Исследование антивирусов 4

[Alex_Goodwin]

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 11.09.2006, 10:58:53 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.09.2006 TR/Dldr.Horst.FU.1
Authentium 4.93.8 11.08.2006 no virus found
Avast 4.7.892.0 11.07.2006 no virus found
AVG 386 11.08.2006 Proxy.24.BU
BitDefender 7.2 11.09.2006 no virus found
CAT-QuickHeal 8.00 11.08.2006 Trojan.Horst.gen
ClamAV devel-20060426 11.09.2006 no virus found
DrWeb 4.33 11.09.2006 no virus found
eTrust-InoculateIT 23.73.50 11.09.2006 no virus found
eTrust-Vet 30.3.3184 11.09.2006 no virus found
Ewido 4.0 11.08.2006 no virus found
Fortinet 2.82.0.0 11.09.2006 no virus found
F-Prot 3.16f 11.08.2006 no virus found
F-Prot4 4.2.1.29 11.08.2006 no virus found
Ikarus 0.2.65.0 11.09.2006 no virus found
Kaspersky 4.0.2.24 11.09.2006 no virus found
McAfee 4891 11.08.2006 no virus found
Microsoft 1.1609 11.09.2006 no virus found
NOD32v2 1.1859 11.08.2006 no virus found
Norman 5.80.02 11.09.2006 no virus found
Panda 9.0.0.4 11.08.2006 Suspicious file
Sophos 4.11.0 11.07.2006 Mal/Behav-080
TheHacker 6.0.1.116 11.09.2006 Trojan/Horst.b2
UNA 1.83 11.09.2006 no virus found
VBA32 3.11.1 11.08.2006 no virus found
VirusBuster 4.3.15:9 11.08.2006 no virus found


Aditional Information
File size: 38591 bytes
MD5: 48b019996a8ea1f6ed7591c8eabe2c6f
SHA1: 85ea2b17d3a415c669d0d09177b6e1e89748885e
packers: UPX
ЛК: Trojan-Proxy.Win32.Horst

[MOCT]

реальный паразитический вирус:

Complete scanning result of "Frozen_Throne.exe", received in VirusTotal at 11.10.2006, 07:14:50 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.09.2006 no virus found
Authentium 4.93.8 11.10.2006 no virus found
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.09.2006 no virus found
BitDefender 7.2 11.10.2006 no virus found
CAT-QuickHeal 8.00 11.09.2006 no virus found
ClamAV devel-20060426 11.10.2006 no virus found
DrWeb 4.33 11.09.2006 no virus found
eTrust-InoculateIT 23.73.51 11.10.2006 no virus found
eTrust-Vet 30.3.3184 11.09.2006 no virus found
Ewido 4.0 11.09.2006 no virus found
Fortinet 2.82.0.0 11.10.2006 suspicious
F-Prot 3.16f 11.10.2006 no virus found
F-Prot4 4.2.1.29 11.09.2006 no virus found
Ikarus 0.2.65.0 11.09.2006 no virus found
Kaspersky 4.0.2.24 11.10.2006 no virus found
McAfee 4892 11.09.2006 no virus found
Microsoft 1.1609 11.10.2006 no virus found
NOD32v2 1860 11.09.2006 probably unknown NewHeur_PE virus
Norman 5.80.02 11.09.2006 no virus found
Panda 9.0.0.4 11.09.2006 Suspicious file
Sophos 4.11.0 11.07.2006 no virus found
TheHacker 6.0.1.116 11.09.2006 no virus found
UNA 1.83 11.09.2006 no virus found
VBA32 3.11.1 11.09.2006 no virus found
VirusBuster 4.3.15:9 11.09.2006 no virus found


Aditional Information
File size: 393216 bytes
MD5: e86576091ff40c2e2c03704f59fb368f
SHA1: b2ddbbfdbb07e3a35864b6bc919b8aa122a89692
packers: BINARYRES

[Alex_Goodwin]

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 11.10.2006, 09:34:55 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.10.2006 no virus found
Authentium 4.93.8 11.10.2006 no virus found
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.09.2006 Downloader.Zlob.DP
BitDefender 7.2 11.10.2006 Trojan.Downloader.Zlob.BM
CAT-QuickHeal 8.00 11.10.2006 no virus found
ClamAV devel-20060426 11.10.2006 no virus found
DrWeb 4.33 11.10.2006 no virus found
eTrust-InoculateIT 23.73.51 11.10.2006 no virus found
eTrust-Vet 30.3.3186 11.10.2006 no virus found
Ewido 4.0 11.09.2006 no virus found
Fortinet 2.82.0.0 11.10.2006 suspicious
F-Prot 3.16f 11.10.2006 no virus found
F-Prot4 4.2.1.29 11.09.2006 no virus found
Ikarus 0.2.65.0 11.09.2006 no virus found
Kaspersky 4.0.2.24 11.10.2006 Trojan-Downloader.Win32.Zlob.avo
McAfee 4892 11.09.2006 no virus found
Microsoft 1.1609 11.10.2006 no virus found
NOD32v2 1860 11.09.2006 no virus found
Norman 5.80.02 11.09.2006 no virus found
Panda 9.0.0.4 11.09.2006 no virus found
Sophos 4.11.0 11.07.2006 no virus found
TheHacker 6.0.1.116 11.09.2006 no virus found
UNA 1.83 11.09.2006 no virus found
VBA32 3.11.1 11.09.2006 no virus found
VirusBuster 4.3.15:9 11.09.2006 no virus found


Aditional Information
File size: 54142 bytes
MD5: 80cb1cf08d9347df839c2a081af9a52d
SHA1: e40e8ed3fe84eb4fbbe0242618310533fd45b7ee
packers: UPX
packers: UPX, BINARYRES, BINARYRES
packers: UPX

[WaterFish]

То же, что и в предыдущем скане Al.G-n, но уже свежее.
AntiVir 7.2.0.39 11.10.2006 no virus found
Authentium 4.93.8 11.10.2006 no virus found
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.09.2006 Downloader.Zlob.DP
BitDefender 7.2 11.10.2006 no virus found
CAT-QuickHeal 8.00 11.10.2006 no virus found
ClamAV devel-20060426 11.10.2006 no virus found
DrWeb 4.33 11.10.2006 no virus found
eTrust-InoculateIT 23.73.51 11.10.2006 no virus found
eTrust-Vet 30.3.3186 11.10.2006 no virus found
Ewido 4.0 11.10.2006 no virus found
Fortinet 2.82.0.0 11.10.2006 suspicious
F-Prot 3.16f 11.10.2006 no virus found
F-Prot4 4.2.1.29 11.09.2006 no virus found
Ikarus 0.2.65.0 11.09.2006 no virus found
Kaspersky 4.0.2.24 11.10.2006 no virus found
McAfee 4892 11.09.2006 no virus found
Microsoft 1.1609 11.10.2006 no virus found
NOD32v2 1861 11.10.2006 no virus found
Norman 5.80.02 11.10.2006 no virus found
Panda 9.0.0.4 11.09.2006 no virus found
Sophos 4.11.0 11.07.2006 no virus found
TheHacker 6.0.1.116 11.09.2006 no virus found
UNA 1.83 11.09.2006 no virus found
VBA32 3.11.1 11.09.2006 no virus found
VirusBuster 4.3.15:9 11.09.2006 no virus found

[MOCT]

из темы http://virusinfo.info/showthread.php?p=83680
только два антивируса что-то видят:
Fortinet 2.82.0.0 11.11.2006 suspicious
VirusBuster 4.3.15:9 11.10.2006 Trojan.DL.Obfusc.Gen.4

у остальных "no virus found"

[HATTIFNATTOR]

Complete scanning result of "bl4ck.com", received in VirusTotal at 11.11.2006, 13:37:36 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.10.2006 TR/Proxy.Xorpix.AR.3
Authentium 4.93.8 11.10.2006 no virus found
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.10.2006 no virus found
BitDefender 7.2 11.11.2006 no virus found
CAT-QuickHeal 8.00 11.10.2006 no virus found
ClamAV devel-20060426 11.11.2006 no virus found
DrWeb 4.33 11.11.2006 Trojan.MulDrop.4482
eTrust-InoculateIT 23.73.52 11.11.2006 no virus found
eTrust-Vet 30.3.3186 11.10.2006 no virus found
Ewido 4.0 11.10.2006 no virus found
Fortinet 2.82.0.0 11.11.2006 suspicious
F-Prot 3.16f 11.10.2006 no virus found
F-Prot4 4.2.1.29 11.10.2006 no virus found
Ikarus 0.2.65.0 11.10.2006 no virus found
Kaspersky 4.0.2.24 11.11.2006 no virus found
McAfee 4893 11.10.2006 no virus found
Microsoft 1.1609 11.11.2006 no virus found
NOD32v2 1862 11.10.2006 a variant of Win32/Agent.OH
Norman 5.80.02 11.10.2006 no virus found
Panda 9.0.0.4 11.10.2006 no virus found
Sophos 4.11.0 11.07.2006 Mal/Packer
TheHacker 6.0.1.116 11.09.2006 no virus found
UNA 1.83 11.10.2006 no virus found
VBA32 3.11.1 11.10.2006 Trojan.MulDrop.4482
VirusBuster 4.3.15:9 11.10.2006 no virus found


Aditional Information
File size: 18432 bytes
MD5: c1d37d9be679709f8f3dd145293c95b3
SHA1: 1f329dc5c64c29dfbd47d6a850d8d11a69d2ace6


Sat, 11 Nov 2006 16:57:58 +0300 (MSK)

Дроппер Trojan-Proxy.Win32.Xorpix
дропнутый файл уже детектируется. дроппер добавим в очередное обновление баз.

--
Regards, Aleks Gostev
Senior Virus analyst, Kaspersky Lab.
Malware Research and Analysis Group

[HATTIFNATTOR]

Complete scanning result of "CGraph_Biz_-_download___1089", received in VirusTotal at 11.11.2006, 13:43:28 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.10.2006 HEUR/Exploit.HTML
Authentium 4.93.8 11.10.2006 no virus found
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.10.2006 Exploit
BitDefender 7.2 11.11.2006 Generic.XPL.IESpoof.08380557
CAT-QuickHeal 8.00 11.10.2006 no virus found
ClamAV devel-20060426 11.11.2006 Exploit.MS05-013
DrWeb 4.33 11.11.2006 no virus found
eTrust-InoculateIT 23.73.52 11.11.2006 no virus found
eTrust-Vet 30.3.3186 11.10.2006 no virus found
Ewido 4.0 11.10.2006 no virus found
Fortinet 2.82.0.0 11.11.2006 no virus found
F-Prot 3.16f 11.10.2006 no virus found
F-Prot4 4.2.1.29 11.10.2006 no virus found
Ikarus 0.2.65.0 11.10.2006 no virus found
Kaspersky 4.0.2.24 11.11.2006 no virus found
McAfee 4893 11.10.2006 Exploit-IEPageSpoof
Microsoft 1.1609 11.11.2006 no virus found
NOD32v2 1862 11.10.2006 no virus found
Norman 5.80.02 11.10.2006 no virus found
Panda 9.0.0.4 11.10.2006 no virus found
Sophos 4.11.0 11.07.2006 no virus found
TheHacker 6.0.1.116 11.09.2006 no virus found
UNA 1.83 11.10.2006 no virus found
VBA32 3.11.1 11.10.2006 no virus found
VirusBuster 4.3.15:9 11.10.2006 no virus found


Aditional Information
File size: 93223 bytes
MD5: 1da989e54688068c461dd81cdc2d2f17
SHA1: d77e011e3810a921146ef489380c7b6d01487bff

[HATTIFNATTOR]

Complete scanning result of "info.html", received in VirusTotal at 11.11.2006, 14:56:42 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.10.2006 no virus found
Authentium 4.93.8 11.10.2006 no virus found
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.10.2006 no virus found
BitDefender 7.2 11.11.2006 no virus found
CAT-QuickHeal 8.00 11.10.2006 no virus found
ClamAV devel-20060426 11.11.2006 no virus found
DrWeb 4.33 11.11.2006 no virus found
eTrust-InoculateIT 23.73.52 11.11.2006 no virus found
eTrust-Vet 30.3.3186 11.10.2006 JS/SillyDlScript.CB
Ewido 4.0 11.11.2006 no virus found
Fortinet 2.82.0.0 11.11.2006 no virus found
F-Prot 3.16f 11.10.2006 no virus found
F-Prot4 4.2.1.29 11.10.2006 no virus found
Ikarus 0.2.65.0 11.10.2006 no virus found
Kaspersky 4.0.2.24 11.11.2006 no virus found
McAfee 4893 11.10.2006 no virus found
Microsoft 1.1609 11.11.2006 no virus found
NOD32v2 1862 11.10.2006 no virus found
Norman 5.80.02 11.10.2006 no virus found
Panda 9.0.0.4 11.10.2006 no virus found
Sophos 4.11.0 11.07.2006 no virus found
TheHacker 6.0.1.116 11.09.2006 no virus found
UNA 1.83 11.10.2006 TrojanDropper.VBS.Inor
VBA32 3.11.1 11.10.2006 no virus found
VirusBuster 4.3.15:9 11.10.2006 no virus found


Aditional Information
File size: 11291 bytes
MD5: aea0b475bccbb88d62da623c581e9ef4
SHA1: a1dc9e9fe17b610b9e68657ca06d53cb210152bd

[HATTIFNATTOR]

Complete scanning result of "index.htm", received in VirusTotal at 11.11.2006, 15:11:09 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.10.2006 HEUR/Exploit.HTML
Authentium 4.93.8 11.10.2006 no virus found
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.10.2006 Exploit
BitDefender 7.2 11.11.2006 Generic.XPL.IESpoof.37AD8470
CAT-QuickHeal 8.00 11.10.2006 no virus found
ClamAV devel-20060426 11.11.2006 Exploit.MS05-013
DrWeb 4.33 11.11.2006 no virus found
eTrust-InoculateIT 23.73.52 11.11.2006 no virus found
eTrust-Vet 30.3.3186 11.10.2006 no virus found
Ewido 4.0 11.11.2006 Downloader.Agent.ab
Fortinet 2.82.0.0 11.11.2006 no virus found
F-Prot 3.16f 11.10.2006 no virus found
F-Prot4 4.2.1.29 11.10.2006 no virus found
Ikarus 0.2.65.0 11.10.2006 no virus found
Kaspersky 4.0.2.24 11.11.2006 no virus found
McAfee 4893 11.10.2006 Exploit-IEPageSpoof
Microsoft 1.1609 11.11.2006 no virus found
NOD32v2 1862 11.10.2006 no virus found
Norman 5.80.02 11.10.2006 no virus found
Panda 9.0.0.4 11.11.2006 no virus found
Sophos 4.11.0 11.07.2006 no virus found
TheHacker 6.0.1.116 11.09.2006 no virus found
UNA 1.83 11.10.2006 no virus found
VBA32 3.11.1 11.10.2006 no virus found
VirusBuster 4.3.15:9 11.11.2006 no virus found


Aditional Information
File size: 35623 bytes
MD5: 6b0f43db6a6274e9a406686cc3de20ab
SHA1: 1062ba0dab7a137b243921d7ed2f3c7ffb1dc707

[HATTIFNATTOR]

Complete scanning result of "index.php", received in VirusTotal at 11.11.2006, 15:22:00 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.10.2006 EXP/VML-Fill.A
Authentium 4.93.8 11.10.2006 no virus found
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.10.2006 no virus found
BitDefender 7.2 11.11.2006 no virus found
CAT-QuickHeal 8.00 11.10.2006 no virus found
ClamAV devel-20060426 11.11.2006 no virus found
DrWeb 4.33 11.11.2006 VBS.Psyme.262
eTrust-InoculateIT 23.73.52 11.11.2006 no virus found
eTrust-Vet 30.3.3186 11.10.2006 no virus found
Ewido 4.0 11.11.2006 no virus found
Fortinet 2.82.0.0 11.11.2006 JS/WebAttacker!exploit
F-Prot 3.16f 11.10.2006 no virus found
F-Prot4 4.2.1.29 11.10.2006 no virus found
Ikarus 0.2.65.0 11.10.2006 Exploit.HTML.Agent.c
Kaspersky 4.0.2.24 11.11.2006 Exploit.HTML.Agent.c
McAfee 4893 11.10.2006 JS/Downloader-AUD
Microsoft 1.1609 11.11.2006 no virus found
NOD32v2 1862 11.10.2006 no virus found
Norman 5.80.02 11.10.2006 no virus found
Panda 9.0.0.4 11.11.2006 no virus found
Sophos 4.11.0 11.07.2006 no virus found
TheHacker 6.0.1.116 11.09.2006 no virus found
UNA 1.83 11.10.2006 no virus found
VBA32 3.11.1 11.10.2006 no virus found
VirusBuster 4.3.15:9 11.11.2006 no virus found


Aditional Information
File size: 18985 bytes
MD5: 771dd3eac00aaf7f25c2e721a6fc62d3
SHA1: d01a202541c133cd5925ef0c1219235824f8f04d

[Winsent]

Complete scanning result of "output.exe", received in VirusTotal at 11.12.2006, 06:42:16 (CET).


Antivirus Version Update Result

AntiVir 7.2.0.39 11.10.2006 no virus found
Authentium 4.93.8 11.10.2006 no virus found
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.11.2006 no virus found
BitDefender 7.2 11.12.2006 no virus found
CAT-QuickHeal 8.00 11.11.2006 no virus found
ClamAV devel-20060426 11.11.2006 Trojan.Delf-293
DrWeb 4.33 11.11.2006 no virus found
eTrust-InoculateIT 23.73.52 11.11.2006 no virus found
eTrust-Vet 30.3.3186 11.10.2006 no virus found
Ewido 4.0 11.11.2006 no virus found
Fortinet 2.82.0.0 11.12.2006 no virus found
F-Prot 3.16f 11.10.2006 no virus found
F-Prot4 4.2.1.29 11.10.2006 no virus found
Ikarus 0.2.65.0 11.10.2006 no virus found
Kaspersky 4.0.2.24 11.12.2006 no virus found
McAfee 4893 11.10.2006 no virus found
Microsoft 1.1609 11.12.2006 no virus found
NOD32v2 1862 11.10.2006 a variant of Win32/TrojanDropper.Agent.ATA
Norman 5.80.02 11.10.2006 no virus found
Panda 9.0.0.4 11.11.2006 no virus found
Sophos 4.11.0 11.07.2006 no virus found
TheHacker 6.0.1.117 11.12.2006 no virus found
UNA 1.83 11.10.2006 no virus found
VBA32 3.11.1 11.10.2006 no virus found
VirusBuster 4.3.15:9 11.11.2006 no virus found

Aditional Information
File size: 37376 bytes
MD5: 0aa668c2356abaa8c79e32726275034e
SHA1: d503d7f79197a3ea39111cb466e71eddba0f257e

[MOCT]

из темы http://virusinfo.info/showthread.php?t=6730 :

Antivirus Version Update Result
AntiVir 7.2.0.39 11.12.2006 TR/Crypt.F.Gen
DrWeb 4.33 11.12.2006 Trojan.Spambot
Fortinet 2.82.0.0 11.12.2006 suspicious
Norman 5.80.02 11.10.2006 W32/W.C

Aditional Information
File size: 16324 bytes
MD5: 6e98cbf7f1aadf9415647589e3576db0
SHA1: 56a0b8eefeb70b33451287bf319451019f801391

у остальных антивирусов "no virus found".

кстати говоря, TR/Crypt.F.Gen это тоже "незачот", потому что так ругаются на все файлы, упакованные UPX 2.90

[MOCT]

Complete scanning result of "_103_d0d70e9d2e", received in VirusTotal at 11.12.2006, 21:23:33 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.12.2006 TR/Crypt.F.Gen
Authentium 4.93.8 11.10.2006 W32/Tagen.A
Avast 4.7.892.0 11.09.2006 no virus found
AVG 386 11.11.2006 Downloader.Tibs
BitDefender 7.2 11.12.2006 no virus found
CAT-QuickHeal 8.00 11.11.2006 no virus found
ClamAV devel-20060426 11.11.2006 W32.Dref
DrWeb 4.33 11.12.2006 Win32.Dref
eTrust-InoculateIT 23.73.52 11.11.2006 no virus found
eTrust-Vet 30.3.3186 11.10.2006 Win32/Sinteri
Ewido 4.0 11.12.2006 no virus found
Fortinet 2.82.0.0 11.12.2006 suspicious
F-Prot 3.16f 11.10.2006 W32/Tagen.A
F-Prot4 4.2.1.29 11.10.2006 W32/Tagen.A
Ikarus 0.2.65.0 11.10.2006 no virus found
Kaspersky 4.0.2.24 11.12.2006 no virus found
McAfee 4893 11.10.2006 no virus found
Microsoft 1.1609 11.12.2006 Win32/Vxidl.gen!encrypted
NOD32v2 1862 11.10.2006 Win32/Nuwar.gen
Norman 5.80.02 11.10.2006 W32/Nuwar.gen1
Panda 9.0.0.4 11.12.2006 Suspicious file
Sophos 4.11.0 11.07.2006 no virus found
TheHacker 6.0.1.117 11.12.2006 no virus found
UNA 1.83 11.10.2006 no virus found
VBA32 3.11.1 11.10.2006 suspected of Worm.Nuwar.1 (paranoid heuristics)
VirusBuster 4.3.15:9 11.12.2006 Cryptor.Xorpack.A


Aditional Information
File size: 60489 bytes
MD5: 263385f9cbe99a5bcebf084cbd3e4171
SHA1: 2dc80259634f957798b55fad83223497d6516560

[Alex_Goodwin]

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 11.13.2006, 08:08:06 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.12.2006 Worm/Rbot.148480.13
Authentium 4.93.8 11.10.2006 W32/Sdbot.TAV
Avast 4.7.892.0 11.13.2006 Win32:Rbot-CDY
AVG 386 11.12.2006 IRC/BackDoor.SdBot2.CXL
BitDefender 7.2 11.13.2006 Backdoor.RBot.EPB
CAT-QuickHeal 8.00 11.11.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 11.12.2006 Trojan.Mybot-7408
DrWeb 4.33 11.13.2006 Win32.HLLW.MyBot.based
eTrust-InoculateIT 23.73.53 11.13.2006 no virus found
eTrust-Vet 30.3.3190 11.13.2006 no virus found
Ewido 4.0 11.12.2006 Backdoor.Rbot
Fortinet 2.82.0.0 11.13.2006 W32/RBot!tr.bdr
F-Prot 3.16f 11.10.2006 security risk named W32/Sdbot.TAV
F-Prot4 4.2.1.29 11.10.2006 W32/Sdbot.TAV
Ikarus 0.2.65.0 11.13.2006 no virus found
Kaspersky 4.0.2.24 11.13.2006 Backdoor.Win32.Rbot.gen
McAfee 4893 11.10.2006 W32/Sdbot.worm.gen.l
Microsoft 1.1609 11.13.2006 Backdoor:Win32/Rbot!9688
NOD32v2 1862 11.10.2006 Win32/Rbot
Norman 5.80.02 11.10.2006 W32/Spybot.APBX
Panda 9.0.0.4 11.12.2006 W32/Sdbot.HKC.worm
Sophos 4.11.0 11.07.2006 W32/Rbot-EEO
TheHacker 6.0.1.117 11.12.2006 Backdoor/Rbot.gen
UNA 1.83 11.10.2006 Backdoor.RBot.75AC
VBA32 3.11.1 11.13.2006 Backdoor.Win32.Rbot.gen
VirusBuster 4.3.15:9 11.12.2006 Worm.Rbot.FCV


Aditional Information
File size: 148480 bytes
MD5: 88961b3de28f88474d4f2bfeb9273bc8
SHA1: 35d94564bfb419b1d6223fe50689a76a5130c766
packers: PELOCK

[Alex_Goodwin]

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 11.14.2006, 07:46:51 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.13.2006 no virus found
Authentium 4.93.8 11.14.2006 no virus found
Avast 4.7.892.0 11.13.2006 no virus found
AVG 386 11.13.2006 Downloader.Zlob.DP
BitDefender 7.2 11.14.2006 Trojan.Downloader.Zlob.AZ
CAT-QuickHeal 8.00 11.13.2006 no virus found
ClamAV devel-20060426 11.13.2006 no virus found
DrWeb 4.33 11.13.2006 Trojan.Popuper
eTrust-InoculateIT 23.73.54 11.14.2006 no virus found
eTrust-Vet 30.3.3192 11.14.2006 no virus found
Ewido 4.0 11.13.2006 no virus found
Fortinet 2.82.0.0 11.14.2006 suspicious
F-Prot 3.16f 11.14.2006 no virus found
F-Prot4 4.2.1.29 11.14.2006 no virus found
Ikarus 0.2.65.0 11.13.2006 no virus found
Kaspersky 4.0.2.24 11.14.2006 no virus found
McAfee 4894 11.13.2006 no virus found
Microsoft 1.1609 11.14.2006 TrojanDownloader:Win32/Zlob!E16C
NOD32v2 1864 11.13.2006 no virus found
Norman 5.80.02 11.13.2006 W32/ZlobNS.gen15
Panda 9.0.0.4 11.13.2006 no virus found
Sophos 4.11.0 11.13.2006 no virus found
TheHacker 6.0.1.117 11.12.2006 no virus found
UNA 1.83 11.13.2006 no virus found
VBA32 3.11.1 11.13.2006 no virus found
VirusBuster 4.3.15:9 11.13.2006 no virus found


Aditional Information
File size: 53952 bytes
MD5: f4a38690c68f913ac16711d4fad40143
SHA1: 07b2f8671f081e360ee5d46e8ef2d6103f4e4046
packers: UPX
packers: UPX, BINARYRES, BINARYRES
packers: UPX

[Alex_Goodwin]

STATUS: FINISHEDComplete scanning result of "__1056", received in VirusTotal at 11.14.2006, 13:18:01 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.14.2006 no virus found
Authentium 4.93.8 11.14.2006 no virus found
Avast 4.7.892.0 11.13.2006 no virus found
AVG 386 11.13.2006 Downloader.Zlob.DP
BitDefender 7.2 11.14.2006 no virus found
CAT-QuickHeal 8.00 11.13.2006 no virus found
ClamAV devel-20060426 11.14.2006 no virus found
DrWeb 4.33 11.14.2006 no virus found
eTrust-InoculateIT 23.73.54 11.14.2006 no virus found
eTrust-Vet 30.3.3192 11.14.2006 no virus found
Ewido 4.0 11.13.2006 no virus found
Fortinet 2.82.0.0 11.14.2006 suspicious
F-Prot 3.16f 11.14.2006 no virus found
F-Prot4 4.2.1.29 11.14.2006 no virus found
Ikarus 0.2.65.0 11.13.2006 no virus found
Kaspersky 4.0.2.24 11.14.2006 no virus found
McAfee 4894 11.13.2006 no virus found
Microsoft 1.1609 11.14.2006 no virus found
NOD32v2 1864 11.13.2006 no virus found
Norman 5.80.02 11.13.2006 W32/ZlobNS.gen15
Panda 9.0.0.4 11.13.2006 no virus found
Sophos 4.11.0 11.13.2006 no virus found
TheHacker 6.0.1.118 11.14.2006 no virus found
UNA 1.83 11.13.2006 no virus found
VBA32 3.11.1 11.13.2006 no virus found
VirusBuster 4.3.15:9 11.13.2006 no virus found


Aditional Information
File size: 54404 bytes
MD5: 64e28183471b0866f84b970f21150825
SHA1: defa6f53ce8f1c8415d3022b9f2fd1bb6f7b0648
packers: UPX
packers: UPX, BINARYRES, BINARYRES
packers: UPX
Берем здесь хттп://www.qualitycodec.com/index.php
2-раза в день обновлялось раньше

[anton_dr]

STATUS: FINISHEDComplete scanning result of "avz00003.dta", received in VirusTotal at 11.14.2006, 14:02:58 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.14.2006 HEUR/Malware
Authentium 4.93.8 11.14.2006 no virus found
Avast 4.7.892.0 11.13.2006 no virus found
AVG 386 11.13.2006 no virus found
BitDefender 7.2 11.14.2006 no virus found
CAT-QuickHeal 8.00 11.14.2006 no virus found
ClamAV devel-20060426 11.14.2006 no virus found
DrWeb 4.33 11.14.2006 no virus found
eTrust-InoculateIT 23.73.54 11.14.2006 no virus found
eTrust-Vet 30.3.3192 11.14.2006 Win32/Goesna
Ewido 4.0 11.13.2006 no virus found
Fortinet 2.82.0.0 11.14.2006 suspicious
F-Prot 3.16f 11.14.2006 no virus found
F-Prot4 4.2.1.29 11.14.2006 no virus found
Ikarus 0.2.65.0 11.13.2006 no virus found
Kaspersky 4.0.2.24 11.14.2006 no virus found
McAfee 4894 11.13.2006 IEPatch
Microsoft 1.1609 11.14.2006 no virus found
NOD32v2 1864 11.13.2006 no virus found
Norman 5.80.02 11.14.2006 no virus found
Panda 9.0.0.4 11.13.2006 no virus found
Sophos 4.11.0 11.13.2006 no virus found
TheHacker 6.0.1.118 11.14.2006 no virus found
UNA 1.83 11.13.2006 no virus found
VBA32 3.11.1 11.13.2006 no virus found
VirusBuster 4.3.15:9 11.13.2006 no virus found

Aditional Information
File size: 93184 bytes
MD5: 8125c37f63328e6ff0cde293f71bfc41

[anton_dr]

AntiVir 7.2.0.39 11.14.2006 TR/Crypt.F.Gen
Authentium 4.93.8 11.14.2006 no virus found
Avast 4.7.892.0 11.13.2006 no virus found
AVG 386 11.13.2006 Win32/PEPatch
BitDefender 7.2 11.14.2006 no virus found
CAT-QuickHeal 8.00 11.14.2006 no virus found
ClamAV devel-20060426 11.14.2006 no virus found
DrWeb 4.33 11.14.2006 Trojan.Spambot
eTrust-InoculateIT 23.73.54 11.14.2006 no virus found
eTrust-Vet 30.3.3192 11.14.2006 no virus found
Ewido 4.0 11.13.2006 no virus found
Fortinet 2.82.0.0 11.14.2006 suspicious
F-Prot 3.16f 11.14.2006 no virus found
F-Prot4 4.2.1.29 11.14.2006 no virus found
Ikarus 0.2.65.0 11.13.2006 no virus found
Kaspersky 4.0.2.24 11.14.2006 no virus found
McAfee 4894 11.13.2006 no virus found
Microsoft 1.1609 11.14.2006 no virus found
NOD32v2 1864 11.13.2006 no virus found
Norman 5.80.02 11.14.2006 W32/Nuwar.gen3
Panda 9.0.0.4 11.13.2006 no virus found
Sophos 4.11.0 11.13.2006 no virus found
TheHacker 6.0.1.118 11.14.2006 no virus found
UNA 1.83 11.13.2006 no virus found
VBA32 3.11.1 11.13.2006 no virus found
VirusBuster 4.3.15:9 11.13.2006 Cryptor.Xorpack.C


Aditional Information
File size: 29022 bytes
MD5: f31c9a75ba9a57e24cf689d43e5ce386
SHA1: 6afe97e7a78bff7ef9f111a964a240932566de1a

[anton_dr]

STATUS: FINISHEDComplete scanning result of "avz00005.dta", received in VirusTotal at 11.14.2006, 14:11:56 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.14.2006 TR/Crypt.F.Gen
Authentium 4.93.8 11.14.2006 no virus found
Avast 4.7.892.0 11.13.2006 no virus found
AVG 386 11.13.2006 Win32/PEPatch
BitDefender 7.2 11.14.2006 no virus found
CAT-QuickHeal 8.00 11.14.2006 no virus found
ClamAV devel-20060426 11.14.2006 no virus found
DrWeb 4.33 11.14.2006 Trojan.Spambot
eTrust-InoculateIT 23.73.54 11.14.2006 no virus found
eTrust-Vet 30.3.3192 11.14.2006 Win32/Sinteri!generic
Ewido 4.0 11.13.2006 no virus found
Fortinet 2.82.0.0 11.14.2006 suspicious
F-Prot 3.16f 11.14.2006 no virus found
F-Prot4 4.2.1.29 11.14.2006 no virus found
Ikarus 0.2.65.0 11.13.2006 no virus found
Kaspersky 4.0.2.24 11.14.2006 no virus found
McAfee 4894 11.13.2006 no virus found
Microsoft 1.1609 11.14.2006 Win32/Vxidl.gen!encrypted
NOD32v2 1864 11.13.2006 probably a variant of Win32/Nuwar
Norman 5.80.02 11.14.2006 W32/Nuwar.gen3
Panda 9.0.0.4 11.13.2006 no virus found
Sophos 4.11.0 11.13.2006 no virus found
TheHacker 6.0.1.118 11.14.2006 no virus found
UNA 1.83 11.13.2006 no virus found
VBA32 3.11.1 11.13.2006 no virus found
VirusBuster 4.3.15:9 11.13.2006 Cryptor.Xorpack.C


Aditional Information
File size: 54110 bytes
MD5: 190a1fa67d27925059c8046d5ab2b42c
SHA1: b8e4859b979d35fc76f91b1b9ac3799dad26ae9d

[mvlab]

STATUS: FINISHEDComplete scanning result of "mobile.exe", received in VirusTotal at 11.15.2006, 1802 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.39 11.15.2006 HEUR/Malware
Authentium 4.93.8 11.14.2006 no virus found
Avast 4.7.892.0 11.15.2006 no virus found
AVG 386 11.15.2006 no virus found
BitDefender 7.2 11.15.2006 BehavesLike:Win32.ExplorerHijack
CAT-QuickHeal 8.00 11.15.2006 TrojanDownloader.Delf.awg
ClamAV devel-20060426 11.15.2006 no virus found
DrWeb 4.33 11.15.2006 Trojan.DownLoader.14869
eTrust-InoculateIT 23.73.56 11.15.2006 no virus found
eTrust-Vet 30.3.3194 11.15.2006 Win32/Areses.AG
Ewido 4.0 11.15.2006 no virus found
Fortinet 2.82.0.0 11.15.2006 suspicious
F-Prot 3.16f 11.15.2006 no virus found
F-Prot4 4.2.1.29 11.14.2006 no virus found
Ikarus 0.2.65.0 11.15.2006 Packer.byDwing
Kaspersky 4.0.2.24 11.15.2006 no virus found
McAfee 4895 11.14.2006 Downloader-AWA
Microsoft 1.1609 11.15.2006 no virus found
NOD32v2 1867 11.15.2006 a variant of Win32/TrojanDownloader.Delf.AJD
Norman 5.80.02 11.15.2006 W32/DLoader.AYFV
Panda 9.0.0.4 11.14.2006 Trj/Xorpix.S
Prevx1 V2 11.15.2006 no virus found
Sophos 4.11.0 11.15.2006 Mal/Packer
TheHacker 6.0.1.119 11.15.2006 no virus found
UNA 1.83 11.14.2006 no virus found
VBA32 3.11.1 11.15.2006 no virus found
VirusBuster 4.3.15:9 11.15.2006 no virus found


Aditional Information
File size: 10739