Avast didn,t detect few things.

Viruses and worms
1

HI :slight_smile:

How are you?

hXXp://1job1.cn/us4/us4.exe=Avast blocks this URL but I sent this file to VT(http://www.virustotal.com/sl/analisis/fe4cf687a3569d51bdefdfa78070254b9f74a950124df866342f9e0e67da0cbf-1257696884 )

hxxp://213.108.56.140/pr/pic/build.exe…Virustotal:http://www.virustotal.com/sl/analisis/2f84dcc0c017c2f04656a96700d9357ac7d23b8866d27eb887b7f87929bcf352-1257797812

hxxp://stortfordaircadets.org.uk/flash/exe.exe=Avast blocks this URL but I sent this file to VT: http://www.virustotal.com/sl/analisis/22e5542569911f89a87f010b4219a59e84fd9855bafd41a7e0cc3c391cd0aaa4-1257695506

hxxp://crferari.info/load/1256760719.exe—http://www.virustotal.com/analisis/05ccf7ce40130d863fd6be962b300aa8f9046fec01796c132ed3295a71998b5a-1257675298

hxxp://raktor.net/exeHelper/exeHelper.com-----http://www.virustotal.com/analisis/cc4e515bcfcf2a6b23bb886d8d073b3f488ef64c054136f61833d1d3e11097ca-1257761988

hxxp://morde.su/zevs/bot.exe----http://www.virustotal.com/analisis/a677c4b43d088190d13714c81e210b3704df96a5b10827f21b8b0c7e25db589e-1257762067

hxxp://kwtoolbar.com/modlueol/rwgnhan/ixjsysr4.exe----http://www.virustotal.com/analisis/35fa30f138a6ad8d3ac1eaeab86a2474b70603a03201097e9cfd588514cb94fa-1257860443

2

Hello JuninhoSlo,

Did you get these from mdl?

nmb

3

I checked just one of your links against Web page security report and bingo:
stortfordaircadets dot org dot uk
Last time suspicious content was found to reside there was 2009-11-10.
Malicious software includes 208 exploits, 187 trojans.

This site was hosted on 1 network including AS13213 (UK2NET).

This site has functioned to redirect to malware. Yes, it did infect 48 sites, e.g. cacherstats.com/, theserviceadvisor.com/, regionaltimes.com/

The next one I checked was for the present status of crferari dot info?
This site is known to be suspicious and can seriously damage your computer.

Part of this site has been seen to perform suspicious activities.
This site has been hosting malcode and this malicious software has been infecting 15 domains, e.g. carperformanceuk.co.uk/, shefa-amr.com/, sugarcreekgardens.com/.

For the rest of the links see: http://www.unmaskparasites.com/security-report/
The sites apparently were hacked and redirecting to malcode all sorts,
the avast webshield has intervened and disconnected before the malcode could be loaded,
at least it dhould have. Did you have the webshield active and did it alert?

polonus

4

google chrome did a good job it doesnt allow me to visit those sites,but i go there,hehehe

5

Hi superhacker,

If google chrome does not allow you to go to these sites or firekeeper or WOT or DrWeb av linkchecker or finjan, why would you go to these sites anyway if you know they are at least suspicious, could infect you or could have a bad reputation that could produce trouble - BIG QUESTION MARK ?
If I know in advance that I should not go to an alley because I could be struck over the head with a club I would not venture out there in the first place. Beter safe than sorry!
Or do you visit the links via a proxy which filters the bad bits out or use NoScript with RequestPolicy to be secure?

POLONUS

6

agreed; there’s nothing heroic visiting some bad sites.

7

HI :slight_smile:

Avast has blocked all sites … but than I close Avast protection and sent file to VT.
I just want improve Avast detection. :wink:

Thx and have a nice day. :slight_smile:

8

Hi JuninhoSlo,

All the best to you too,

pozdravi,

polonus

9

Hi,
thank you, samples will be added to VPS, but the file “exeHelper.com” don’t look malicious, but contrary tries to remove some infection (files and registry keys).

Milos

10

why i go there?
1.it is good to know how is your enemy"malware creators"think.
2.i was bored and i like to get a virus to analyze it and make its small anti virus.
3.i dont think i am going to get infect"and if i"it is a VM SO i wont get really infected.
4.it is a test pc not my maine one so,there is no danger.
5.malwares cant C me,my time is now,follow John Cena “i am kidding”