Images Album.exe

Viruses and worms
1

Hey,

Every once in a while I scan my host computer to check up on things and it found 3 things. 2 of which were from an early test of the Zeus Trojan network I found. (I forgot I had launched the file, oops). But Avast! also detected another file in my downloads folder. Images Album.exe. Detected as a Trojan backDoor.IRC. Is anything noticeable in a OTL scan?

I renamed the file

VT Results: https://www.virustotal.com/en/file/aa2584d268bc715aa9a0bddb8c0a58bcdef5e61c78bd585f5b011adeb6af4a78/analysis/1385151022/

I’ll attach OTL here in a sec

2

Can you upload the file to Malwr.com and post the link here?

You can look through Malwr and OTL then to compare it.

3

Also, Windows is apparently not genuine anymore. I got this shortly after cleaning up the mess left by this thread:

http://forum.avast.com/index.php?topic=140336.0

4

Malwr: https://malwr.com/submission/status/M2I4ODIzYWVhNjBkNGE0MDllZmI0YjYzMzNmMjI4MDI/

OTL has been attached. (I don’t understand OTL nor do I have the training to)

5

What software are you using for the VM?

You can create snapshots and roll back everything.

Malwr is still running.

6

http://en.wikipedia.org/wiki/Backdoor.Win32.IRCBot

Once installed on a PC the worm copies itself into a Windows system folder, creates a new file displayed as "Windows Genuine Advantage Validation Notification" and becomes part of the computer's automatic startup.
7

Rolling back I don’t think would work

Also, Software, Just Avast!, OTL and MBAM. Nothing else…

8

Pondus, the IRC Wor wasn’t active at the time. Just sitting there as a .vir file…

And If that can still happen without being executed then why has my Host computer which is where I found the file not been changed?

9

Do you want to check your system, I think you’re really infected…by looking at OTL

10

Twin, it’s a Virtual Machine. my real system never had the file launched

11

Is OTL.txt you attached performed on host or VM?

12

VM