files.ar-club.ru/f_ddec.exe(77mb)
this program do very bad things.
create/change files Windows\notepad.exe, regedit.exe, taskman.exe, explorer.exe, winhlp32.exe
add new service, and others.
and avast do not see this.
This program with russian interface, when you run DelphiDecompiler, press Открыть Exe(Open EXE), for activate virus system.
sorry for my bad english.
Thanks
Can you send the samples to virus@avast.com ?
You can zip and password the files… Inform a link to this thread and the password used.
You can send the files to Chest and, from there, resend to Alwil for analysis.
Thanks for helping improving detection.
77mb by e-mail???
i suggest you try the online file scanner of kaspersky…
The preferred way for submitting samples is e-mail (or sending them from Chest). Although, you can use Alwil FTP server as a second way to transfer only big files. Upload them to ftp://ftp.avast.com/incoming (please, note that you won’t have READ access to the ftp server, just write - so you won’t even be able to see what you’ve just uploaded).