Potential Malware?

Viruses and worms
1

Hi, does anybony know about mycafecup (internet cafe software) from wwx.mycafecup.com? Whether this is realy a potensial malware or just false positive. Here the virus toatal result: http://www.virustotal.com/file-scan/report.html?id=f0ce84541070cf86b28d19ffa97df1b7c09efe1d8b3fd98a98d7f93bdff96e9d-1299984421

2

It is detected as PUP and not malware…

A PUP (potentially unwanted program) = http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci1066761,00.html

3

Hi Yance and Pondus,

The site is not without issues according to Norton Safe Web & avast:

Threats found: 2

Threat Name: Infostealer.Gampass
Location: htxp://www.mycafecup.net/software/printmonitor.zip
httx://www.mycafecup.net/software/printmonitor.zip - archive ZIP

htxp://www.mycafecup.net/software/printmonitor.zip/PrintMonitor.exe packed by YODA
to detect packer YODA, see: http://www.computer-support.nl/Virusinfo/Viruslib/Packer.Yoda.A/

htxp://www.mycafecup.net/software/printmonitor.zip/PrintMonitor.exe -
htxp://www.mycafecup.net/software/printmonitor.zip/Readme_th.pdf - archive PDF
htxp://www.mycafecup.net/software/printmonitor.zip/Readme_th.pdf -
hxtp://www.mycafecup.net/software/printmonitor.zip/Readme.pdf packed by ZLIB
htxp://www.mycafecup.net/software/printmonitor.zip/Readme.pdf - archive BINARYRES
compresses and adds a packer to the beginning of it,

htxp://www.mycafecup.net/software/printmonitor.zip/Readme.pdf/data001 -
htxp://www.mycafecup.net/software/printmonitor.zip/Readme.pdf -
htxp://www.mycafecup.net/software/printmonitor.zip/Readme1st.txt -
htxp://www.mycafecup.net/software/printmonitor.zip - detected see below and,
Avast detects it also: http://www.virustotal.com/file-scan/report.html?id=4f6486f3379be0613a9ee2bd4be7008c10c69ac94b3665e7058a1bf4b0fa26eb-1300026260
a detection for a Trojan horse that specifically target video game credentials.
Another similar sort of malware detected here:
htxp://www.spyarsenal.com/printer-monitoring-software/print-monitor-pro/print-monitor-pro.zip (malicious site)

Threat Name: Direct link to Infostealer.Gampass
Location: htxp://www.mycafecup.com/th_news.html
See: htxp://jsunpack.jeek.org/dec/go?report=26427176e1ff4e62b99d1bb977bb941d08e6e585

polonus