Author Topic: something new that i can't find anywhere  (Read 7947 times)

0 Members and 1 Guest are viewing this topic.

languy

  • Guest
Re: something new that i can't find anywhere
« Reply #15 on: March 24, 2006, 03:14:42 AM »
yeah it sucks to be one of the first, and i think from what i have red is that it can get its way in through pic files i'm not sure how but that what i heard who knows how it got it , maybe just another windows hole. anyway of course i would tell you guys i have been using avast for about two years now for free and you guys have saved me a bunch of money now its time for me to help a little, the malware is called downloader.small.ciw thats why ewido calls it but you can see from the list i put up a while ago different programs call it different things.

languy

  • Guest
Re: something new that i can't find anywhere
« Reply #16 on: March 24, 2006, 05:33:26 AM »
more info i found, i guess the exe never got executed on my computer because i found out what it does, i found this info on other websites.

Further analysis on the Prevx Research site shows that VOBLAIZDUPLA.EXE creates TaskDir.exe which in turn creates ZLBW.DLL and TaskDir.DLL

VOBLAIZDUPLA.EXE is a trojan downloader that download a file, called parad.raw.exe from a still up webserver.

From the webserver it download a clean dll, called zlbw.dll, and some garbage files.

then a copy of parad.raw.exe is done and called taskdir.exe.

Taskdir.exe is a new variant of trojan Lager. It contains a dll embeeded, called taskdir.dll.

taskdir.dll is then "injected" in every system process. This dll has "rootkit" features, because it hide every file or directory called "taskdir" from user's eyes. (this is to hide taskdir.exe execution).