Avast does not detect Backdoor.Win32.Simda aka DR/Delphi.Gen5 here?

Viruses and worms
1

See: http://zulu.zscaler.com/submission/show/56301a511b289502de9ac26664aac1aa-1340608914
and
https://www.virustotal.com/url/6e96f1ea2cc48fa6fcc777c426b847699dd92dfdb334c9b8e7851a386ae51f0a/analysis/1340608959/
Scam site related to the Ph*rmalert malcode campaign.
See: http://minotauranalysis.com/search.aspx?q=aa79d443209acb1d6ccdc8d4dc3f0d0e

See IDS alerts here: http://urlquery.net/report.php?id=74875
for:
ET CURRENT_EVENTS DRIVEBY Blackhole - Payload Download - scandsk.ex-
&
ET RBN Known Russian Business Network IP (190)

avast does not detect, so reported to virus AT avast dot com,

polonus

2

Avast should detect these as Win32:Dropper-CQB [Drp],
another live one undetected here: http://urlquery.net/queued.php?id=74881 (missed there)
See: http://camas.comodo.com/cgi-bin/submit?file=e621bfadeb665f907d8788e64c86999dc291dd951fd98679491165a6ded7dcb7
Avast had detection for it here, 2 months ago: https://www.virustotal.com/file/73845ac79a71cdf61b93edc5ea2682b95ebea1e90f2b577b7f3e3bbe1fc7f849/analysis/

polonus

3

the first one…

VirusTotal
https://www.virustotal.com/file/a3ef8978c9432f4c9e4ba9e021d32293c8a57b1fb6407dc1bf7afefa89a75535/analysis/1340610620/

and second…

VirusTotal
https://www.virustotal.com/file/e621bfadeb665f907d8788e64c86999dc291dd951fd98679491165a6ded7dcb7/analysis/1340610835/

4

Hi Pondus,

Thanx again, Pondus, for following this up and checking my observations.
As always you are busy to improve av detection in general and avast av detection in particular,

polonus

5

:wink: … if you have more i will have a look later…at work now