information on trshicon.exe.
i dont now if everything is relevant, i copied what i found....
Service load: 0% 100%
File: trashicon.exe
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: 7c5f5260f51db2d2a17ce93d6165ade8
Packers detected: -
Bit9 reports: File not found
Scanner results
Scan taken on 06 Mar 2008 20:19:08 (GMT)
A-Squared Found Trojan-PSW.Win32.LdPinch.fxi
AntiVir Found TR/Crypt.XPACK.Gen
ArcaVir Found Heur.W32
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found Troj.Dropper.W32.Agent.bno
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan:W32/Renos.BA, Trojan-Dropper.Win32.Agent.bno
Fortinet Found nothing
Ikarus Found Trojan.Crypt.XPACK
Kaspersky Anti-Virus Found Trojan-Dropper.Win32.Agent.bno
NOD32 Found nothing
Norman Virus Control Found W32/Smalltroj.CWBU
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found Mal/Generic-A
VirusBuster Found nothing
VBA32 Found Trojan-Dropper.Win32.Agent.bno
______________________________________________________________________________________________________
kaspersky:
Scanned file: trashicon.exe - Infected
trashicon.exe - infected by
Trojan-Dropper.Win32.Agent.bno
Statistics:
Known viruses: 605235 Updated: 06-03-2008
File size (Kb): 67 Virus bodies: 1
Files: 1 Warnings: 0
Archives: 0 Suspicious: 0
Trojan-Dropper.Win32.Agent.bno
Detection added Aug 02 2007 16:16 GMT
Update released Aug 03 2007 18:55 GMT
Behavior TrojanDropper
Currently there is no description available for this program.
As many viruses and worms are modifications of earlier versions, it may help you to check the descriptions of similar programs. If such descriptions are available, they will be listed at the top of the page.
Our virus analysts work hard to ensure that descriptions of the commonest and most potentially dangerous software are available to users. The Virus Encyclopedia is updated on a regular basis.
If you cannot find the description you need, please check back later, or contact us on
webmaster@viruslist.com.
Home / Viruses / Virus Encyclopedia / Malware Descriptions / Trojan Programs
Trojan Programs
Trojans can be classified according to the actions which they carry out on victim machines.
Backdoors
General Trojans
PSW Trojans
Trojan Clickers
Trojan Downloaders
Trojan Droppers
Trojan Proxies
Trojan Spies
Trojan Notifiers
ArcBombs
Rootkits
Backdoors
Today backdoors are the most dangerous type of Trojans and the most widespread. These Trojans are remote administration utilities that open infected machines to external control via a LAN or the Internet. They function in the same way as legal remote administration programs used by system administrators. This makes them difficult to detect.
The only difference between a legal administration tool and a backdoor is that backdoors are installed and launched without the knowledge or consent of the user of the victim machine. Once the backdoor is launched, it monitors the local system without the user's knowledge; often the backdoor will not be visible in the log of active programs.
Once a remote administration utilitiy has been successfully installed and launched, the victim machine is wide open. Backdoor functions can include:
Sending/ receiving files
Launching/ deleting files
Executing files
Displaying notification
Deleting data
Rebooting the machine
In other words, backdoors are used by virus writers to detect and download confidential information, execute malicious code, destroy data, include the machine in bot networks and so forth. In short, backdoors combine the functionality of most other types of Trojans in one package.
Backdoors have one especially dangerous sub-class: variants that can propagate like worms. The only difference is that worms are programmed to propagate constantly, whereas these 'mobile' backdoors spread only after a specific command from the 'master'.
General Trojans
This loose category includes a variety of Trojans that damage victim machines or threaten data integrity, or impair the functioning of the victim machine.
Multi-purpose Trojans are also included in this group, as some virus writers create multi-functional Trojans rather than Trojan packs.
PSW Trojans
This family of Trojans steals passwords, normally system passwords from victim machines. They search for system files which contain confidential information such as passwords and Internet access telephone numbers and then send this information to an email address coded into the body of the Trojan. It will then be retrieved by the 'master' or user of the illegal program.
Some PSW Trojans steal other types of information such as:
System details (memory, disk space, operating system details)
Local email client
IP-address
Registration details
Passwords for on-line games
Trojan-AOL are PSW Trojans that steal passwords for aol (American Online) They are contained in a sub-groups because they are so numerous.
Trojan Clickers
This family of Trojans redirects victim machines to specified websites or other Internet resources. Clickers either send the necessary commands to the browser or replace system files where standard Internet urls are stored (e.g. the 'hosts' file in MS Windows).
Clickers are used:
To raise the hit-count of a specific site for advertising purposes
To organize a DoS attack on a specified server or site
To lead the victim to an infected resource where the machine will be attacked by other malware (viruses or Trojans)
Trojan Downloaders
This family of Trojans downloads and installs new malware or adware on the victim machine. The downloader then either launches the new malware or registers it to enable autorun according to the local operating system requirements. All of this is done without the knowledge or consent of the user.
The names and locations of malware to be downloaded are either coded into the Trojan or downloaded from a specified website or other Internet location.
Trojan Droppers
These Trojans are used to install other malware on victim machines without the knowledge of the user. Droppers install their payload either without displaying any notification, or displaying a false message about an error in an archived file or in the operating system. The new malware is dropped to a specified location on a local disk and then launched.
Droppers are normally structured in the following way:
Main file
contains the dropper payload
File 1
first payload
File 2
second payload
...
as many files as the coder chooses to include
The dropper functionality contains code to install and execute all of the payload files.
In most cases, the payload contains other Trojans and at least one hoax: jokes, games, graphics and so forth. The hoax is meant to distract the user or to prove that the activity caused by the dropper is harmless, whereas it actually serves to mask the installation of the dangerous payload.
Hackers using such programs achieve two objectives:
Hidden or masked installation of other Trojans or viruses
Tricking antivirus solutions which are unable to analyse all components
_______________________________________________________________________________________________________
File trashicon.exe received on 03.06.2008 21:15:25 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 12/32 (37.5%)
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 42 and 60 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:
Antivirus Version Last Update Result
AhnLab-V3 2008.3.4.0 2008.03.06 -
AntiVir 7.6.0.73 2008.03.06 TR/Crypt.XPACK.Gen
Authentium 4.93.8 2008.03.06 -
Avast 4.7.1098.0 2008.03.06 -
AVG 7.5.0.516 2008.03.06 -
BitDefender 7.2 2008.03.06 -
CAT-QuickHeal 9.50 2008.03.06 TrojanDropper.Agent.bno
ClamAV 0.92.1 2008.03.06 -
DrWeb 4.44.0.09170 2008.03.06 -
eSafe 7.0.15.0 2008.03.06 Suspicious File
eTrust-Vet 31.3.5591 2008.03.06 -
Ewido 4.0 2008.03.06 -
FileAdvisor 1 2008.03.06 -
Fortinet 3.14.0.0 2008.03.06 -
F-Prot 4.4.2.54 2008.03.05 -
F-Secure 6.70.13260.0 2008.03.06 W32/Smalltroj.CWBU
Ikarus T3.1.1.20 2008.03.06 Trojan.Crypt.XPACK
Kaspersky 7.0.0.125 2008.03.06 Trojan-Dropper.Win32.Agent.bno
McAfee 5245 2008.03.05 -
Microsoft 1.3301 2008.03.06 -
NOD32v2 2927 2008.03.06 -
Norman 5.80.02 2008.03.06 W32/Smalltroj.CWBU
Panda 9.0.0.4 2008.03.06 Suspicious file
Prevx1 V2 2008.03.06 Trojan.Dropper
Rising 20.34.32.00 2008.03.06 -
Sophos 4.27.0 2008.03.06 Mal/Generic-A
Sunbelt 3.0.930.0 2008.03.05 -
Symantec 10 2008.03.06 -
TheHacker 6.2.92.233 2008.03.04 -
VBA32 3.12.6.2 2008.03.05 Trojan-Dropper.Win32.Agent.bno
VirusBuster 4.3.26:9 2008.03.06 -
Webwasher-Gateway 6.6.2 2008.03.06 Trojan.Crypt.XPACK.Gen
Additional information
File size: 68096 bytes
MD5: 7c5f5260f51db2d2a17ce93d6165ade8
SHA1: c1b576baf656cf57c86d9740ae1806548d244874
PEiD: -
Prevx info:
http://info.prevx.com/aboutprogramtext.asp?PX5=FD7D30E00044BE3A0A3B013B3C2E070059D0DF23
the rest of the things you asked will be posted soon.....
: