False negative: phishing not detected

You are right some of the phishing sites do no longer exist or the phish was taken down before detection could take place or should be continued. Most malware exists for small periods, a couple of hours or so, is rotating or comes in perpetually chaging variants to go under the av detection radar. Malware campaigns as a rule do not last that long. This is a reason that slow reacting av detection has more false negatives, because they are slow reactors and this is less obvious after a couple of days when things gets evened out, well for signature detection that is.

Malcode that lasts longer than one day is rare. Malware that stays on for weeks is still there because of pure ignorance by parties that should take it down or cleanse, and malware that is with us even longer is called OVERDUE! malcode (exists for thousand hours and more) and is intentional malware and produced by cybercrime/malcreants and dubious hosters that condone it to be launched from their servers. One can easily see these patterns at clean MX resources (at the moment clean MX again under ddos attack, so take a look there later, look up clean mx in combination with malwarename or IP or URL.

polonus

Lisandro · November 7, 2014, 10:15am

How to get VT scanning the file again and without uploading it again?
In other words, how to update the results?

Pondus · November 7, 2014, 10:44am

If it is a file you get a rescan button on first popup if the file have been uploaded before
You need to have the file as there is no rescan button on old result … Sometimes you will see a “see latest result” if someone have uploaded same file

If it is a URL you upload and scan again

Lisandro · November 7, 2014, 11:37am

It’s a pity… You always need to have the file again…

Lisandro · November 7, 2014, 1:47pm

New scan: https://www.virustotal.com/en/file/d24cb1bd4a84ccd315856f3b0943d4eb91821572663d03ef09143cdd5dc2ab1d/analysis/1415360326/
Avast is detecting in VT.
Although Avast is NOT detecting locally (neither within Chest nor right-click scanning).

polonus · November 7, 2014, 3:14pm

Hi Lisandro and Pondus,

But you two should know by now avast detection always have such issues with Borland Delphi (7) file detection.
It is a known pain in the back, also for the developers of such executables.
See the number of reports analyzed here: http://www.threatexpert.com/files/face.exe.html
Antivirus Report of face.exe:
face.exe Malware
face.exe Dangerous
face.exe High Risk
face.exe
We suggest you to remove face.exe from your computer as soon as possible.
Face.exe is Trojan/Backdoor.
Kill the process face.exe and remove face.exe from Windows startup.
Remove face.exe now!
Reviewed by:
by NightWatcher
face.exe Dangerous Rating: 5 out of 5 (info credits go to Alex Nightwatcher)

Therefore the free version of Revo Uninstaller and in advanced mode should always be ready to be used on on your desktop.

polonus

False negative: phishing not detected

Announcements