.Win32.Agent.b

C:\WINDOWS\System32\msjarun.exe
BitDefender
Backdoor.SDBot.Gen
Dr.Web
Win32.HLLW.MyBot.based
Kaspersky Anti-Virus
Backdoor.Win32.Agobot.va
mks_vir
Trojan.Agobot.Va
NOD32
probably unknown NewHeur_PE (probable variant)
Norman Virus Control
Sandbox: W32/Backdoor; [ General information ]

* File might be compressed.
* **Locates window "NULL [class mIRC]" on desktop.
* File length: 116193 bytes.

[ Changes to filesystem ]
* Creates file C:\WINDOWS\SYSTEM\msjarun.exe.
* Deletes file 1.

[ Changes to registry ]
* Creates value "Microsoft JavaVM"="msjarun.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\Run".
* Creates value "Microsoft JavaVM"="msjarun.exe" in key "HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices".
* Creates value "Microsoft JavaVM"="msjarun.exe" in key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run".

[ Network services ]
* Looks for an Internet connection.
* Connects to "jump.afz.biz" on port 6667 (TCP).
* Connects to IRC server.
* IRC: Uses password l0cked.
* IRC: Uses nickname X, 5278530.
* IRC: Uses username ezkieyaca.
* IRC: Joins channel ##x-fun## with password locked.
* IRC: Sets the usermode for user X, 5278530 to +B.
* IRC: Sets the channel mode for channel ##x-fun## to +s.

[ Security issues ]
* Possible backdoor functionality [Authenticate] port 113.

[ Process/window information ]
* Creates a mutex [X01].
* Will automatically restart after boot (I'll be back...).