Исследование антивирусов 4

[Alex_Goodwin]

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 09.19.2006, 13:23:17 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.19.2006 BDC/Coldfus.11B.Dll
Authentium 4.93.8 09.18.2006 no virus found
Avast 4.7.844.0 09.15.2006 no virus found
AVG 386 09.18.2006 no virus found
BitDefender 7.2 09.19.2006 no virus found
CAT-QuickHeal 8.00 09.18.2006 no virus found
ClamAV devel-20060426 09.19.2006 Trojan.Dropper.Joiner.21
DrWeb 4.33 09.19.2006 no virus found
eTrust-InoculateIT 23.72.128 09.19.2006 no virus found
eTrust-Vet 30.3.3086 09.19.2006 no virus found
Ewido 4.0 09.19.2006 Trojan.LdPinch.axh
Fortinet 2.82.0.0 09.19.2006 W32/SpyBot.P!worm
F-Prot 3.16f 09.18.2006 no virus found
F-Prot4 4.2.1.29 09.18.2006 no virus found
Ikarus 0.2.65.0 09.18.2006 Trojan-Dropper.Win32.Tefil.21.A
Kaspersky 4.0.2.24 09.19.2006 Trojan-PSW.Win32.LdPinch.axh
McAfee 4854 09.18.2006 W32/Spybot.worm.gen.p
Microsoft 1.1560 09.19.2006 no virus found
NOD32v2 1.1762 09.19.2006 no virus found
Norman 5.90.23 09.19.2006 no virus found
Panda 9.0.0.4 09.18.2006 Suspicious file
Sophos 4.09.0 09.19.2006 no virus found
Symantec 8.0 09.19.2006 no virus found
TheHacker 6.0.1.072 09.19.2006 Trojan/Hami
UNA 1.83 09.18.2006 no virus found
VBA32 3.11.1 09.19.2006 Trojan-PSW.Win32.LdPinch.axh
VirusBuster 4.3.7:9 09.18.2006 no virus found


Aditional Information
File size: 1744896 bytes
MD5: 92c9f40b4da907589123bcb6cc600fa1
SHA1: 43408d1b230de21c8be607b7c8cd6dd4456ce8b5
packers: Armadillo
Реально это пинч, склееный с с чем-то. Так что правы и те кто джойнер палят, хотя пинч это достовернее.

[Alex_Goodwin]

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 09.19.2006, 13:34:24 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.19.2006 no virus found
Authentium 4.93.8 09.18.2006 no virus found
Avast 4.7.844.0 09.15.2006 no virus found
AVG 386 09.18.2006 no virus found
BitDefender 7.2 09.19.2006 no virus found
CAT-QuickHeal 8.00 09.18.2006 no virus found
ClamAV devel-20060426 09.19.2006 no virus found
eTrust-InoculateIT 23.72.128 09.19.2006 no virus found
eTrust-Vet 30.3.3086 09.19.2006 no virus found
DrWeb 4.33 09.19.2006 no virus found
Ewido 4.0 09.19.2006 Dropper.Delf.zp
Fortinet 2.82.0.0 09.19.2006 no virus found
F-Prot 3.16f 09.18.2006 no virus found
F-Prot4 4.2.1.29 09.18.2006 no virus found
Ikarus 0.2.65.0 09.18.2006 no virus found
Kaspersky 4.0.2.24 09.19.2006 no virus found
McAfee 4854 09.18.2006 no virus found
Microsoft 1.1560 09.19.2006 no virus found
NOD32v2 1.1762 09.19.2006 no virus found
Norman 5.80.02 09.19.2006 no virus found
Panda 9.0.0.4 09.18.2006 no virus found
Sophos 4.09.0 09.19.2006 no virus found
Symantec 8.0 09.19.2006 no virus found
TheHacker 6.0.1.072 09.19.2006 no virus found
UNA 1.83 09.18.2006 no virus found
VBA32 3.11.1 09.19.2006 suspected of Trojan-Dropper.Delf.71 (paranoid heuristics)
VirusBuster 4.3.7:9 09.18.2006 no virus found


Aditional Information
File size: 748544 bytes
MD5: 8c223cf3c7a9c2d6e03f00d4bb122ef3
SHA1: 9709c247c8021a2ad513fb107b648bde4dda5b4e

Троян-дроппер

[Alex_Goodwin]

zip архив

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 09.19.2006, 13:45:28 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.19.2006 HEUR/Crypted
Authentium 4.93.8 09.18.2006 no virus found
Avast 4.7.844.0 09.15.2006 no virus found
AVG 386 09.18.2006 no virus found
BitDefender 7.2 09.19.2006 no virus found
CAT-QuickHeal 8.00 09.18.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 09.19.2006 no virus found
DrWeb 4.33 09.19.2006 no virus found
eTrust-InoculateIT 23.72.128 09.19.2006 no virus found
eTrust-Vet 30.3.3086 09.19.2006 no virus found
Ewido 4.0 09.19.2006 Heuristic.Win32.Morphine-Crypted
Fortinet 2.82.0.0 09.19.2006 suspicious
F-Prot 3.16f 09.18.2006 no virus found
F-Prot4 4.2.1.29 09.18.2006 no virus found
Ikarus 0.2.65.0 09.18.2006 no virus found
Kaspersky 4.0.2.24 09.19.2006 no virus found
McAfee 4854 09.18.2006 New Malware.h
Microsoft 1.1560 09.19.2006 no virus found
NOD32v2 1.1762 09.19.2006 unpack error
Norman 5.90.23 09.19.2006 W32/Suspicious_N.gen
Panda 9.0.0.4 09.18.2006 Suspicious file
Sophos 4.09.0 09.19.2006 no virus found
Symantec 8.0 09.19.2006 no virus found
TheHacker 6.0.1.072 09.19.2006 no virus found
UNA 1.83 09.18.2006 no virus found
VBA32 3.11.1 09.19.2006 suspected of Trojan.Delf.37
VirusBuster 4.3.7:9 09.18.2006 no virus found


Aditional Information
File size: 422765 bytes
MD5: 413d6911092cf298733a18363f96cf59
SHA1: 18e1cbfcf2b9ee4a4fa7922d07daabc09dde6d8f
packers: Morphine, AHPack

если распаковать м постить exe то результ. тот же

[Alex_Goodwin]

безобидный криптор

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 09.19.2006, 14:19:16 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.19.2006 no virus found
Authentium 4.93.8 09.18.2006 no virus found
Avast 4.7.844.0 09.15.2006 no virus found
AVG 386 09.18.2006 no virus found
BitDefender 7.2 09.19.2006 no virus found
CAT-QuickHeal 8.00 09.18.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 09.19.2006 no virus found
DrWeb 4.33 09.19.2006 no virus found
eTrust-InoculateIT 23.72.128 09.19.2006 no virus found
eTrust-Vet 30.3.3086 09.19.2006 no virus found
Ewido 4.0 09.19.2006 no virus found
Fortinet 2.82.0.0 09.19.2006 PossibleThreat!01519
F-Prot 3.16f 09.18.2006 no virus found
F-Prot4 4.2.1.29 09.18.2006 no virus found
Ikarus 0.2.65.0 09.18.2006 no virus found
Kaspersky 4.0.2.24 09.19.2006 no virus found
McAfee 4854 09.18.2006 no virus found
Microsoft 1.1560 09.19.2006 no virus found
NOD32v2 1.1762 09.19.2006 no virus found
Norman 5.90.23 09.19.2006 no virus found
Panda 9.0.0.4 09.18.2006 Suspicious file
Sophos 4.09.0 09.19.2006 no virus found
Symantec 8.0 09.19.2006 no virus found
TheHacker 6.0.1.072 09.19.2006 Posible_Worm32
UNA 1.83 09.18.2006 no virus found
VBA32 3.11.1 09.19.2006 no virus found
VirusBuster 4.3.7:9 09.18.2006 no virus found


Aditional Information
File size: 27648 bytes
MD5: 3a1cbaf3a33d4bdbd67937ac0641acbc
SHA1: 7da5ab72c8673367235c68b244b389e070c2ee2e
packers: UPX

ложняк

[Aswed]

Обнаружил в Cache у Firefox'а троян:

Complete scanning result of "C39791ADd01", received in VirusTotal at 09.20.2006, 09:48:04 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.20.2006 no virus found
Authentium 4.93.8 09.19.2006 no virus found
Avast 4.7.844.0 09.19.2006 no virus found
AVG 386 09.19.2006 no virus found
BitDefender 7.2 09.20.2006 no virus found
CAT-QuickHeal 8.00 09.20.2006 no virus found
ClamAV devel-20060426 09.20.2006 no virus found
DrWeb 4.33 09.20.2006 no virus found
eTrust-InoculateIT 23.72.128 09.19.2006 no virus found
eTrust-Vet 30.3.3088 09.20.2006 no virus found
Ewido 4.0 09.19.2006 no virus found
Fortinet 2.82.0.0 09.20.2006 JS/Agent.AB!tr.dldr
F-Prot 3.16f 09.19.2006 no virus found
F-Prot4 4.2.1.29 09.19.2006 no virus found
Ikarus 0.2.65.0 09.19.2006 no virus found
Kaspersky 4.0.2.24 09.20.2006 Trojan-Downloader.JS.Agent.ab
McAfee 4855 09.19.2006 no virus found
Microsoft 1.1560 09.19.2006 no virus found
NOD32v2 1.1763 09.19.2006 no virus found
Norman 5.90.23 09.19.2006 no virus found
Panda 9.0.0.4 09.19.2006 no virus found
Sophos 4.09.0 09.20.2006 no virus found
Symantec 8.0 09.20.2006 no virus found
TheHacker 6.0.1.074 09.20.2006 no virus found
UNA 1.83 09.19.2006 no virus found
VBA32 3.11.1 09.19.2006 no virus found
VirusBuster 4.3.7:9 09.19.2006 no virus found

Aditional Information
File size: 16500 bytes
MD5: f6f15ec5745156eba9463448ce882688
SHA1: ed558a29dbb33d48ef271ec2f5c3fdd342d66851

[pig]

Письмо якобы от eBay.

Complete scanning result of "edlead_slipwave.com_1219_21245898",
received in VirusTotal at 09.21.2006, 09:11:23 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.21.2006 no virus found
Authentium 4.93.8 09.21.2006 no virus found
Avast 4.7.844.0 09.19.2006 no virus found
AVG 386 09.20.2006 no virus found
BitDefender 7.2 09.21.2006 no virus found
CAT-QuickHeal 8.00 09.20.2006 no virus found
ClamAV devel-20060426 09.21.2006 HTML.Phishing.Auction-144
DrWeb 4.33 09.20.2006 no virus found
eTrust-InoculateIT 23.73.1 09.21.2006 no virus found
eTrust-Vet 30.3.3088 09.20.2006 no virus found
Ewido 4.0 09.20.2006 no virus found
Fortinet 2.82.0.0 09.20.2006 no virus found
F-Prot 3.16f 09.20.2006 no virus found
F-Prot4 4.2.1.29 09.20.2006 no virus found
Ikarus 0.2.65.0 09.20.2006 no virus found
Kaspersky 4.0.2.24 09.21.2006 no virus found
McAfee 4856 09.20.2006 no virus found
Microsoft 1.1560 09.21.2006 no virus found
NOD32v2 1.1765 09.20.2006 no virus found
Norman 5.90.23 09.20.2006 no virus found
Panda 9.0.0.4 09.20.2006 no virus found
Sophos 4.09.0 09.21.2006 no virus found
Symantec 8.0 09.21.2006 no virus found
TheHacker 6.0.1.074 09.20.2006 no virus found
UNA 1.83 09.20.2006 no virus found
VBA32 3.11.1 09.19.2006 no virus found
VirusBuster 4.3.7:9 09.20.2006 no virus found


Aditional Information
File size: 15613 bytes
MD5: e0c1808dd82e87068402eaed1688bc4f
SHA1: f50ec1a592a388e35d7f875f540fdf835e9e7736

Действительно фишинг, ссылка ведёт на хттп://www.digitalsat.tv/cgi.ebay.com/ws/ebayisapi%3bdllsignin&co_partnerid=2/puserid=&siteid=0&pagetype=&pa1=&i1=&bshowgif=&usi ngssl=&ru/

P.S. Dr.Web 21.09.06 16:13 MSD: Trojan.Bankfraud.378

[Sanja]

STATUS: FINISHEDComplete scanning result of "avz00001.dta", received in VirusTotal at 09.21.2006, 21:08:32 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.16 09.21.2006 BDS/VanBot.N
Authentium 4.93.8 09.21.2006 W32/Ircbot.VM
Avast 4.7.844.0 09.19.2006 no virus found
AVG 386 09.21.2006 BackDoor.Generic3.OAT
BitDefender 7.2 09.21.2006 DeepScan:Generic.Sdbot.BAE122A0
CAT-QuickHeal 8.00 09.20.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 09.21.2006 no virus found
DrWeb 4.33 09.21.2006 BackDoor.IRC.Combot
eTrust-InoculateIT 23.73.1 09.21.2006 Win32/Duiskbot.J!Worm
eTrust-Vet 30.3.3090 09.21.2006 Win32/Duiskbot.J
Ewido 4.0 09.21.2006 no virus found
Fortinet 2.82.0.0 09.21.2006 W32/SpyBot.MK!worm
F-Prot 3.16f 09.21.2006 security risk named W32/Ircbot.VM
F-Prot4 4.2.1.29 09.21.2006 W32/Ircbot.VM
Ikarus 0.2.65.0 09.21.2006 no virus found
Kaspersky 4.0.2.24 09.21.2006 Backdoor.Win32.VanBot.n
McAfee 4857 09.21.2006 W32/Sdbot.worm!MS06-040
Microsoft 1.1560 09.21.2006 no virus found
NOD32v2 1.1766 09.21.2006 no virus found
Norman 5.90.23 09.21.2006 no virus found
Panda 9.0.0.4 09.21.2006 W32/Sdbot.IFM.worm
Sophos 4.09.0 09.21.2006 W32/Spybot-MK
Symantec 8.0 09.21.2006 no virus found
TheHacker 6.0.1.075 09.21.2006 no virus found
UNA 1.83 09.21.2006 Backdoor.SdBot.D
VBA32 3.11.1 09.21.2006 BackDoor.IRC.Combot
VirusBuster 4.3.7:9 09.21.2006 no virus found

[OlegL]

Complete scanning result of "OD_02.exe", received in VirusTotal at 09.23.2006, 20:40:13 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.18 09.23.2006 TR/PSW.LdPinch.ach.6
Authentium 4.93.8 09.23.2006 no virus found
Avast 4.7.844.0 09.22.2006 Win32dpinch-CK
AVG 386 09.22.2006 no virus found
BitDefender 7.2 09.23.2006 no virus found
CAT-QuickHeal 8.00 09.22.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 09.23.2006 no virus found
DrWeb 4.33 09.22.2006 no virus found
eTrust-InoculateIT 23.73.3 09.23.2006 no virus found
eTrust-Vet 30.3.3093 09.22.2006 no virus found
Ewido 4.0 09.23.2006 Trojan.LdPinch.ach
Fortinet 2.82.0.0 09.23.2006 suspicious
F-Prot 3.16f 09.23.2006 no virus found
F-Prot4 4.2.1.29 09.23.2006 no virus found
Ikarus 0.2.65.0 09.23.2006 Trojan-PSW.Win32.LdPinch.ach
Kaspersky 4.0.2.24 09.23.2006 no virus found
McAfee 4858 09.22.2006 no virus found
Microsoft 1.1560 09.23.2006 no virus found
NOD32v2 1.1769 09.23.2006 no virus found
Norman 5.90.23 09.22.2006 no virus found
Panda 9.0.0.4 09.23.2006 Suspicious file
Sophos 4.09.0 09.23.2006 no virus found
Symantec 8.0 09.23.2006 Infostealer
TheHacker 6.0.1.077 09.23.2006 no virus found
UNA 1.83 09.22.2006 no virus found
VBA32 3.11.1 09.23.2006 no virus found
VirusBuster 4.3.7:9 09.23.2006 no virus found

Aditional Information
File size: 439040 bytes
MD5: 3c3728ea1fa42690db0b34f31ad85145
SHA1: 85675c90d05a921d19bbc5862c155aaf48572f0f
packers: ACProtect, Aspack

[Exxx]

Complete scanning result of "FR.exe", received in VirusTotal at 09.25.2006, 00:00:21 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.18 09.24.2006 TR/Small.Crypted.Gen
Authentium 4.93.8 09.23.2006 no virus found
Avast 4.7.844.0 09.22.2006 Win32ownloader-gen
AVG 386 09.22.2006 Downloader.Obfuskated
BitDefender 7.2 09.24.2006 no virus found
CAT-QuickHeal 8.00 09.22.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 09.24.2006 Dialer-307
DrWeb 4.33 09.22.2006 Trojan.DownLoader.based
eTrust-InoculateIT 23.73.4 09.24.2006 no virus found
eTrust-Vet 30.3.3093 09.22.2006 Win32/SillyDl.PW
Ewido 4.0 09.24.2006 no virus found
Fortinet 2.82.0.0 09.24.2006 Dial/269
F-Prot 3.16f 09.23.2006 no virus found
F-Prot4 4.2.1.29 09.23.2006 no virus found
Ikarus 0.2.65.0 09.23.2006 no virus found
Kaspersky 4.0.2.24 09.24.2006 Trojan-Downloader.Win32.Obfuscated.n
McAfee 4858 09.22.2006 potentially unwanted program Dialer-269
Microsoft 1.1560 09.24.2006 TrojanDownloader:Win32/Beenut.gen
NOD32v2 1.1772 09.24.2006 a variant of Win32/TrojanDownloader.Busky
Norman 5.90.23 09.22.2006 no virus found
Panda 9.0.0.4 09.24.2006 no virus found
Sophos 4.09.0 09.24.2006 no virus found
Symantec 8.0 09.24.2006 no virus found
TheHacker 6.0.1.078 09.24.2006 no virus found
UNA 1.83 09.22.2006 no virus found
VBA32 3.11.1 09.24.2006 suspected of MalwareScope.Trojan-Downloader.Obfuscated.1 (paranoid heuristics)
VirusBuster 4.3.7:9 09.24.2006 no virus found

Aditional Information
File size: 17528 bytes
MD5: 9317998c25a12f749cd8c3b5ca7e8c3a
SHA1: 7bacca912bc4b799bfe94ddb12dc069ef5ceef2a
packers: embedded

[WaterFish]

Не совсем в соответствии с правилами топика.
Отсюда:http://forum.kaspersky.com/index.php?showtopic=22251

STATUS: FINISHEDComplete scanning result of "m_mail.rar", received in VirusTotal at 09.27.2006, 10:18:00 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.18 09.27.2006 TR/Drop.Microjoin.J.262
Authentium 4.93.8 09.27.2006 no virus found
Avast 4.7.892.0 09.26.2006 no virus found
AVG 386 09.26.2006 no virus found
BitDefender 7.2 09.27.2006 Trojan.Dropper.Microjoin.J
CAT-QuickHeal 8.00 09.27.2006 no virus found
ClamAV devel-20060426 09.27.2006no virus found
eTrust-InoculateIT 23.73.6 09.27.2006 no virus found
eTrust-Vet 30.3.3103 09.27.2006 no virus found
DrWeb 4.33 09.27.2006 Trojan.MulDrop.4153
Ewido 4.0 09.26.2006 no virus found
Fortinet 2.82.0.0 09.27.2006 suspicios
F-Prot 3.16f 09.27.2006 no virus found
F-Prot4 4.2.1.29 09.27.2006 no virus found
Ikarus 0.2.65.0 09.27.2006 no virus found
Kaspersky 4.0.2.24 09.27.2006 no virus found
McAfee 4860 09.26.2006 New Win32
Microsoft 1.1603 09.27.2006 no virus found
NOD32v2 1.1777 09.26.2006 no virus found
Norman 5.80.02 09.26.2006 no virus found
Panda 9.0.0.4 09.26.2006 Suspicious file
Sophos 4.10.0 09.27.2006 no virus found
Symantec 8.0 09.27.2006 no virus found
TheHacker 6.0.1.083 09.27.2006 no virus found
UNA 1.83 09.26.2006 no virus found
VBA32 3.11.1 09.26.2006 no virus found
VirusBuster 4.3.7:9 09.26.2006 no virus found


Aditional Information
File size: 303185 bytes
MD5: 3107a1ac0811b4ffbaa30e9e47e8defd
SHA1: 5fb710f44de5d6d3a48921d2595cc49ec0b6ef88

VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability

[kvit]

Complete scanning result of "Document.hta", received in VirusTotal at 09.28.2006, 05:47:59 (CET).

AntiVir 7.2.0.18 09.27.2006 no virus found
Authentium 4.93.8 09.28.2006 VBS/Scano@dr
Avast 4.7.892.0 09.27.2006 no virus found
AVG 386 09.27.2006 I-Worm/Scano
BitDefender 7.2 09.28.2006 [email protected]
CAT-QuickHeal 8.00 09.27.2006 VBS/Scano.E
ClamAV devel-20060426 09.27.2006 Worm.Scano.AF-2
DrWeb 4.33 09.27.2006 Win32.HLLM.Perf
eTrust-InoculateIT 23.73.7 09.28.2006 VBS/Areses!Worm
eTrust-Vet 30.3.3103 09.27.2006 VBS/Areses!generic
Ewido 4.0 09.27.2006 no virus found
Fortinet 2.82.0.0 09.28.2006 VBS/Scano.AF@mm
F-Prot 3.16f 09.28.2006 VBS/Scano@dr
F-Prot4 4.2.1.29 09.28.2006 VBS/Scano@dr
Ikarus 0.2.65.0 09.28.2006 no virus found
Kaspersky 4.0.2.24 09.28.2006 Trojan-Downloader.Win32.Scano.gen
McAfee 4861 09.27.2006 W32/Areses.dr
Microsoft 1.1603 09.28.2006 TrojanDropper:VBS/Scano.gen
NOD32v2 1.1780 09.27.2006 Win32/Scano.AO
Norman 5.90.23 09.27.2006 no virus found
Panda 9.0.0.4 09.27.2006 no virus found
Sophos 4.10.0 09.28.2006 W32/Bagle-GY
Symantec 8.0 09.28.2006 W32.Areses.Q!vbs
TheHacker 6.0.1.085 09.28.2006 no virus found
UNA 1.83 09.27.2006 no virus found
VBA32 3.11.1 09.27.2006 Email-Worm.Win32.Scano.e#6
VirusBuster 4.3.7:9 09.27.2006 VBS.Scano.AZ

[WaterFish]

Complete scanning result of "axdlplug-1.5.0.0-0147-setup.exe", received in VirusTotal at 09.29.2006, 08:10:23 (CET).
Antivirus Version Update Result
AntiVir 7.2.0.18 09.28.2006 no virus found
Authentium 4.93.8 09.28.2006 no virus found
Avast 4.7.892.0 09.27.2006 Win32:Adware-gen.
AVG 386 09.27.2006 no virus found
BitDefender 7.2 09.29.2006 no virus found
CAT-QuickHeal 8.00 09.28.2006 no virus found
ClamAV devel-20060426 09.28.2006 no virus found
DrWeb 4.33 09.28.2006 Trojan.DownLoader.13318
eTrust-InoculateIT 23.73.8 09.29.2006 no virus found
eTrust-Vet 30.3.3104 09.28.2006 no virus found
Ewido 4.0 09.28.2006 no virus found
Fortinet 2.82.0.0 09.29.2006 suspicious
F-Prot 3.16f 09.28.2006 no virus found
F-Prot4 4.2.1.29 09.28.2006 no virus found
Ikarus 0.2.65.0 09.28.2006 no virus found
Kaspersky 4.0.2.24 09.29.2006 no virus found
McAfee 4862 09.28.2006 no virus found
Microsoft 1.1603 09.29.2006 NetPumper (threat-c)
NOD32v2 1.1782 09.28.2006 no virus found
Norman 5.90.23 09.28.2006 no virus found
Panda 9.0.0.4 09.28.2006 no virus found
Sophos 4.10.0 09.29.2006 no virus found
Symantec 8.0 09.29.2006 no virus found
TheHacker 6.0.1.086 09.29.2006 no virus found
UNA 1.83 09.28.2006 no virus found
VBA32 3.11.1 09.28.2006 no virus found
VirusBuster 4.3.7:9 09.28.2006 no virus found

Aditional Information
File size: 356911 bytes
MD5: 84373090b6b8d2122424ee6e5b997c9d
SHA1: f69cded63ef3a06bf71307fff485b01286026cbd
packers: RAR

[Winsent]

Предлагают посмотреть на солистку ТАТУ в ванной


Complete scanning result of "tatu_Lena.exe", received in VirusTotal at 10.01.2006, 14:30:22 (CET).

AntiVir 7.2.0.22 09.30.2006 DR/Agent.aij.2
Authentium 4.93.8 09.29.2006 could be a corrupted executable file
Avast 4.7.892.0 09.29.2006 no virus found
AVG 386 09.29.2006 no virus found
BitDefender 7.2 10.01.2006 Trojan.PWS.LDPinch.SCA
CAT-QuickHeal 8.00 09.30.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 10.01.2006 no virus found
eTrust-InoculateIT 23.73.10 09.30.2006 no virus found
eTrust-Vet 30.3.3106 09.30.2006 no virus found
DrWeb 4.33 10.01.2006 Trojan.MulDrop.1413
Ewido 4.0 09.30.2006 no virus found
Fortinet 2.82.0.0 09.30.2006 PossibleThreat!09705
F-Prot 3.16f 09.29.2006 no virus found
F-Prot4 4.2.1.29 09.29.2006 no virus found
Ikarus 0.2.65.0 09.29.2006 no virus found
Kaspersky 4.0.2.24 10.01.2006 Trojan-PSW.Win32.PdPinch.fe
McAfee 4863 09.29.2006 New Win32.g5
Microsoft 1.1603 10.01.2006 no virus found
NOD32v2 1.1784 09.29.2006 no virus found
Norman 5.80.02 09.29.2006 no virus found
Panda 9.0.0.4 09.30.2006 no virus found
Sophos 4.10.0 09.30.2006 no virus found
Symantec 8.0 10.01.2006 no virus found
TheHacker 6.0.1.088 09.30.2006 no virus found
UNA 1.83 09.29.2006 no virus found
VBA32 3.11.1 09.29.2006 Trojan.VBS.KillAV.O
VirusBuster 4.3.7:9 09.30.2006 no virus found

Aditional Information
File size: 30849 bytes
MD5: 5260cd82fc76352bc622964eccf9a8b2
SHA1: 42bfa6394d7d4a6e4ff57b4b50f5bbf4b176ae54

[mihail]

Девушка предлагает посмотреть на ее фото с подругой.

STATUS: FINISHEDComplete scanning result of "spodrugoj.zip", received in VirusTotal at 10.02.2006, 00:16:23 (CET).

AntiVir 7.2.0.22 09.30.2006 HEUR/Malware
Authentium 4.93.8 09.29.2006 no virus found
Avast 4.7.892.0 09.29.2006 no virus found
AVG 386 10.01.2006 no virus found
BitDefender 7.2 10.01.2006 BehavesLike:Win32.ExplorerHijack
CAT-QuickHeal 8.00 09.30.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 10.01.2006 no virus found
DrWeb 4.33 10.01.2006 no virus found
eTrust-InoculateIT 23.73.10 09.30.2006 no virus found
eTrust-Vet 30.3.3106 09.30.2006 Win32/Areses
Ewido 4.0 10.01.2006 no virus found
Fortinet 2.82.0.0 10.01.2006 suspicious
F-Prot 3.16f 09.29.2006 no virus found
F-Prot4 4.2.1.29 09.29.2006 no virus found
Ikarus 0.2.65.0 09.29.2006 no virus found
Kaspersky 4.0.2.24 10.01.2006 no virus found
McAfee 4863 09.29.2006 Downloader-AWA
Microsoft 1.1603 10.01.2006 no virus found
NOD32v2 1.1784 09.29.2006 a variant of Win32/TrojanDownloader.Delf.AJD
Norman 5.90.23 09.29.2006 W32/Downloader
Panda 9.0.0.4 10.01.2006 Suspicious file
Sophos 4.10.0 10.01.2006 Mal/Packer
Symantec 8.0 10.01.2006 no virus found
TheHacker 6.0.1.088 09.30.2006 no virus found
UNA 1.83 09.29.2006 no virus found
VBA32 3.11.1 10.01.2006 no virus found
VirusBuster 4.3.7:9 10.01.2006 no virus found

[kvit]

Complete scanning result of "Update-KB5984-x86.exe", processed in VirusTotal at 10/02/2006 06:47:26 (CET).

[ file data ]
* name: Update-KB5984-x86.exe
* size: 148860
* md5.: bb8c209c4f62e12db30fb58636ca9eb6
* sha1: 98bb80f43058a8b39990dff801f40e809c46bf60

[ scan result ]
AntiVir 7.2.0.22/20060930 found [Worm/Stration.C]
Authentium 4.93.8/20060929 found nothing
Avast 4.7.892.0/20060929 found nothing
AVG 386/20061001 found [I-Worm/Stration]
BitDefender 7.2/20061002 found nothing
CAT-QuickHeal 8.00/20060930 found [(Suspicious) - DNAScan]
ClamAV devel-20060426/20061002 found [Worm.Stration.EM]
DrWeb 4.33/20061001 found nothing
eTrust-InoculateIT 23.73.10/20060930 found nothing
eTrust-Vet 30.3.3106/20060930 found nothing
Ewido 4.0/20061001 found nothing
F-Prot 3.16f/20060929 found nothing
F-Prot4 4.2.1.29/20060929 found nothing
Fortinet 2.82.0.0/20061002 found [suspicious]
Ikarus 0.2.65.0/20060929 found [Email-Worm.Win32.Warezov.at]
Kaspersky 4.0.2.24/20061002 found nothing
McAfee 4863/20060929 found [New Malware.n]
Microsoft 1.1603/20061001 found nothing
NOD32v2 1.1784/20060929 found nothing
Norman 5.80.02/20060929 found nothing
Panda 9.0.0.4/20061001 found [Suspicious file]
Sophos 4.10.0/20061002 found [Mal/Packer]
Symantec 8.0/20061002 found nothing
TheHacker 6.0.1.088/20060930 found nothing
UNA 1.83/20060929 found nothing
VBA32 3.11.1/20061001 found nothing
VirusBuster 4.3.7:9/20061001 found [Trojan.Opnis.Gen!Pac2]

[ notes ]
packers: UPACK

[Alex_Goodwin]

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 10.02.2006, 10:09:55 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.22 09.30.2006 EXP/Agent.B
Authentium 4.93.8 09.29.2006 no virus found
Avast 4.7.892.0 09.29.2006 no virus found
AVG 386 10.01.2006 no virus found
BitDefender 7.2 10.02.2006 Application.JS.ForcePopup.D
CAT-QuickHeal 8.00 09.30.2006 no virus found
ClamAV devel-20060426 10.02.2006 no virus found
eTrust-InoculateIT 23.73.10 09.30.2006 no virus found
eTrust-Vet 30.3.3111 10.02.2006 no virus found
DrWeb 4.33 10.02.2006 Trojan.Click.1394
Ewido 4.0 10.02.2006 Hijacker.Agent.a
Fortinet 2.82.0.0 10.02.2006 no virus found
F-Prot 3.16f 09.29.2006 no virus found
F-Prot4 4.2.1.29 09.29.2006 no virus found
Ikarus 0.2.65.0 10.02.2006 no virus found
Kaspersky 4.0.2.24 10.02.2006 Trojan-Clicker.HTML.Agent.a
McAfee 4863 09.29.2006 no virus found
Microsoft 1.1603 10.02.2006 no virus found
NOD32v2 1.1785 10.02.2006 no virus found
Norman 5.80.02 09.29.2006 no virus found
Panda 9.0.0.4 10.01.2006 no virus found
Sophos 4.10.0 10.02.2006 no virus found
Symantec 8.0 10.02.2006 no virus found
TheHacker 6.0.1.089 10.02.2006 no virus found
UNA 1.83 09.29.2006 no virus found
VBA32 3.11.1 10.01.2006 no virus found
VirusBuster 4.3.7:9 10.01.2006 no virus found


Aditional Information
File size: 8935 bytes
MD5: a9474a01779ec4f2e6219ea94c014d31
SHA1: 58e7f438a370b9dc00d37935da89c93eb4a5b48f

Кликеру сто лет, а ловят по прежнему единицы

[Winsent]

В продолжении Update'а-KB5984-x86.exe

Untitled.txt [From ***@telcan.com][Date Pц]/Update-KB8750-x86.exe/PE_Patch/UPack



File "Untitled.txt" received on 10.02.2006 at 13:31:12 (CET) is being scanned by VirusTotal in this moment. Results will be shown as they're generated.

Antivirus Version Update Result
AntiVir 7.2.0.22 10.02.2006 Worm/Stration.C
Authentium 4.93.8 09.29.2006 no virus found
Avast 4.7.892.0 10.02.2006 no virus found
AVG 386 10.01.2006 no virus found
BitDefender 7.2 10.02.2006 no virus found
CAT-QuickHeal 8.00 09.30.2006 no virus found
ClamAV devel-20060426 10.02.2006 Worm.Stration.EW
DrWeb 4.33 10.02.2006 Win32.HLLM.Limar.based
eTrust-InoculateIT 23.73.10 09.30.2006 no virus found
eTrust-Vet 30.3.3111 10.02.2006 no virus found
Ewido 4.0 10.02.2006 no virus found
Fortinet 2.82.0.0 10.02.2006 suspicious
F-Prot 3.16f 09.29.2006 no virus found
F-Prot4 4.2.1.29 09.29.2006 no virus found
Ikarus 0.2.65.0 10.02.2006 Email-Worm.Win32.Warezov.at
Kaspersky 4.0.2.24 10.02.2006 Email-Worm.Win32.Warezov.bt
McAfee 4863 09.29.2006 New Malware.n
Microsoft 1.1603 10.02.2006 no virus found
NOD32v2 1.1786 10.02.2006 no virus found
Norman 5.90.23 09.29.2006 no virus found
Panda 9.0.0.4 10.01.2006 Suspicious file
Sophos 4.10.0 10.02.2006 Mal/Packer
Symantec 8.0 10.02.2006 no virus found

Aditional Information
File size: 201263 bytes
MD5: a54fefc9a3507e5e8764e29c6d835602
SHA1: b9979a7b447ad3b5ca76dca245d541de5b783a7e

[HATTIFNATTOR]

* name: test.txt.bat
* size: 150557
* md5.: 52ce315c114cd680db7b71c7927687c2
* sha1: 6f6bcc5734eb7614dad11aead24613ba581520b8

[ scan result ]
AntiVir 7.2.0.22/20061002 found [Worm/Stration.C]
Authentium 4.93.8/20060929 found nothing
Avast 4.7.892.0/20061002 found nothing
AVG 386/20061001 found [I-Worm/Stration]
BitDefender 7.2/20061002 found [Dropped:Win32.Stration.Gen@mm]
CAT-QuickHeal 8.00/20060930 found [(Suspicious) - DNAScan]
ClamAV devel-20060426/20061002 found [Worm.Stration.ET]
DrWeb 4.33/20061002 found [Win32.HLLM.Limar.based]
eTrust-InoculateIT 23.73.10/20060930 found nothing
eTrust-Vet 30.3.3111/20061002 found nothing
Ewido 4.0/20061002 found nothing
F-Prot 3.16f/20060929 found nothing
F-Prot4 4.2.1.29/20060929 found nothing
Fortinet 2.82.0.0/20061002 found [suspicious]
Ikarus 0.2.65.0/20061002 found [Email-Worm.Win32.Warezov.at]
Kaspersky 4.0.2.24/20061002 found [Email-Worm.Win32.Warezov.bw]
McAfee 4863/20060929 found [New Malware.n]
Microsoft 1.1603/20061002 found nothing
NOD32v2 1.1786/20061002 found [Win32/Stration.FM]
Norman 5.80.02/20060929 found nothing
Panda 9.0.0.4/20061001 found [Suspicious file]
Sophos 4.10.0/20061002 found [Mal/Packer]
Symantec 8.0/20061002 found nothing
TheHacker 6.0.1.089/20061002 found nothing
UNA 1.83/20060929 found nothing
VBA32 3.11.1/20061001 found nothing
VirusBuster 4.3.7:9/20061001 found [Trojan.Opnis.Gen!Pac2]

packers: UPACK


* name: document.log.cmd
* size: 147768
* md5.: b2676ac7cae4b137c6929eb0457fe3c8
* sha1: 2bd946a9cd09f34de32682723c068e0749836795

[ scan result ]
AntiVir 7.2.0.22/20061002 found [Worm/Stration.C]
Authentium 4.93.8/20060929 found nothing
Avast 4.7.892.0/20061002 found nothing
AVG 386/20061001 found [I-Worm/Stration]
BitDefender 7.2/20061002 found [Win32.Stration.Gen@mm]
CAT-QuickHeal 8.00/20060930 found [(Suspicious) - DNAScan]
ClamAV devel-20060426/20061002 found [Worm.Stration.EY]
DrWeb 4.33/20061002 found [Win32.HLLM.Limar.based]
eTrust-InoculateIT 23.73.10/20060930 found nothing
eTrust-Vet 30.3.3111/20061002 found nothing
Ewido 4.0/20061002 found nothing
F-Prot 3.16f/20060929 found nothing
F-Prot4 4.2.1.29/20060929 found nothing
Fortinet 2.82.0.0/20061002 found [suspicious]
Ikarus 0.2.65.0/20061002 found [Email-Worm.Win32.Warezov.at]
Kaspersky 4.0.2.24/20061002 found nothing
McAfee 4863/20060929 found [New Malware.n]
Microsoft 1.1603/20061002 found nothing
NOD32v2 1.1786/20061002 found [Win32/Stration.FS]
Norman 5.80.02/20060929 found nothing
Panda 9.0.0.4/20061001 found [Suspicious file]
Sophos 4.10.0/20061002 found [Mal/Packer]
Symantec 8.0/20061002 found nothing
TheHacker 6.0.1.089/20061002 found nothing
UNA 1.83/20060929 found nothing
VBA32 3.11.1/20061001 found nothing
VirusBuster 4.3.7:9/20061001 found [Trojan.Opnis.Gen!Pac2]

packers: UPACK

на фтп + еще пара детектируемых почти всеми вариантов

[HATTIFNATTOR]

* name: readme.dat.exe
* size: 144414
* md5.: 2ce50c5687173f2ef8d8504a5a4bcf4e
* sha1: ccbf3ed449ba080d4cb8f1d16f8fc6b1d409658d

[ scan result ]
AntiVir 7.2.0.22/20061002 found [Worm/Stration.C]
Authentium 4.93.8/20060929 found nothing
Avast 4.7.892.0/20061002 found nothing
AVG 386/20061001 found [I-Worm/Stration]
BitDefender 7.2/20061002 found [Win32.Stration.Gen@mm]
CAT-QuickHeal 8.00/20060930 found [(Suspicious) - DNAScan]
ClamAV devel-20060426/20061002 found [Worm.Stration.FC-1]
DrWeb 4.33/20061002 found [Win32.HLLM.Limar.based]
[B]eTrust-InoculateIT 23.73.10/20060930 found nothing [B]
eTrust-Vet 30.3.3111/20061002 found nothing
Ewido 4.0/20061002 found nothing
F-Prot 3.16f/20060929 found nothing
F-Prot4 4.2.1.29/20060929 found nothing
Fortinet 2.82.0.0/20061002 found [W32/Stration.DR@mm]
Ikarus 0.2.65.0/20061002 found [Packer.byDwing]
Kaspersky 4.0.2.24/20061002 found nothing
McAfee 4863/20060929 found [New Malware.n]
Microsoft 1.1603/20061002 found nothing
NOD32v2 1.1786/20061002 found [a variant of Win32/Stration]
Norman 5.80.02/20061002 found nothing
Panda 9.0.0.4/20061001 found [Suspicious file]
Sophos 4.10.0/20061002 found [W32/Stratio-AO]
Symantec 8.0/20061002 found nothing
TheHacker 6.0.1.089/20061002 found nothing
UNA 1.83/20061002 found nothing
VBA32 3.11.1/20061001 found [suspected of Worm.Warezov.5 (paranoid heuristics)]
VirusBuster 4.3.7:9/20061002 found [Trojan.Opnis.Gen!Pac2]

[ notes ]
packers: UPACK

[ZhIV]

Complete scanning result of "body.zip", received in VirusTotal at 10.04.2006, 05:28:40 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.22 10.03.2006 no virus found
Authentium 4.93.8 10.03.2006 W32/Warezov.gen!W32DL
Avast 4.7.892.0 10.03.2006 no virus found
AVG 386 10.03.2006 I-Worm/Stration
BitDefender 7.2 10.04.2006 no virus found
CAT-QuickHeal 8.00 10.03.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 10.04.2006 Worm.Stration.EY
DrWeb 4.33 10.03.2006 Win32.HLLM.Limar
eTrust-InoculateIT 23.73.13 10.04.2006 Win32/Stration.4gf!Worm
eTrust-Vet 30.3.3113 10.03.2006 Win32/Stration!ZIP!generic
Ewido 4.0 10.04.2006 Worm.Warezov
Fortinet 2.82.0.0 10.04.2006 W32/Stration.DR@mm
F-Prot 3.16f 10.03.2006 W32/Warezov.gen!W32DL
F-Prot4 4.2.1.29 10.02.2006 W32/Tricky-Malware-based!Maximus
Ikarus 0.2.65.0 10.03.2006 Packer.byDwing
Kaspersky 4.0.2.24 10.04.2006 no virus found
McAfee 4865 10.03.2006 W32/Stration.dr
Microsoft 1.1603 10.04.2006 no virus found
NOD32v2 1.1788 10.03.2006 no virus found
Norman 5.90.23 10.03.2006 W32/Stration.PR
Panda 9.0.0.4 10.03.2006 no virus found
Sophos 4.10.0 10.04.2006 W32/Stratio-Zip
Symantec 8.0 10.04.2006 no virus found
TheHacker 6.0.1.090 10.03.2006 W32/Stration@MM
UNA 1.83 10.03.2006 no virus found
VBA32 3.11.1 10.03.2006 no virus found
VirusBuster 4.3.7:9 10.03.2006 Trojan.Opnis.Gen!Pac2

Aditional Information
File size: 110914 bytes
MD5: 83e2fb64b28a5d0d562d031d63cbf653
SHA1: 8b891bcc69c54e5f4fd12b95400c9de2a907e6f5