Complete scanning result of "produtos.scr", received in VirusTotal at 06.13.2006, 14:13:53 (CET). Antivirus Version Update Result AntiVir 6.35.0.10 06.13.2006 no virus found Authentium 4.93.8 06.12.2006 no virus found Avast 4.7.844.0 06.11.2006 no virus found AVG 386 06.12.2006 no virus found BitDefender 7.2 06.13.2006 no virus found CAT-QuickHeal 8.00 06.12.2006 (Suspicious) - DNAScan ClamAV devel-20060426 06.13.2006 no virus found DrWeb 4.33 06.13.2006 no virus found eTrust-InoculateIT 23.72.35 06.13.2006 no virus found eTrust-Vet 12.6.2253 06.13.2006 no virus found Ewido 3.5 06.13.2006 Downloader.Dadobra.lw Fortinet 2.77.0.0 06.13.2006 no virus found F-Prot 3.16f 06.12.2006 no virus found Ikarus 0.2.65.0 06.13.2006 no virus found Kaspersky 4.0.2.24 06.13.2006 no virus found McAfee 4782 06.12.2006 no virus found Microsoft 1.1441 06.13.2006 no virus found NOD32v2 1.1596 06.13.2006 probably a variant of Win32/TrojanDownloader.Delf.QP Norman 5.90.21 06.13.2006 W32/Downloader Panda 9.0.0.4 06.13.2006 Suspicious file Sophos 4.06.0 06.13.2006 no virus found Symantec 8.0 06.13.2006 no virus found TheHacker 5.9.8.158 06.12.2006 no virus found UNA 1.83 06.09.2006 no virus found VBA32 3.11.0 06.12.2006 no virus found Aditional Information File size: 48384 bytes MD5: 882d61cdfbe55115add84a2707f8d84a SHA1: 5cb2f44a07b8e335f66162b828b4d2f4ce10f7b8 Norman SandBox: [ General information ] * **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: ANALYSIS@NORMAN.NO - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**. * File might be compressed. * Decompressing Petite. * Creating several executable files on hard-drive. * File length: 48384 bytes. [ Changes to filesystem ] * Creates file C:windowssystem32Internet.exe. * Creates file C:windowssystem otepad.exe. [ Changes to registry ] * Creates value "Windows Host Process Cleaner"="c:windowssystem otepad.exe" in key "HKCUSoftwareMicrosoftWindowsCurrentVersionRun". [ Network services ] * Downloads file from http://trabalharonliner.com.sapo.pt/dados/dados1.dat as c:windowssystem32Internet.exe. * Downloads file from http://trabalhaonliner2.com.sapo.pt/dados/dados1.dat as c:windowssystem32Internet.exe. * Downloads file from http://trabalhaonliner3.com.sapo.pt/dados/dados1.dat as c:windowssystem32Internet.exe. * Downloads file from http://trabalhaonliner4.com.sapo.pt/dados/dados1.dat as c:windowssystem32Internet.exe. * Downloads file from http://trabalhaonliner5.com.sapo.pt/dados/dados1.dat as c:windowssystem32Internet.exe. * Downloads file from http://trabalharonliner.com.sapo.pt/dados/svdados.dat as c:windowssystem otepad.exe. * Downloads file from http://trabalhaonliner2.com.sapo.pt/dados/svdados.dat as c:windowssystem otepad.exe. * Downloads file from http://trabalhaonliner3.com.sapo.pt/dados/svdados.dat as c:windowssystem otepad.exe. * Downloads file from http://trabalhaonliner4.com.sapo.pt/dados/svdados.dat as c:windowssystem otepad.exe. * Downloads file from http://trabalhaonliner5.com.sapo.pt/dados/svdados.dat as c:windowssystem otepad.exe. [ Security issues ] * Starting downloaded file - potential security problem. [ Process/window information ] * Creates an event called . * Will automatically restart after boot (I'll be back...). VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.