Avast does not detect daidai worm or is this a PUP? [SOLVED]

Viruses and worms
1

https://www.virustotal.com/nl/file/d80c76d0cff1b2434eb67bb3a480d6c1c9e44c6cbf49dabf1429c4db99f782db/analysis/
see: http://www.malwarepatrol.net/cgi/search.pl?id=VHJvamFuLldpbjMyLlN0YXJ0UGFnZS5iYWxm
→ http://urlquery.net/report.php?id=2117627 ET POLICY PE EXE or DLL Windows file download IDS alert

polonus

P.S. Is on DrWeb’s malicious sites list →
htxp://x.uzzf.com/daidaiworm.exe is in Dr.Web malicious sites list!

Checking:htxp://x.uzzf.com/daidaiworm.exe
Engine version:7.0.4.9250
Total virus-finding records:3882680
File size:1.19 MB
File MD5:6cf0636f8b24e1df515141282936acb6

htxp://x.uzzf.com/daidaiworm.exe - archive RAR

htxp://x.uzzf.com/daidaiworm.exe/daidaiworm\index.reg - Ok
htxp://x.uzzf.com/daidaiworm.exe/daidaiworm\MD5SUM - Ok
hxtp://x.uzzf.com/daidaiworm.exe/daidaiworm\worm1004.exe - Ok
htxp://x.uzzf.com/daidaiworm.exe - Ok

2

Also see: http://threatcenter.crdf.fr/?More&ID=112472&D=CRDF.Trojan.Trojan.Win32.StartPage2100307960
&
http://anubis.iseclab.org/?action=result&task_id=1c7b521468c958ca46159be0fe4bd35e6
nothing here: https://www.virustotal.com/nl/file/715ae7db06b5b91d3909fbc52cc91e14d6c09a1c6051c2f14aceeece83f90161/analysis/
and for this: https://www.virustotal.com/nl/file/715ae7db06b5b91d3909fbc52cc91e14d6c09a1c6051c2f14aceeece83f90161/analysis/
part of Win7 recovery…
But on this threat and the fine tuned snort IDS alerts, read this from Richard Bejtlich’s blog:
http://taosecurity.blogspot.nl/2013/02/recovering-from-suricata-gone-wild.html

polonus

3

avast detects through avast! Web Shield as Win32:StartPage-API[Trj]
We are being protected!

polonus