Trojan Zlob

Discussion in 'NOD32 version 2 Forum' started by ugly, May 27, 2006.

Thread Status:
Not open for further replies.
Page 3 of 15
  1. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,361
    Location:
    The Netherlands
    Don't forget hxxp://www.digikeygen.com/ ; the files hail from there as well
     
    TonyKlein, Jun 4, 2006
    #51
  2. TNT

    TNT Registered Member

    Joined:
    Sep 4, 2005
    Posts:
    948
    I saw that site and I didn't find any file downloads on there. Are they linked anywhere apart from the homepage, or is this from traffic analysis on an infected machine?
     
    TNT, Jun 4, 2006
    #52
  3. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    we're waiting for that thing you need to adjust. :D
     
    pykko, Jun 4, 2006
    #53
  4. Benvan45

    Benvan45 Registered Member

    Joined:
    Jul 27, 2004
    Posts:
    556
    I got no detection at all, neither on-demand. Statistical information has been sent a few times, but I don't know what's in that. It should be logged, but what exactly is that information? I was looking for information regarding Zlob.

    Time Module Event User
    4-6-2006 12:56:16 Kernel Statistical information has been sent to Eset.
    4-6-2006 11:55:25 Kernel Statistical information has been sent to Eset.
    4-6-2006 11:55:13 Kernel Statistical information has been sent to Eset.
    3-6-2006 23:00:17 Kernel Statistical information has been sent to Eset.

    log.jpg

    Where can I find the log with the sent data?
     
    Benvan45, Jun 4, 2006
    #54
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    See the ThreatSense help file, there's an example of the information submitted.

    As for TD Zlob detection, most likely you have the HTTP scanner disabled, or it would block them automatically.
     
    Marcos, Jun 4, 2006
    #55
  6. Benvan45

    Benvan45 Registered Member

    Joined:
    Jul 27, 2004
    Posts:
    556
    No, I have not disabled the HTTP scanner!
     
    Benvan45, Jun 4, 2006
    #56
  7. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,456
    So you are saying that you downloaded the trojan from hxxp://media-xxxxxxx.com without IMON blockin it? Didn't you change the deafult IMON settings by disabling some options?
     
    Marcos, Jun 4, 2006
    #57
  8. andyrock

    andyrock Registered Member

    Joined:
    Mar 27, 2006
    Posts:
    22

    Hi!

    This one is working with imon activated: www. mediacodec .net
     
    andyrock, Jun 4, 2006
    #58
  9. Benvan45

    Benvan45 Registered Member

    Joined:
    Jul 27, 2004
    Posts:
    556
    I got this bugger through a website, didn't download it from hxxp://media-xxxxxxx.com, so I can't tell why and how!
    I have not changed/diasabled anything at all within Imon. I wish I still had a report about this trojan when I cleaned it with Spybot. I used Ewido Micro and was detected properly, but pc blocked when trying to delete. I sure will save a log or report the next time, so everybody can see what it is.
    The only thing I noticed from Nod, was the fact that Statistical information was sent, and I would love to know what the information was, as it was sent at the moment I got hit by that Trojan. You refer to a helpfile with an example of the information being sent, but what good is that gonna do? I would like to see what is sent exactly, as it should be logged......or I must be going crazy now. So, where can I find that log?

    Time Module Event User
    4-6-2006 12:56:16 Kernel Statistical information has been sent to Eset.
    4-6-2006 11:55:25 Kernel Statistical information has been sent to Eset.
    4-6-2006 11:55:13 Kernel Statistical information has been sent to Eset.
     
    Benvan45, Jun 4, 2006
    #59
  10. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,361
    Location:
    The Netherlands
    It's where all the "digikeygen_ver*.***.exe" files you 've seen the VT reports of hail from.

    Just like most of the mediacodec files, they're infecting folks at certain p0rn sites, where people are prompted to "click this in order to obtain a password for free and easy access"
     
    TonyKlein, Jun 4, 2006
    #60
  11. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,361
    Location:
    The Netherlands
    Here's part of the FireFox Page Info on one of these sites. As you can see you click almost ANYthing on that web page, and you're toast... LOL
     

    Attached Files:

    TonyKlein, Jun 4, 2006
    #61
  12. Benvan45

    Benvan45 Registered Member

    Joined:
    Jul 27, 2004
    Posts:
    556
    I got hit through an online Poker Site.......too bad I don't remember which one. With the big names (Online Poker) never had any trouble.
     
    Benvan45, Jun 4, 2006
    #62
  13. TNT

    TNT Registered Member

    Joined:
    Sep 4, 2005
    Posts:
    948
    Thanks. Added to my block list.
     
    TNT, Jun 4, 2006
    #63
  14. andyrock

    andyrock Registered Member

    Joined:
    Mar 27, 2006
    Posts:
    22
    Trojans detected now :)
     
    andyrock, Jun 4, 2006
    #64
  15. Benvan45

    Benvan45 Registered Member

    Joined:
    Jul 27, 2004
    Posts:
    556
    detected by what?
     
    Benvan45, Jun 4, 2006
    #65
  16. TNT

    TNT Registered Member

    Joined:
    Sep 4, 2005
    Posts:
    948
    Found a new one:
    hxxp://www.nvidcodec.com/getcodec/SVideoCodec4_01a.exe

    New site as well (for me), so here's the updated list:

    codeccash.com
    digikeygen.com
    emcodec.com
    emediacodec.com
    getcodecs.com #expired
    media-codec.com
    mediacodec.net
    nvidcodec.com
    v-codec.com
    vcodec-download.com
    vcodec-get.com
    vcodec.com #expired
    vcodecdownload.com
    vcodecget.com
    vcodecget.net
    vcodecobtain.com
    vcodecpull.com
    vcodecreceive.com
    vicodec.com
    vidcodec.com
    videocodecupdate.com
    vidscodec.com
    zcodec.com

    NB: not all these are distributing trojans at the moment. But they have.
     
    TNT, Jun 4, 2006
    #66
  17. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,361
    Location:
    The Netherlands
    Ah, good catch! :)

    Complete scanning result of "SVideoCodec4_01a.exe", received in VirusTotal at 06.04.2006, 17:33:45 (CET).

    Antivirus Version Update Result
    AntiVir 6.34.1.37 06.04.2006 no virus found
    Authentium 4.93.8 06.02.2006 no virus found
    Avast 4.7.844.0 06.02.2006 no virus found
    AVG 386 06.02.2006 no virus found
    BitDefender 7.2 06.04.2006 no virus found
    CAT-QuickHeal 8.00 06.03.2006 no virus found
    ClamAV devel-20060426 06.04.2006 no virus found
    DrWeb 4.33 06.04.2006 no virus found
    eTrust-InoculateIT 23.72.28 06.04.2006 no virus found
    eTrust-Vet 12.6.2240 06.02.2006 no virus found
    Ewido 3.5 06.04.2006 no virus found
    Fortinet 2.77.0.0 06.03.2006 W32/Zlob.PC!tr
    F-Prot 3.16f 06.02.2006 no virus found
    Ikarus 0.2.65.0 06.02.2006 Trojan.Favadd
    Kaspersky 4.0.2.24 06.04.2006 no virus found
    McAfee 4776 06.02.2006 no virus found
    Microsoft 1.1441 06.04.2006 no virus found
    NOD32v2 1.1578 06.04.2006 Win32/TrojanDownloader.Zlob.PJ
    Norman 5.90.17 06.02.2006 no virus found
    Panda 9.0.0.4 06.04.2006 no virus found
    Sophos 4.05.0 06.03.2006 no virus found
    Symantec 8.0 06.04.2006 no virus found
    TheHacker 5.9.8.154 06.01.2006 Trojan/Downloader.Zlob.pz
    UNA 1.83 06.02.2006 no virus found
    VBA32 3.11.0 06.04.2006 no virus found

    Aditional Information
    File size: 71953 bytes
    MD5: 2f49353169fe4b7d11ad3d0919bfa478
    SHA1: e83472de67cf7fb3ed0cb3fb73b4573628f0baec
     
    TonyKlein, Jun 4, 2006
    #67
  18. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,174
    Location:
    Denmark
    Well that's a first, for me anyways :p
     

    Attached Files:

    Brian N, Jun 4, 2006
    #68
  19. TNT

    TNT Registered Member

    Joined:
    Sep 4, 2005
    Posts:
    948
    hxxp://www.digipassword.com/get/digipass_ver1.[number].exe

    [number] = number from 104 to 660.

    codeccash.com
    digikeygen.com
    digipassword.com
    emcodec.com
    emediacodec.com
    getcodecs.com #expired
    media-codec.com
    mediacodec.net
    nvidcodec.com
    v-codec.com
    vcodec-download.com
    vcodec-get.com
    vcodec.com #expired
    vcodecdownload.com
    vcodecget.com
    vcodecget.net
    vcodecobtain.com
    vcodecpull.com
    vcodecreceive.com
    vicodec.com
    vidcodec.com
    videocodecupdate.com
    vidscodec.com
    zcodec.com
     
    TNT, Jun 4, 2006
    #69
  20. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    yes...now all threats are detected. :thumb:
    Tony, please don't post links to infected websites. :D :D
     
    pykko, Jun 4, 2006
    #70
  21. Benvan45

    Benvan45 Registered Member

    Joined:
    Jul 27, 2004
    Posts:
    556
    Great result for Nod32, but terrible for the rest, man......what is everybody gonna do??
     
    Benvan45, Jun 4, 2006
    #71
  22. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    they'll live...that's all. :D Nice indeed for NOD32 ;)
     
    pykko, Jun 4, 2006
    #72
  23. Benvan45

    Benvan45 Registered Member

    Joined:
    Jul 27, 2004
    Posts:
    556
    The log is shown in the event log, but it does not show what information has been sent and I like to know why this is. Especially in my case, when information was sent during the infection of this trojan, why can't they just log all information?

    I just don't like not getting a proper answer about this logging, what good is a help file with an example gonna do? It amazes me more and more.....and I'm really beginning to think different about this whole 'Big' Nod32.
     
    Benvan45, Jun 4, 2006
    #73
  24. TNT

    TNT Registered Member

    Joined:
    Sep 4, 2005
    Posts:
    948
    The detection of these Zlob trojans is GODAWFUL for most AVs. KAV, NOD32 and (somewhat suprisingly) ClamAV seem the only one to care at all.

    Frankly, some of those AV vendors should be ashamed of themselves.
     
    TNT, Jun 4, 2006
    #74
  25. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,361
    Location:
    The Netherlands
    Ikarus and Fortinet are doing pretty well too.

    You can only be disappointed in McAfee, Norton, and a couple of other big names.

    And in Microsoft as well (bless their little hearts... LOL!)
     
    TonyKlein, Jun 4, 2006
    #75
Page 3 of 15
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...