[résolu]infos sur BDS/Tagent.E

[angelique]

'soir

 

Antivir detecte BDS/Tagent.E [PCK/MEW] dans un log dont je ne peux dire le nom,je ne trouve aucune infos sur ce niark ou eventuel false positive à l'habitude de antivir...

 

1/quel est le site joty??? pour analyser juste un fichier??

2/qlq1 a t il des infos sur ça??

 

merci!

[lineve26]

Bonsoir,

 

Est-ce cela que tu veux?

 

Ma page Web

 

Bonne soirée!

[angelique]

tout à fait

 

je venais juste de le retrouver merci^^

 

http://virusscan.jotti.org/

[lineve26]

De rien, angélique !

[angelique]

bon j'ai besoin d'aide de conseillers sécu

 

je fais quoi,je le garde ce fichier ou pas!! il est sur clé usb pour le moment..

 

File: ...................exe

Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)

MD5 02dcc9e3b956349cc1e3fc84b62bcd86

Packers detected: PE_PATCH, MEWBUNDLE, MEW

Scanner results

AntiVir Found Packer/MEW packer

ArcaVir Found nothing

Avast Found nothing

AVG Antivirus Found Generic.QHV

BitDefender Found nothing

ClamAV Found nothing

Dr.Web Found nothing

F-Prot Antivirus Found nothing

Fortinet Found BackDoor.Q!tr

Kaspersky Anti-Virus Found nothing

NOD32 Found nothing

Norman Virus Control Found W32/Suspicious_M.gen

UNA Found nothing

VirusBuster Found nothing

VBA32 Found nothing

 

vous en pensez quoi 4 detections sur 15 av...

 

sachant que un paker est un decompresseur,ici mew

y'a 15 .exe ds ce fichier...

 

File: .............exe

Status: MIGHT BE INFECTED/MALWARE (Sandbox emulation took a long time and/or runtime packers were found, this is suspicious. Normally programs aren't packed and don't force the sandbox into lengthy emulation. Do realize no scanner issued any warning, the file can very well be harmless. Caution is advised, however.) (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)

MD5 e7a169e1e6af9d5fb9277b169b8dd4ce

Packers detected: UPX

Scanner results

AntiVir Found nothing

ArcaVir Found nothing

Avast Found nothing

AVG Antivirus Found nothing

BitDefender Found nothing

ClamAV Found nothing

Dr.Web Found nothing

F-Prot Antivirus Found nothing

Fortinet Found nothing

Kaspersky Anti-Virus Found nothing

NOD32 Found nothing

Norman Virus Control Found nothing

UNA Found nothing

VirusBuster Found nothing

VBA32 Found nothing

 

 

 

merci

[angelique]

packeter avec MEW11

 

J'ai unpacked avec unmew l'exe qui donne plein de resultats positifs:

 

celui là:

 

File: ...................exe

Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)

MD5 02dcc9e3b956349cc1e3fc84b62bcd86

Packers detected: PE_PATCH, MEWBUNDLE, MEW

Scanner results

AntiVir Found Packer/MEW packer

ArcaVir Found nothing

Avast Found nothing

AVG Antivirus Found Generic.QHV

BitDefender Found nothing

ClamAV Found nothing

Dr.Web Found nothing

F-Prot Antivirus Found nothing

Fortinet Found BackDoor.Q!tr

Kaspersky Anti-Virus Found nothing

NOD32 Found nothing

Norman Virus Control Found W32/Suspicious_M.gen

UNA Found nothing

VirusBuster Found nothing

VBA32 Found nothing

 

 

et j'ai scanné l'unpacked avec avast v4.7 pro edition ,et rien...aucune alerte!!

 

La je vais scanner l'unpacked chez http://virusscan.jotti.org/

 

vais voir le resultats...............

[angelique]

bon l'unpacked a été scanné chez http://virusscan.jotti.org/

 

il en ressort:

 

File: unmewtruc

Status: INFECTED/MALWARE

MD5 e46e00d0276680145d8a80ca7a33a269

Packers detected: -

Scanner results

AntiVir Found nothing

ArcaVir Found nothing

Avast Found nothing

AVG Antivirus Found Generic.QHV

BitDefender Found nothing

ClamAV Found nothing

Dr.Web Found nothing

F-Prot Antivirus Found nothing

Fortinet Found nothing

Kaspersky Anti-Virus Found nothing

NOD32 Found nothing

Norman Virus Control Found nothing

UNA Found nothing

VirusBuster Found nothing

VBA32 Found nothing

 

des infos sur Generic.QHV ???

 

merci

[angelique]

bon

 

le .dat qui se trouve en C:\Documents and Settings\All Users\Documents\angelique logs\AIOKg\....\pou64\1\g\x\packs\AutoPlay est locker par mdp ce qui est plus que suspecte,et des requetes tcp/ip s'incruste donc backdoor à 95%.

 

 

fin de l'histoire...