Исследование антивирусов 4

[Sanja]

STATUS: FINISHEDComplete scanning result of "ogysteo.exe", received in VirusTotal at 11.28.2006, 22:00:01 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.46 11.28.2006 TR/Proxy.Small.DU.16
Authentium 4.93.8 11.27.2006 could be infected with an unknown virus
Avast 4.7.892.0 11.28.2006 no virus found
AVG 386 11.28.2006 Generic2.KKL
BitDefender 7.2 11.28.2006 no virus found
CAT-QuickHeal 8.00 11.28.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 11.28.2006 no virus found
DrWeb 4.33 11.28.2006 Trojan.Spambot
eSafe 7.0.14.0 11.28.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.69 11.28.2006 no virus found
eTrust-Vet 30.3.3219 11.28.2006 no virus found
Ewido 4.0 11.28.2006 no virus found
Fortinet 2.82.0.0 11.28.2006 suspicious
F-Prot 3.16f 11.27.2006 could be infected with an unknown virus
F-Prot4 4.2.1.29 11.27.2006 generic
Ikarus 0.2.65.0 11.28.2006 no virus found
Kaspersky 4.0.2.24 11.28.2006 Trojan-Proxy.Win32.Small.du
McAfee 4906 11.28.2006 no virus found
Microsoft 1.1804 11.28.2006 no virus found
NOD32v2 1887 11.28.2006 probably unknown NewHeur_PE virus
Norman 5.80.02 11.28.2006 no virus found
Panda 9.0.0.4 11.28.2006 Suspicious file
Prevx1 V2 11.28.2006 no virus found
Sophos 4.11.0 11.16.2006 no virus found
TheHacker 6.0.3.124 11.27.2006 no virus found
UNA 1.83 11.28.2006 no virus found
VBA32 3.11.1 11.28.2006 no virus found
VirusBuster 4.3.15:9 11.28.2006 no virus found


STATUS: FINISHEDComplete scanning result of "avz00003.dta", received in VirusTotal at 11.28.2006, 22:00:31 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.46 11.28.2006 no virus found
Authentium 4.93.8 11.27.2006 no virus found
Avast 4.7.892.0 11.28.2006 no virus found
AVG 386 11.28.2006 no virus found
BitDefender 7.2 11.28.2006 no virus found
CAT-QuickHeal 8.00 11.28.2006 no virus found
ClamAV devel-20060426 11.28.2006 no virus found
DrWeb 4.33 11.28.2006 no virus found
eSafe 7.0.14.0 11.28.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.69 11.28.2006 no virus found
eTrust-Vet 30.3.3219 11.28.2006 no virus found
Ewido 4.0 11.28.2006 no virus found
Fortinet 2.82.0.0 11.28.2006 suspicious
F-Prot 3.16f 11.27.2006 no virus found
F-Prot4 4.2.1.29 11.27.2006 no virus found
Ikarus 0.2.65.0 11.28.2006 no virus found
Kaspersky 4.0.2.24 11.28.2006 SpamTool.Win32.Agent.t
McAfee 4906 11.28.2006 no virus found
Microsoft 1.1804 11.28.2006 no virus found
NOD32v2 1887 11.28.2006 no virus found
Norman 5.80.02 11.28.2006 no virus found
Panda 9.0.0.4 11.28.2006 Suspicious file
Prevx1 V2 11.28.2006 no virus found
Sophos 4.11.0 11.16.2006 no virus found
TheHacker 6.0.3.124 11.27.2006 no virus found
UNA 1.83 11.28.2006 no virus found
VBA32 3.11.1 11.28.2006 suspected of Email-Worm.Mydoom.3 (paranoid heuristics)
VirusBuster 4.3.15:9 11.28.2006 no virus found

STATUS: FINISHEDComplete scanning result of "avz00002.dta", received in VirusTotal at 11.28.2006, 22:01:31 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.46 11.28.2006 no virus found
Authentium 4.93.8 11.27.2006 no virus found
Avast 4.7.892.0 11.28.2006 Win32:Trojano-CS
AVG 386 11.28.2006 no virus found
BitDefender 7.2 11.28.2006 no virus found
CAT-QuickHeal 8.00 11.28.2006 no virus found
ClamAV devel-20060426 11.28.2006 no virus found
DrWeb 4.33 11.28.2006 no virus found
eSafe 7.0.14.0 11.28.2006 no virus found
eTrust-InoculateIT 23.73.69 11.28.2006 no virus found
eTrust-Vet 30.3.3219 11.28.2006 no virus found
Ewido 4.0 11.28.2006 no virus found
Fortinet 2.82.0.0 11.28.2006 no virus found
F-Prot 3.16f 11.27.2006 no virus found
F-Prot4 4.2.1.29 11.27.2006 no virus found
Ikarus 0.2.65.0 11.28.2006 no virus found
Kaspersky 4.0.2.24 11.28.2006 SpamTool.Win32.Agent.t
McAfee 4906 11.28.2006 no virus found
Microsoft 1.1804 11.28.2006 no virus found
NOD32v2 1887 11.28.2006 no virus found
Norman 5.80.02 11.28.2006 no virus found
Panda 9.0.0.4 11.28.2006 Suspicious file
Prevx1 V2 11.28.2006 no virus found
Sophos 4.11.0 11.16.2006 no virus found
TheHacker 6.0.3.124 11.27.2006 no virus found
UNA 1.83 11.28.2006 SpamTool.Win32.Agent.F918
VBA32 3.11.1 11.28.2006 suspected of Email-Worm.Mydoom.3 (paranoid heuristics)
VirusBuster 4.3.15:9 11.28.2006 no virus found

[DoSTR]

Complete scanning result of "sex_girl_porno.exe", received in VirusTotal at 11.30.2006, 19:58:50 (CET).

Antivirus Version Update Result

AntiVir 7.2.0.46 11.30.2006 HEUR/Crypted
Authentium 4.93.8 11.30.2006 no virus found
Avast 4.7.892.0 11.30.2006 no virus found
AVG 386 11.30.2006 no virus found
BitDefender 7.2 11.30.2006 DeepScan:Generic.PWStealer.CE74FB38
CAT-QuickHeal 8.00 11.30.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 11.30.2006 Trojan.Dropper.Agent-106
DrWeb 4.33 11.30.2006 Trojan.PWS.LDPinch.1217
eSafe 7.0.14.0 11.30.2006 Suspicious Trojan/Worm
eTrust-InoculateIT 23.73.72 11.29.2006 no virus found
eTrust-Vet 30.3.3223 11.30.2006 no virus found
Ewido 4.0 11.30.2006 no virus found
Fortinet 2.82.0.0 11.30.2006 no virus found
F-Prot 3.16f 11.30.2006 no virus found
F-Prot4 4.2.1.29 11.30.2006 no virus found
Ikarus 0.2.65.0 11.30.2006 no virus found
Kaspersky 4.0.2.24 11.30.2006 no virus found
McAfee 4908 11.30.2006 no virus found
Microsoft 1.1804 11.30.2006 Win32/Ldpinch
NOD32v2 1892 11.30.2006 no virus found
Norman 5.80.02 11.30.2006 no virus found
Panda 9.0.0.4 11.30.2006 Suspicious file
Prevx1 V2 11.30.2006 no virus found
Sophos 4.11.0 11.16.2006 no virus found
TheHacker 6.0.3.126 11.29.2006 no virus found
UNA 1.83 11.30.2006 no virus found
VBA32 3.11.1 11.30.2006 MalwareScope.Trojan-PSW.LdPinch.1
VirusBuster 4.3.15:9 11.30.2006 no virus found

Aditional Information
File size: 32256 bytes
MD5: efaee5e926a09506b80ef5fb3de7c757
SHA1: 79dd5e7b32f6de79730503c80a58227a23c2ded9
packers: PECOMPACT
packers: PecBundle, PECompact

[DoSTR]

Complete scanning result of "porno.exe", received in VirusTotal at 11.30.2006, 20:24:54 (CET).

Antivirus Version Update Result

AntiVir 7.2.0.46 11.30.2006 HEUR/Crypted
Authentium 4.93.8 11.30.2006 Possibly a new variant of W32/Threat-HLLSI-based!Maximus
Avast 4.7.892.0 11.30.2006 no virus found
AVG 386 11.30.2006 no virus found
BitDefender 7.2 11.30.2006 no virus found
CAT-QuickHeal 8.00 11.30.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 11.30.2006 no virus found
DrWeb 4.33 11.30.2006 no virus found
eSafe 7.0.14.0 11.30.2006 no virus found
eTrust-InoculateIT 23.73.72 11.29.2006 no virus found
eTrust-Vet 30.3.3223 11.30.2006 no virus found
Ewido 4.0 11.30.2006 no virus found
Fortinet 2.82.0.0 11.30.2006 suspicious
F-Prot 3.16f 11.30.2006 Possibly a new variant of W32/Threat-HLLSI-based!Maximus
F-Prot4 4.2.1.29 11.30.2006 W32/Threat-HLLSI-based!Maximus
Ikarus 0.2.65.0 11.30.2006 no virus found
Kaspersky 4.0.2.24 11.30.2006 no virus found
McAfee 4908 11.30.2006 no virus found
Microsoft 1.1804 11.30.2006 no virus found
NOD32v2 1892 11.30.2006 no virus found
Norman 5.80.02 11.30.2006 no virus found
Panda 9.0.0.4 11.30.2006 Suspicious file
Prevx1 V2 11.30.2006 no virus found
Sophos 4.11.0 11.16.2006 no virus found
TheHacker 6.0.3.126 11.29.2006 no virus found
UNA 1.83 11.30.2006 no virus found
VBA32 3.11.1 11.30.2006 MalwareScope.Trojan-PSW.LdPinch.1
VirusBuster 4.3.15:9 11.30.2006 no virus found

Aditional Information
File size: 14117 bytes
MD5: 612f6149668f3d868b7ea4ce44ab0840
SHA1: 607488ca2164627a9828c9d28eba71afb10f4481
packers: FSG
packers: FSG

[DoSTR]

Complete scanning result of "Smoking.exe", received in VirusTotal at 12.01.2006, 15:23:24 (CET).

Antivirus Version Update Result

AntiVir 7.2.0.46 12.01.2006 HEUR/Crypted
Authentium 4.93.8 11.30.2006 no virus found
Avast 4.7.892.0 12.01.2006 Win32:Ldpinch-AH
AVG 386 12.01.2006 no virus found
BitDefender 7.2 12.01.2006 no virus found
CAT-QuickHeal 8.00 11.30.2006 no virus found
ClamAV devel-20060426 12.01.2006 no virus found
DrWeb 4.33 12.01.2006 BACKDOOR.PWS.Trojan
eSafe 7.0.14.0 11.30.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.73 12.01.2006 no virus found
eTrust-Vet 30.3.3225 12.01.2006 no virus found
Ewido 4.0 12.01.2006 no virus found
Fortinet 2.82.0.0 12.01.2006 no virus found
F-Prot 3.16f 11.30.2006 no virus found
F-Prot4 4.2.1.29 11.30.2006 no virus found
Ikarus 0.2.65.0 12.01.2006 no virus found
Kaspersky 4.0.2.24 12.01.2006 no virus found
McAfee 4908 11.30.2006 no virus found
Microsoft 1.1804 12.01.2006 no virus found
NOD32v2 1892 11.30.2006 a variant of Win32/PSW.LdPinch.RG
Norman 5.80.02 12.01.2006 no virus found
Panda 9.0.0.4 12.01.2006 Suspicious file
Prevx1 V2 12.01.2006 no virus found
Sophos 4.12.0 12.01.2006 no virus found
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.127 12.01.2006 no virus found
UNA 1.83 11.30.2006 no virus found
VBA32 3.11.1 11.30.2006 MalwareScope.Trojan-PSW.LdPinch.1
VirusBuster 4.3.15:9 11.30.2006 no virus found

Aditional Information
File size: 172544 bytes
MD5: 85c75dbf1e460d11249d038244767798
SHA1: 7e2c9aef24cc213be92f2227dd8d0f44a22f760f
packers: UPX
packers: UPX
packers: UPX
packers: UPX

[Ego1st]

File: Поговорим-ка_v2.1.exe
Status: INFECTED/MALWARE
MD5 5c97a32f094c8dba7380749bf555cb9a
Packers detected: NSPACK
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found BehavesLike:Trojan.FirewallBypass (probable variant)
ClamAV Found nothing
Dr.Web Found Trojan.PWS.LDPinch.1338
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found Trojan-Dropper.Win32.Agent.azx
NOD32 Found nothing
Norman Virus Control Found nothing
VirusBuster Found nothing
VBA32 Found Trojan.MulDrop.4393

[santy]

Complete scanning result of "new_version_stration_.rar", received in VirusTotal at 12.05.2006, 06:07:05 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.46 12.04.2006 TR/Dldr.Stration.Gen
Authentium 4.93.8 12.04.2006 W32/Warezov.gen4
Avast 4.7.892.0 12.04.2006 no virus found
AVG 386 12.05.2006 I-Worm/Stration
BitDefender 7.2 12.05.2006 Win32.Warezov.FF@mm
CAT-QuickHeal 8.00 12.04.2006 no virus found
ClamAV devel-20060426 12.05.2006 Worm.Stration.WZ
DrWeb 4.33 12.04.2006 no virus found
eSafe 7.0.14.0 12.03.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.76 12.05.2006 no virus found
eTrust-Vet 30.3.3230 12.04.2006 no virus found
Ewido 4.0 12.04.2006 no virus found
Fortinet 2.82.0.0 12.05.2006 W32/Stration.DS@mm
F-Prot 3.16f 12.04.2006 W32/Warezov.gen4
F-Prot4 4.2.1.29 12.04.2006 W32/Warezov.gen3!W32DL
Ikarus 1.0.26 12.04.2006 Email-Worm.Win32.Warezov.gen
Kaspersky 4.0.2.24 12.05.2006 no virus found
McAfee 4910 12.04.2006 no virus found
Microsoft 1.1804 12.05.2006 no virus found
NOD32v2 1900 12.05.2006 a variant of Win32/Stration
Norman 5.80.02 12.04.2006 no virus found
Panda 9.0.0.4 12.03.2006 no virus found
Prevx1 V2 12.05.2006 no virus found
Sophos 4.12.0 12.04.2006 no virus found
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.128 12.04.2006 no virus found
UNA 1.83 12.04.2006 no virus found
VBA32 3.11.1 12.04.2006 no virus found
VirusBuster 4.3.15:9 12.04.2006 no virus found

Aditional Information
File size: 28098 bytes
MD5: 206bd01c2093cd76b496cc477188f938
SHA1: 000133c1969ff6e3e52c65c8c140976ba4b045bc
packers: UPX
packers: UPX
packers: UPX
packers: UPX, embedded

[santy]

Complete scanning result of "new_virus.rar", received in VirusTotal at 12.05.2006, 11:57:17 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.46 12.05.2006 TR/Dldr.Stration.Gen
Authentium 4.93.8 12.04.2006 W32/Warezov.gen4
Avast 4.7.892.0 12.05.2006 Win32:Warezov-QS
AVG 386 12.05.2006 I-Worm/Stration
BitDefender 7.2 12.05.2006 Dropped:Win32.Warezov.DO@mm
CAT-QuickHeal 8.00 12.04.2006 no virus found
ClamAV devel-20060426 12.05.2006 Worm.Stration.XB
DrWeb 4.33 12.05.2006 Win32.HLLM.Limar.based
eSafe 7.0.14.0 12.03.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.76 12.05.2006 no virus found
eTrust-Vet 30.3.3232 12.05.2006 no virus found
Ewido 4.0 12.04.2006 no virus found
Fortinet 2.82.0.0 12.05.2006 W32/Stration.DS@mm
F-Prot 3.16f 12.04.2006 W32/Warezov.gen4
F-Prot4 4.2.1.29 12.04.2006 W32/Warezov.gen3!W32DL
Ikarus T3.1.0.26 12.04.2006 Email-Worm.Win32.Warezov.gen
Kaspersky 4.0.2.24 12.05.2006 no virus found
McAfee 4910 12.04.2006 no virus found
Microsoft 1.1804 12.05.2006 no virus found
NOD32v2 1901 12.05.2006 a variant of Win32/Stration
Norman 5.80.02 12.04.2006 no virus found
Panda 9.0.0.4 12.05.2006 no virus found
Prevx1 V2 12.05.2006 no virus found
Sophos 4.12.0 12.04.2006 no virus found
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.129 12.05.2006 no virus found
UNA 1.83 12.04.2006 no virus found
VBA32 3.11.1 12.05.2006 Email-Worm.Win32.Warezov.fb
VirusBuster 4.3.15:9 12.05.2006 no virus found

Aditional Information
File size: 28019 bytes
MD5: 0540ecb170ffc420ed78352ffc0a796a
SHA1: 44c51bfce5cf5c43fca58bc2af478bb57c13c598
packers: UPX
packers: UPX
packers: UPX
packers: UPX
packers: UPX, embedded

[Winsent]

Complete scanning result of "setup.rar", received in VirusTotal at 12.05.2006, 18:23:52 (CET).


Antivirus Version Update Result

AntiVir 7.2.0.49 12.05.2006 no virus found
Authentium 4.93.8 12.04.2006 W32/Methodbod.gen2
Avast 4.7.892.0 12.05.2006 no virus found
AVG 386 12.05.2006 no virus found
BitDefender 7.2 12.05.2006 DeepScan:Generic.Horst.7162EBF0
CAT-QuickHeal 8.00 12.05.2006 no virus found
ClamAV devel-20060426 12.05.2006 Trojan.Medbot-98
DrWeb 4.33 12.05.2006 no virus found
eSafe 7.0.14.0 12.03.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.76 12.05.2006 no virus found
eTrust-Vet 30.3.3232 12.05.2006 no virus found
Ewido 4.0 12.05.2006 no virus found
Fortinet 2.82.0.0 12.05.2006 no virus found
F-Prot 3.16f 12.04.2006 W32/Methodbod.gen2
F-Prot4 4.2.1.29 12.04.2006 W32/Methodbod.gen2
Ikarus T3.1.0.26 12.05.2006 no virus found
Kaspersky 4.0.2.24 12.05.2006 no virus found
McAfee 4911 12.05.2006 no virus found
Microsoft 1.1804 12.05.2006 no virus found
NOD32v2 1902 12.05.2006 no virus found
Norman 5.80.02 12.05.2006 no virus found
Panda 9.0.0.4 12.05.2006 Suspicious file
Prevx1 V2 12.05.2006 no virus found
Sophos 4.12.0 12.04.2006 Mal/Behav-080
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.129 12.05.2006 Trojan/Horst.gen
UNA 1.83 12.04.2006 no virus found
VBA32 3.11.1 12.05.2006 MalwareScope.Trojan-Proxy.Horst.1
VirusBuster 4.3.15:9 12.05.2006 no virus found

Aditional Information
File size: 42447 bytes
MD5: ee7b10cc7b235464c1b04cd5496b8e9a
SHA1: 6bb14eac48de8a4a7e3e8c9f556ebcee855eaf49
packers: UPX
packers: UPX
packers: UPX
packers: UPX

[DoSTR]

Complete scanning result of "NEW_WinRAR_KG3.61.exe", received in VirusTotal at 12.06.2006, 07:39:00 (CET).

Antivirus Version Update Result

AntiVir 7.2.0.49 12.06.2006 no virus found
Authentium 4.93.8 12.05.2006 no virus found
Avast 4.7.892.0 12.05.2006 no virus found
AVG 386 12.05.2006 no virus found
BitDefender 7.2 12.06.2006 no virus found
CAT-QuickHeal 8.00 12.05.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 12.06.2006 no virus found
DrWeb 4.33 12.05.2006 Trojan.MulDrop.4153
eSafe 7.0.14.0 12.03.2006 Win32.Polipos.sus
eTrust-InoculateIT 23.73.78 12.06.2006 no virus found
eTrust-Vet 30.3.3234 12.06.2006 no virus found
Ewido 4.0 12.05.2006 no virus found
Fortinet 2.82.0.0 12.06.2006 suspicious
F-Prot 3.16f 12.05.2006 no virus found
F-Prot4 4.2.1.29 12.05.2006 no virus found
Ikarus T3.1.0.26 12.05.2006 no virus found
Kaspersky 4.0.2.24 12.06.2006 no virus found
McAfee 4911 12.05.2006 no virus found
Microsoft 1.1804 12.06.2006 no virus found
NOD32v2 1903 12.05.2006 no virus found
Norman 5.80.02 12.05.2006 no virus found
Panda 9.0.0.4 12.06.2006 Suspicious file
Prevx1 V2 12.06.2006 no virus found
Sophos 4.12.0 12.05.2006 no virus found
Sunbelt 2.2.907.0 11.30.2006 VIPRE.Suspicious
TheHacker 6.0.3.129 12.05.2006 no virus found
UNA 1.83 12.05.2006 no virus found
VBA32 3.11.1 12.05.2006 suspected of Trojan-PSW.LdPinch.38 (paranoid heuristics)
VirusBuster 4.3.15:9 12.05.2006 no virus found

Aditional Information
File size: 189952 bytes
MD5: 9198d755fcfb18f1a92f083635af07cb
SHA1: ac6d98b208e3378d072ff296d7e8dbcc47dde955
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

[Winsent]

Complete scanning result of "setup.exe", received in VirusTotal at 12.06.2006, 18:07:32 (CET).


Antivirus Version Update Result

AntiVir 7.2.0.49 12.06.2006 no virus found
Authentium 4.93.8 12.05.2006 W32/Methodbod.gen2
Avast 4.7.892.0 12.06.2006 no virus found
AVG 386 12.06.2006 no virus found
BitDefender 7.2 12.06.2006 DeepScan:Generic.Horst.831BFB7F
CAT-QuickHeal 8.00 12.05.2006 no virus found
ClamAV devel-20060426 12.06.2006 Trojan.Medbot-98
DrWeb 4.33 12.06.2006 no virus found
eSafe 7.0.14.0 12.06.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.78 12.06.2006 no virus found
eTrust-Vet 30.3.3234 12.06.2006 no virus found
Ewido 4.0 12.06.2006 no virus found
Fortinet 2.82.0.0 12.06.2006 no virus found
F-Prot 3.16f 12.05.2006 W32/Methodbod.gen2
F-Prot4 4.2.1.29 12.05.2006 W32/Methodbod.gen2
Ikarus T3.1.0.26 12.05.2006 no virus found
Kaspersky 4.0.2.24 12.06.2006 no virus found
McAfee 4911 12.05.2006 no virus found
Microsoft 1.1804 12.06.2006 no virus found
NOD32v2 1904 12.06.2006 no virus found
Norman 5.80.02 12.05.2006 W32/Malware
Panda 9.0.0.4 12.06.2006 Suspicious file
Prevx1 V2 12.06.2006 no virus found
Sophos 4.12.0 12.06.2006 Mal/Behav-080
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.130 12.06.2006 Trojan/Horst.gen
UNA 1.83 12.05.2006 no virus found
VBA32 3.11.1 12.05.2006 MalwareScope.Trojan-Proxy.Horst.1
VirusBuster 4.3.15:9 12.05.2006 no virus found

Aditional Information
File size: 44544 bytes
MD5: 0667b2142eae7afe013cad02fbbbb5ce
SHA1: 3847537d3e55487fc7fddddea509508e38f7b81e
packers: UPX
packers: UPX
packers: UPX
packers: UPX
norman sandbox: [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: [email protected] - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* Decompressing UPX.
* File length: 44544 bytes.

[ Process/window information ]
* Modifies other process memory.
* Modifies execution flow of a remote process.

[NickGolovko]

Scanner results
AntiVir Found Heuristic/Malware (probable variant)
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found BACKDOOR.Trojan, BackDoor.Pomax (probable variant)
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
VirusBuster Found nothing
VBA32 Found Embedded.Trojan-Spy.Win32.Small.gm (probable variant)

[kvit]

Только что пришел по почте... Хотя на свежатину не похож...

Complete scanning result of "__1056", received in VirusTotal at 12.07.2006, 10:48:49 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.49 12.07.2006 TR/Dldr.Tiny.BM.50
Authentium 4.93.8 12.07.2006 W32/Downloader.AUDX
Avast 4.7.892.0 12.06.2006 no virus found
AVG 386 12.07.2006 Downloader.Generic2.ZWH
BitDefender 7.2 12.07.2006 Trojan.Downloader.Tiny.BM
CAT-QuickHeal 8.00 12.06.2006 TrojanDownloader.Tiny.bm
ClamAV devel-20060426 12.07.2006 Trojan.Downloader-13
DrWeb 4.33 12.07.2006 Trojan.DownLoader.15512
eSafe 7.0.14.0 12.06.2006 no virus found
eTrust-InoculateIT 23.73.79 12.07.2006 Win32/NordDL.1lx!Trojan
eTrust-Vet 30.3.3236 12.07.2006 Win32/Ohbeeb.AA
Ewido 4.0 12.07.2006 Downloader.Tiny.bm
Fortinet 2.82.0.0 12.07.2006 W32/Tiny.BM!tr.dldr
F-Prot 3.16f 12.05.2006 security risk named W32/Downloader.AUDX
F-Prot4 4.2.1.29 12.05.2006 W32/Downloader.AUDX
Ikarus T3.1.0.26 12.07.2006 Trojan-Downloader.Small.CBF
Kaspersky 4.0.2.24 12.07.2006 Trojan-Downloader.Win32.Tiny.bm
McAfee 4912 12.07.2006 no virus found
Microsoft 1.1804 12.07.2006 no virus found
NOD32v2 1906 12.07.2006 Win32/TrojanDownloader.Tiny.NBR
Norman 5.80.02 12.06.2006 W32/Tiny.SV
Panda 9.0.0.4 12.07.2006 no virus found
Prevx1 V2 12.07.2006 Downloader.Drev.A
Sophos 4.12.0 12.06.2006 Troj/Tiny-BT
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.130 12.06.2006 no virus found
UNA 1.83 12.06.2006 TrojanDownloader.Win32.Tiny.8DEF
VBA32 3.11.1 12.06.2006 Trojan-Downloader.Win32.Tiny.bm
VirusBuster 4.3.15:9 12.06.2006 Trojan.DL.Tiny.DK


Aditional Information
File size: 2560 bytes
MD5: 14425bb89f6d2b448b28cd1ccf4d9f8b
SHA1: 995c776401c5ef3578e1a1bdd29a9132b90d1589
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=a26e59461175

[Winsent]

Complete scanning result of "setup.exe", received in VirusTotal at 12.07.2006, 14:06:37 (CET).


Antivirus Version Update Result

AntiVir 7.2.0.49 12.07.2006 no virus found
Authentium 4.93.8 12.07.2006 W32/Methodbod.gen2
Avast 4.7.892.0 12.07.2006 no virus found
AVG 386 12.07.2006 no virus found
BitDefender 7.2 12.07.2006 DeepScan:Generic.Horst.FBC6323B
CAT-QuickHeal 8.00 12.06.2006 no virus found
ClamAV devel-20060426 12.07.2006 Trojan.Medbot-98
DrWeb 4.33 12.07.2006 no virus found
eSafe 7.0.14.0 12.06.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.79 12.07.2006 no virus found
eTrust-Vet 30.3.3236 12.07.2006 no virus found
Ewido 4.0 12.07.2006 no virus found
Fortinet 2.82.0.0 12.07.2006 no virus found
F-Prot 3.16f 12.05.2006 W32/Methodbod.gen2
F-Prot4 4.2.1.29 12.05.2006 W32/Methodbod.gen2
Ikarus T3.1.0.26 12.07.2006 no virus found
Kaspersky 4.0.2.24 12.07.2006 no virus found
McAfee 4912 12.07.2006 no virus found
Microsoft 1.1804 12.07.2006 no virus found
NOD32v2 1907 12.07.2006 no virus found
Norman 5.80.02 12.06.2006 W32/Malware
Panda 9.0.0.4 12.07.2006 Suspicious file
Prevx1 V2 12.07.2006 no virus found
Sophos 4.12.0 12.06.2006 Mal/Behav-080
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.130 12.06.2006 Trojan/Horst.gen
UNA 1.83 12.06.2006 no virus found
VBA32 3.11.1 12.06.2006 MalwareScope.Trojan-Proxy.Horst.1
VirusBuster 4.3.15:9 12.06.2006 no virus found

Aditional Information
File size: 44544 bytes
MD5: 1722a1dc5186cdf52465245a5fb76cba
SHA1: 55157c41e7064161961298c5441c88cd119c1cda
packers: UPX
packers: UPX
packers: UPX
packers: UPX
norman sandbox: [ General information ]
* **IMPORTANT: PLEASE SEND THE SCANNED FILE TO: [email protected] - REMEMBER TO ENCRYPT IT (E.G. ZIP WITH PASSWORD)**.
* Decompressing UPX.
* File length: 44544 bytes.

[ Process/window information ]
* Modifies other process memory.
* Modifies execution flow of a remote process.

[DoSTR]

Благодарю 2jocke2 за предоставленный образец
Complete scanning result of "zAskop.dll", received in VirusTotal at 12.07.2006, 14:54:22 (CET).

Antivirus Version Update Result

AntiVir 7.2.0.49 12.07.2006 TR/Spy.Agent.AAE.1
Authentium 4.93.8 12.07.2006 no virus found
Avast 4.7.892.0 12.07.2006 Win32:Small-BKI
AVG 386 12.07.2006 PSW.Generic2.SDM
BitDefender 7.2 12.07.2006 Generic.Malware.SFMdld.0099442E
CAT-QuickHeal 8.00 12.06.2006 no virus found
ClamAV devel-20060426 12.07.2006 no virus found
DrWeb 4.33 12.07.2006 Trojan.Spambot
eSafe 7.0.14.0 12.07.2006 no virus found
eTrust-InoculateIT 23.73.79 12.07.2006 no virus found
eTrust-Vet 30.3.3236 12.07.2006 Win32/Meldsimp!generic
Ewido 4.0 12.07.2006 no virus found
Fortinet 2.82.0.0 12.07.2006 no virus found
F-Prot 3.16f 12.05.2006 no virus found
F-Prot4 4.2.1.29 12.05.2006 no virus found
Ikarus T3.1.0.26 12.07.2006 no virus found
Kaspersky 4.0.2.24 12.07.2006 no virus found
McAfee 4912 12.07.2006 no virus found
Microsoft 1.1804 12.07.2006 no virus found
NOD32v2 1907 12.07.2006 probably a variant of Win32/Spy.Small.DP
Norman 5.80.02 12.07.2006 no virus found
Panda 9.0.0.4 12.07.2006 Trj/Agysteo.B
Prevx1 V2 12.07.2006 no virus found
Sophos 4.12.0 12.06.2006 no virus found
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.130 12.06.2006 no virus found
UNA 1.83 12.06.2006 no virus found
VBA32 3.11.1 12.06.2006 suspected of Backdoor.xBot.1 (paranoid heuristics)
VirusBuster 4.3.15:9 12.06.2006 no virus found

Aditional Information
File size: 13824 bytes
MD5: 41d48c0c2defce2294855c766401127f
SHA1: a0c0d338877bf61a3eb8f0d13599b8a8b70dc644
packers: UPX
packers: UPX
packers: UPX
packers: UPX

[Winsent]

Complete scanning result of "setup.exe", received in VirusTotal at 12.08.2006, 08:52:36 (CET).


Antivirus Version Update Result

AntiVir 7.2.0.49 12.08.2006 no virus found
Authentium 4.93.8 12.07.2006 W32/Methodbod.gen2
Avast 4.7.892.0 12.07.2006 no virus found
AVG 386 12.07.2006 no virus found
BitDefender 7.2 12.08.2006 DeepScan:Generic.Horst.FF530EE6
CAT-QuickHeal 8.00 12.07.2006 no virus found
ClamAV devel-20060426 12.08.2006 Trojan.Medbot-98
DrWeb 4.33 12.08.2006 no virus found
eSafe 7.0.14.0 12.07.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.80 12.08.2006 no virus found
eTrust-Vet 30.3.3238 12.08.2006 no virus found
Ewido 4.0 12.07.2006 no virus found
Fortinet 2.82.0.0 12.08.2006 no virus found
F-Prot 3.16f 12.07.2006 W32/Methodbod.gen2
F-Prot4 4.2.1.29 12.07.2006 W32/Methodbod.gen2
Ikarus T3.1.0.26 12.07.2006 no virus found
Kaspersky 4.0.2.24 12.08.2006 no virus found
McAfee 4913 12.07.2006 BackDoor-CMQ.gen
Microsoft 1.1804 12.08.2006 no virus found
NOD32v2 1909 12.07.2006 no virus found
Norman 5.80.02 12.07.2006 W32/Horst.gen14
Panda 9.0.0.4 12.08.2006 Suspicious file
Prevx1 V2 12.08.2006 no virus found
Sophos 4.12.0 12.06.2006 Mal/Behav-080
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.130 12.06.2006 Trojan/Horst.gen
UNA 1.83 12.07.2006 no virus found
VBA32 3.11.1 12.07.2006 MalwareScope.Trojan-Proxy.Horst.1
VirusBuster 4.3.15:9 12.07.2006 no virus found

Aditional Information
File size: 44032 bytes
MD5: 13b3e0b604f4eac38ee519cb5aa08e35
SHA1: fd10382f34177e0b92247560d3288edac0b5eae8
packers: UPX
packers: UPX
packers: UPX
packers: UPX

[Синауридзе Александр]

Complete scanning result of "___1051", received in VirusTotal at 12.08.2006, 14:27:43 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.49 12.08.2006 no virus found
Authentium 4.93.8 12.07.2006 no virus found
Avast 4.7.892.0 12.07.2006 no virus found
AVG 386 12.08.2006 no virus found
BitDefender 7.2 12.08.2006 no virus found
CAT-QuickHeal 8.00 12.07.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 12.08.2006 no virus found
DrWeb 4.33 12.08.2006 no virus found
eSafe 7.0.14.0 12.07.2006 no virus found
eTrust-InoculateIT 23.73.80 12.08.2006 no virus found
eTrust-Vet 30.3.3238 12.08.2006 no virus found
Ewido 4.0 12.08.2006 no virus found
Fortinet 2.82.0.0 12.08.2006 no virus found
F-Prot 3.16f 12.07.2006 no virus found
F-Prot4 4.2.1.29 12.07.2006 no virus found
Ikarus T3.1.0.26 12.07.2006 Trojan-Downloader.Win32.Banload.rf
Kaspersky 4.0.2.24 12.08.2006 no virus found
McAfee 4913 12.07.2006 no virus found
Microsoft 1.1804 12.08.2006 no virus found
NOD32v2 1910 12.08.2006 probably unknown NewHeur_PE virus
Norman 5.80.02 12.08.2006 no virus found
Panda 9.0.0.4 12.08.2006 Suspicious file
Prevx1 V2 12.08.2006 no virus found
Sophos 4.12.0 12.08.2006 no virus found
Sunbelt 2.2.907.0 11.30.2006 VIPRE.Suspicious
TheHacker 6.0.3.130 12.06.2006 no virus found
UNA 1.83 12.07.2006 no virus found
VBA32 3.11.1 12.07.2006 no virus found
VirusBuster 4.3.15:9 12.07.2006 no virus found

Aditional Information
File size: 333312 bytes
MD5: c7ce45626e59f49002bf533a2b7c7bd4
SHA1: f26cbbe2141eb0ad93d4d00e50a2238a839d7396
packers: PE_Patch, Aspack
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

[Winsent]

Complete scanning result of "setup.exe", received in VirusTotal at 12.08.2006, 18:38:07 (CET).


Antivirus Version Update Result

AntiVir 7.2.0.49 12.08.2006 no virus found
Authentium 4.93.8 12.07.2006 W32/Methodbod.gen2
Avast 4.7.892.0 12.08.2006 no virus found
AVG 386 12.08.2006 no virus found
BitDefender 7.2 12.08.2006 DeepScan:Generic.Horst.5CCDBFEF
CAT-QuickHeal 8.00 12.08.2006 no virus found
ClamAV devel-20060426 12.08.2006 Trojan.Medbot-98
DrWeb 4.33 12.08.2006 no virus found
eSafe 7.0.14.0 12.07.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.80 12.08.2006 no virus found
eTrust-Vet 30.3.3238 12.08.2006 no virus found
Ewido 4.0 12.08.2006 no virus found
Fortinet 2.82.0.0 12.08.2006 no virus found
F-Prot 3.16f 12.07.2006 W32/Methodbod.gen2
F-Prot4 4.2.1.29 12.07.2006 W32/Methodbod.gen2
Ikarus T3.1.0.26 12.07.2006 no virus found
Kaspersky 4.0.2.24 12.08.2006 no virus found
McAfee 4914 12.08.2006 no virus found
Microsoft 1.1804 12.08.2006 no virus found
NOD32v2 1911 12.08.2006 no virus found
Norman 5.80.02 12.08.2006 W32/Horst.gen14
Panda 9.0.0.4 12.08.2006 Suspicious file
Prevx1 V2 12.08.2006 no virus found
Sophos 4.12.0 12.08.2006 Mal/Behav-080
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.130 12.06.2006 Trojan/Horst.gen
UNA 1.83 12.07.2006 no virus found
VBA32 3.11.1 12.08.2006 MalwareScope.Trojan-Proxy.Horst.1
VirusBuster 4.3.15:9 12.08.2006 no virus found

Aditional Information
File size: 44544 bytes
MD5: e8cb9a43e491e5cc592f225371df0a0a
SHA1: ad86ee6cae901b10692635324eceabcc76b04322
packers: UPX
packers: UPX
packers: UPX
packers: UPX

[Winsent]

Complete scanning result of "setup.exe", received in VirusTotal at 12.09.2006, 20:16:30 (CET).


Antivirus Version Update Result

AntiVir 7.2.0.49 12.08.2006 no virus found
Authentium 4.93.8 12.08.2006 W32/Methodbod.gen2
Avast 4.7.892.0 12.08.2006 no virus found
AVG 386 12.09.2006 no virus found
BitDefender 7.2 12.09.2006 DeepScan:Generic.Horst.F09457F2
CAT-QuickHeal 8.00 12.09.2006 no virus found
ClamAV devel-20060426 12.09.2006 Trojan.Medbot-98
DrWeb 4.33 12.09.2006 no virus found
eSafe 7.0.14.0 12.07.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.81 12.09.2006 no virus found
eTrust-Vet 30.3.3238 12.08.2006 no virus found
Ewido 4.0 12.09.2006 no virus found
Fortinet 2.82.0.0 12.09.2006 no virus found
F-Prot 3.16f 12.08.2006 W32/Methodbod.gen2
F-Prot4 4.2.1.29 12.08.2006 W32/Methodbod.gen2
Ikarus T3.1.0.26 12.07.2006 no virus found
Kaspersky 4.0.2.24 12.09.2006 Trojan-Proxy.Win32.Horst.sh
McAfee 4914 12.08.2006 no virus found
NOD32v2 1913 12.09.2006 a variant of Win32/Medbot.DP
Norman 5.80.02 12.08.2006 W32/Horst.gen14
Panda 9.0.0.4 12.09.2006 Suspicious file
Prevx1 V2 12.09.2006 no virus found
Sophos 4.12.0 12.08.2006 Mal/Behav-080
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.130 12.06.2006 Trojan/Horst.gen
UNA 1.83 12.08.2006 no virus found
VBA32 3.11.1 12.09.2006 MalwareScope.Trojan-Proxy.Horst.1
VirusBuster 4.3.15:9 12.09.2006 no virus found

Aditional Information
File size: 44032 bytes
MD5: b2f3daed796da63f74f0d86554931dc6
SHA1: a3bfcda907e914483a2a05d9c7767c4ca60371da
packers: UPX
packers: UPX
packers: UPX
packers: UPX

[Winsent]

Complete scanning result of "Moiseev_ebal_Bilana.exe", received in VirusTotal at 12.11.2006, 02:13:08 (CET).


Antivirus Version Update Result

AntiVir 7.2.0.49 12.10.2006 HEUR/Crypted
Authentium 4.93.8 12.08.2006 no virus found
Avast 4.7.892.0 12.08.2006 no virus found
AVG 386 12.09.2006 no virus found
BitDefender 7.2 12.11.2006 no virus found
CAT-QuickHeal 8.00 12.09.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 12.10.2006 no virus found
DrWeb 4.33 12.10.2006 no virus found
eSafe 7.0.14.0 12.07.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.81 12.09.2006 no virus found
eTrust-Vet 30.3.3238 12.08.2006 no virus found
Ewido 4.0 12.10.2006 no virus found
Fortinet 2.82.0.0 12.11.2006 suspicious
F-Prot 3.16f 12.08.2006 no virus found
F-Prot4 4.2.1.29 12.08.2006 generic
Ikarus T3.1.0.26 12.07.2006 no virus found
Kaspersky 4.0.2.24 12.11.2006 no virus found
McAfee 4915 12.10.2006 no virus found
Microsoft 1.1804 12.10.2006 Win32/Ldpinch
NOD32v2 1913 12.09.2006 no virus found
Norman 5.80.02 12.08.2006 no virus found
Panda 9.0.0.4 12.11.2006 Suspicious file
Prevx1 V2 12.11.2006 no virus found
Sophos 4.12.0 12.10.2006 no virus found
Sunbelt 2.2.907.0 11.30.2006 VIPRE.Suspicious
TheHacker 6.0.3.131 12.10.2006 no virus found
UNA 1.83 12.08.2006 no virus found
VBA32 3.11.1 12.10.2006 MalwareScope.Trojan-PSW.PdPinch.5
VirusBuster 4.3.15:9 12.10.2006 no virus found

Aditional Information
File size: 33268 bytes
MD5: fc3ca9215687f84bf1fb3035e63945fd
SHA1: 3672f81e54cce27aad769d4407b92f520507a3f1
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

[kvit]

Из очередного спама

Complete scanning result of "__1056", received in VirusTotal at 12.11.2006, 05:23:48 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.49 12.10.2006 no virus found
Authentium 4.93.8 12.08.2006 no virus found
Avast 4.7.892.0 12.08.2006 no virus found
AVG 386 12.09.2006 no virus found
BitDefender 7.2 12.11.2006 DeepScan:Generic.Dld.Wmed.E.55D473CD
CAT-QuickHeal 8.00 12.09.2006 no virus found
ClamAV devel-20060426 12.10.2006 no virus found
DrWeb 4.33 12.10.2006 Trojan.DownLoader.15754
eSafe 7.0.14.0 12.07.2006 no virus found
eTrust-InoculateIT 23.73.81 12.09.2006 no virus found
eTrust-Vet 30.3.3238 12.08.2006 no virus found
Ewido 4.0 12.10.2006 no virus found
Fortinet 2.82.0.0 12.11.2006 no virus found
F-Prot 3.16f 12.08.2006 no virus found
F-Prot4 4.2.1.29 12.08.2006 no virus found
Ikarus T3.1.0.26 12.07.2006 no virus found
Kaspersky 4.0.2.24 12.11.2006 Trojan-Downloader.Win32.Donn.ae
McAfee 4915 12.10.2006 no virus found
Microsoft 1.1804 12.10.2006 no virus found
NOD32v2 1913 12.09.2006 no virus found
Norman 5.80.02 12.08.2006 no virus found
Panda 9.0.0.4 12.11.2006 no virus found
Prevx1 V2 12.11.2006 Win32.Malware.gen
Sophos 4.12.0 12.10.2006 no virus found
Sunbelt 2.2.907.0 11.30.2006 no virus found
TheHacker 6.0.3.131 12.10.2006 no virus found
UNA 1.83 12.08.2006 no virus found
VBA32 3.11.1 12.10.2006 no virus found
VirusBuster 4.3.15:9 12.10.2006 no virus found

Aditional Information
File size: 3584 bytes
MD5: fd42667ea6e265a87eb0e57177fb1890
SHA1: 352ef85eb8607b1c5323012caed3d589eb2dfb13
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=5ac261384280