Trojan Zlob

BTW, none of yesterday's four or five new variants were detected by Nod32.

Here are the relevant bits from the VirusTotal reports I could retrieve (I seem to have misplaced the others...)
These are the three that were detected neither by Nod32 nor by Kaspersky

Complete scanning result of "8a005be6fd089cbff87343d39bbe1ab1", received in VirusTotal at 06.19.2006, 01:23:49 (CET).

Authentium 4.93.8 06.16.2006 Possibly a new variant of W32/AdwareDropper.MCodec-based
CAT-QuickHeal 8.00 06.17.2006 (Suspicious) - DNAScan
Fortinet 2.77.0.0 06.18.2006 suspicious
F-Prot 3.16f 06.17.2006 Possibly a new variant of W32/AdwareDropper.MCodec-based
Panda 9.0.0.4 06.18.2006 Suspicious file
TheHacker 5.9.8.162 06.18.2006 Trojan/Downloader.Zlob.tm

Complete scanning result of "1259658124752fc0907956e29434eec2", received in VirusTotal at 06.19.2006, 01:24:46 (CET).

Authentium 4.93.8 06.16.2006 Possibly a new variant of W32/AdwareDropper.MCodec-based
CAT-QuickHeal 8.00 06.17.2006 (Suspicious) - DNAScan
Fortinet 2.77.0.0 06.18.2006 suspicious
F-Prot 3.16f 06.17.2006 Possibly a new variant of W32/AdwareDropper.MCodec-based
Panda 9.0.0.4 06.18.2006 Suspicious file
TheHacker 5.9.8.162 06.18.2006 Trojan/Downloader.Zlob.sw
VirusBuster 4.3.7:9 06.18.2006 Trojan.DR.Zlob.Gen!Pac8

Complete scanning result of "e013aa95e0db15f5843d85e79200f15d", received in VirusTotal at 06.19.2006, 01:25:10 (CET).

CAT-QuickHeal 8.00 06.17.2006 (Suspicious) - DNAScan
Fortinet 2.77.0.0 06.18.2006 suspicious
Panda 9.0.0.4 06.18.2006 Suspicious file


Samples sent; available to other developers on request.

 

heh that is funny
What do you get if you try http://forums.aanet.com.au/viewtopic.php?t=10041 or just http://forums.aanet.com.au/ then Service Issues, Service Problems - VIC, 'Melbourne router is being attacked now' ?

Perhaps they have a ban on some international IP's? It's the member forum for an Australian ISP.

 

I also get:
You have been banned from this forum.
Please contact the webmaster or board administrator for more information.

Very likely. If you ban international IP's you only have to worry about Australian hacking attempts filling your log files

 

Gotto be that, as I get the same anywhere at that site...

 

I have no probs with that link!

Gerard

 

Oh well, I guess I'll have to resign myself to it...

 

Oh well, for the benefit of international visitors, I'll copy some over here.
The background is that aanet an Australian ISP was the beneficiary of a major DOS attack - took down their network across an entire state via traffic targeted at a specific IP address. Probably zlob related - the result outcome was as follows - One IP is completely toast - permanantly blocked upstream by their wholesale provider never to be re-allocated.
Some of this may be of interest to malware researchers, or they may already be fully aware of it. Those in the industry can PM me if they would like to know the www's that were being viewed - they're not in the list at post #136 of this thread.

 

Were you running test zlobs? Could your IP be one of these?

And besides Tony, you are from 'The Netherlands' - gerardwil is from 'Netherlands'

 

wow...such a big discussion since I was away.
But anyway there are still at least 4 variants not detected now...

 

I don`t have any problem with either links.

 

Nope, it isn't...

Ah, that must be it! http://www.spywareinfoforum.com/html/emoticons/weee.gif

 

F-Prot seems to have a really nice heuristic on that !
I was expecting this from eset !

 

I think we should cease posting any futher screenshots, or the thread will need to be eventually closed. It's a matter of fact that these Zlobs are a neverending story that will go on.

 

i wish these zlob virus would stop its getting stupid now

these people should get out more or get a girlfriend something to take there mind of causing mayhem on the internet

 

Hi Marcos
The screenshots are a little interesting because they show that no single AV seems better than others at detecting these variants,seems to depend who has updated bases and who hasn't at time test was run,must be said that some AV's seem to miss more than their fair share though

 

Actually, I've discovered that most vendors *are* adding signatures, but it takes time to do so. Since this is the NOD32 forum I won't quote any names, but all the big vendors seem to have the samples and are adding signatures for these Zlobs, though not as quickly as one would expect.

Eset is the only one to offer quick protection against all these Zlobs. Again, a job well done.

 

Some of those hosting DNS records for zlob would surely remove them if somebody from an AV company was to notify them with evidence about what the sites are used for....
For example, several of the DNS records are hosted by http://www.everydns.net/
from the everydns TOS...

 

Well , I wanted to tell , that the malware (no matter if it is Zlob or something else) cannot be totally stopped because the bad guys are not sleeping

We are not sleeping,too

 

A number of posts removed.

For those not wishing to follow along as this important discussion plays out....Please feel free to participate in the numerous other ongoing support threads....or not. We rarely close threads @ Wilders....especially for reasons of non interest by a few members. Simply move on and let this Nod32 Support discussion continue Please.

Thanks,
Bubba

 

yesterday I scanned my second HD with Kaspersky AV 6 and it found 2 ZLOB "things" in the NOD cache files and NOD quarantine files..... does this mean that NOD found these already or were this trojans still active? I was so scared that I immediately had them eliminated so I can't exactly remember the names of the different infected files... sorry but I am not an experienced user.

 

if they were in the quarantine then NOD has previously catched them so you were protected.

 

Files in quarantine are encrypted and thus benign. KAV can decrypt and scan them.

 

thx for the advice !

 

Decrypt those files? How is that possible?

Sorry for the off-topic question, but can NOD32 also decrypt such files?

 

It's not difficult, but there's no sense in it.