Maybe New Virus

Viruses and worms
1

I was searching for an option to directly send this to Alwil but I didn’t found one.

I received this file via E-Mail. Avast didn’t detect a virus or trojan but I’m rather sure that this file contains malicous code. It’s a normal rar-archiv with a xyz.pdf.exe file in it.

I attached the suspicous file. Warning handle with care it may contain a new Virus or Trojan.

P.S. It would be great to have the option to sent a file to Alwil an then let them check it some other antivirus-companies already have it.

Damokles

–Header–

Received: from host175.ipowerweb.com (HELO host175.ipowerweb.com) (66.235.199.151)
  by mx0.gmx.net (mx057) with SMTP; 15 Jan 2005 22:34:24 +0100
Received: from ohsckszl (25.216.220.171)
	by host175.ipowerweb.com; Sat, 15 Jan 2005 13:34:25 -0800
Date: Sat, 15 Jan 2005 13:34:25 -0800
From:  <Rechnung-Online@t-com.net>

–/Header–
–Email–


Guten Tag,

die Gesamtsumme fьr Ihre Rechnung im Monat Januar 2005 betrдgt: 257,74 Euro.

Mit dieser E-Mail erhalten Sie Ihre aktuelle Rechnung und - soweit von Ihnen
beauftragt - die Einzelverbindungsьbersicht.

Nutzen Sie auch unter www.t-com.de/rechnung die vielfдltigen Mцglichkeiten von
Rechnung Online, wie z.B. Sortier- und Auswertungsfunktionen.

=================================
RECHNUNG ONLINE - TIPP DES MONATS

Die aktuellen Top-Angebote der Deutschen Telekom finden Sie unter:
www.t-com.de/aktuell

Auskunft per SMS
Einfach Anfrage per SMS an die 11833* - Die Antwort kommt sekundenschnell zurьck.
11833* - Wir sind die Auskunft.
*pro SMS-Abfrage 69 Cent aus den dt. Mobilfunknetzen, 49 Cent aus dem Festnetz von
T-Com.
Pro Anfrage per Telefonanruf einmalig 20 Cent zzgl. 99 Cent/Min.
=================================

Bei Fragen zu Rechnung Online oder zum Rechnungsinhalt klicken Sie bitte unter
www.t-com.de/rechnung (oben links) auf "Kontakt".

Mit freundlichen GrьЯen

Ihre T-Com

----------------------------------------------------------

Aktuelle Informationen zu den Allgemeinen Geschдftsbedingungen finden Sie unter
www.t-com.de/aktuell-agb.

Zum Цffnen der PDF-Dateien verwenden Sie bitte den Adobe Acrobat Reader ab Version
5.0. Ist dieser auf Ihrem PC noch nicht installiert, kцnnen Sie die aktuelle
Version unter www.t-com.de/pdf kostenlos herunterladen.

EDIT: ATTACHMENT REMOVED BY ADMINISTRATOR

2
I was searching for an option to directly send this to Alwil but I didn't found one.
You can use virus@avast.com for that. Put the file in a password protected zip and mention in the body why you think it is malware and the password ofcourse.

If a file is in the virus chest, you can also right click it there and choose “email to Alwil software”

....an then let them check it some other antivirus-companies already have it.
You can check yourself by submitting the file to [url=http://virusscan.jotti.dhs.org/]Jotti[/url]

And please, never place a (suspicious) file/mail here. You never know what people will do with it.

3

Hi,

I agree with Eddy that bineries should not be posted to this forum.

However these are the results according to Jotti Scanner.

AntiVir TR/PSW.LdPinch.jm1 (0.14 seconds taken)
Avast No viruses found (3.05 seconds taken)
BitDefender No viruses found (1.57 seconds taken)
ClamAV Trojan.LdPinch.JM1 (1.75 seconds taken)
Dr.Web No viruses found (2.94 seconds taken)
F-Prot Antivirus No viruses found (0.28 seconds taken)
Kaspersky Anti-Virus Trojan-Dropper.Win32.Agent.dw (1.79 seconds taken)
mks_vir No viruses found (0.60 seconds taken)
NOD32 No viruses found (1.29 seconds taken)
Norman Virus Control No viruses found (0.90 seconds taken)

PS Files have been sent to avast!

Cheers

Jlo

4

THis is the built-in way to send files:
avast → chest → user files → Add… → Email

or, as mentioned above: www.avast.com → company → contacts
:wink:

5

Oh, ok I didn’t knew that.

Today I’ve got a reply form frisk.

The file that you sent us through our submission form was analyzed as a 
security risk named W32/Haxdoor.AA@bd.