Samples missed by avast (VirusTotal links only!)

Viruses and worms
21

a ransom ;D
http://www.virustotal.com/file-scan/report.html?id=27cc321356d59261ccc711e71651ad68219b041dd3ef999344085ab668bd0c02-1285361736

22

yea…but he is already very angry ;D

I am very angry !
23

just a question: I’m not testing samples and I won’t, but for those who do post about stuff missed by Avast, does it make a difference (or not) if heuristic sensitivity is set to high in the web and file system shields?

edit: would be nice if people didn’t just post the VT results, but also their own and specify their settings (yeah, I know, this supposes a VM or sandbox…that’s just a suggestion).

24

The list came from VirusTotal’s Top10 file submissions (Yesterday)
http://www.virustotal.com/file-scan/report.html?id=9ef6116b0e3e1f663e48b76dc2957d97187f7414be0024b721569d67d378ff56-1285448595

http://www.virustotal.com/file-scan/report.html?id=820c0fd3d36354fe2d0f0db9051b1c5164d6b85fd80d922732a105a886f01844-1285445333

http://www.virustotal.com/file-scan/report.html?id=1f5b7c646092641618b79557a47dcc8eba3f96d8f82673568d9d124f5c3fd90a-1285451627

This could be a false positive:
http://www.virustotal.com/file-scan/report.html?id=017c62ee87dfc53f32b774d867f11be1c94911735d051312979861174a7020b0-1285270314

25

Fake ZillaTube:
http://www.virustotal.com/file-scan/report.html?id=c2b7e07688acdcd107fd236532d7156fe0b324b597c0623653e8a1a14958caed-1285510931

Another VirusTotal’s Top10 file submissions(Yesterday)
http://www.virustotal.com/file-scan/report.html?id=9ef6116b0e3e1f663e48b76dc2957d97187f7414be0024b721569d67d378ff56-1285475821

http://www.virustotal.com/file-scan/report.html?id=afbcfe0f0301c5cdb1202ea75f406a04cc9023d34e347e89311f9835bd5c3af9-1285483928

http://www.virustotal.com/file-scan/report.html?id=820c0fd3d36354fe2d0f0db9051b1c5164d6b85fd80d922732a105a886f01844-1285445333

Could be false positive:
http://www.virustotal.com/file-scan/report.html?id=f609efee5fa8df832ce7708ed58f32021d928089404689eb90ddc1f73d8cd32f-1285105620

http://www.virustotal.com/file-scan/report.html?id=1f5b7c646092641618b79557a47dcc8eba3f96d8f82673568d9d124f5c3fd90a-1285464329

http://www.virustotal.com/file-scan/report.html?id=be798c739c255751a6520fd837e4deda4746a7edda8c41ba21b3a9d3b7480fbc-1285136103

http://www.virustotal.com/file-scan/report.html?id=ddf72f981e472913e2bf0dd49b2d3c02e37afb7d9146baf0af91553f146a6a67-1285471642

http://www.virustotal.com/file-scan/report.html?id=9bb1fb490e81a087534d6b2d2ff6cf57c8fb8f09040165ffb07bb19873e2ebc8-1285471555

http://www.virustotal.com/file-scan/report.html?id=2e49fa656ab38cc7fa296a319d62005457b0fb49993e85dcf410c9bfe055c68b-1285224826

http://www.virustotal.com/file-scan/report.html?id=c56c57f44860fc1caa68d4361a0855780945925c65b39b00826b48ef9a31d155-1285481706

26

i Have one link from Virustotal, Avast found it, i Have on link from Jotti’s malware scan Avast dont Find it on Same virus sample why?
http://www.virustotal.com/file-scan/report.html?id=9266c4084e41982ddf7e365be679e53842da37c1bccc5269d2723fdfabeee420-1285516483

27
Have one link from Virustotal, Avast found it, i Have on link from Jotti's malware scan Avast dont Find it on Same virus sample why?
VT and Jotti may not be on the same update yet ?
28

ahh now i see last update on malware jotti was 2010-09-14 for Every AV there :open_mouth:

now They updated :slight_smile: avast Detect it !

29

http://www.virustotal.com/file-scan/report.html?id=3c36409d24180488f584155defff7498374f47051c0bcccbbd9a8445a6130d05-1285488260

30

Jotti also uses Linux versions of AVs I believe, not to mention has nowhere near the number of scanners of virustotal (currently 43), so personally that is the only multi-scanner site I would use.

31

Hi DavidR,

But the folks that report missed samples through VT links, should check there again for more recent results, also sometimes results are found to be false positives, see the link Left123 gave above. So do your homework properly.

polonus

32

Trojan.

http://www.virustotal.com/file-scan/report.html?id=7fae8f44ca6ac0119692ca1080f07173bd5d4f170cd412bc261e4328ac283dde-1285557252

Fake Codec Pack.

http://www.virustotal.com/file-scan/report.html?id=637a685f6cdaf0b50ab2f910dba177fb4ab64a7def1d2102de9684d55417b6b8-1285555478

Fake Antivirus Program.

http://www.virustotal.com/file-scan/report.html?id=e38d310882d6057da15048b429858748452df166c5a70521043fe2fdca3e00c6-1285559703

33

Send a password protected zip file ( Password: virus) to virus@avast.com with the subject “Undetected Malware”, Put the password in the body of the e-mail.

34

http://www.virustotal.com/file-scan/report.html?id=24fde02323b42f8cb48acff5414118690e41ff79f37c4ce43573f13387e954c3-1285585170

35

Possible Trojan.

http://www.virustotal.com/file-scan/report.html?id=682623d7aa70209c4e39eb5deb0851a8da53fd2d1f048fa31619c4233b438fb3-1285641801

Another Trojan.

http://www.virustotal.com/file-scan/report.html?id=b46244c2191de3f5e8eecf16511facbf4c3a98b91ca2604b1d7a6490a36e626a-1285644196

36

Another fake AV.

http://www.virustotal.com/file-scan/report.html?id=8beb25df7bcf9b2c80f6f1f8fc7bdf26e55ae97df4df477094f3ebb2dd1a1189-1285739163

37

http://www.virustotal.com/file-scan/report.html?id=9fcfe985ff93d493ae8c091566b6524deb114748a5a5018f80d797c658311e14-1285836908
http://www.virustotal.com/file-scan/report.html?id=6a17b1626a22aaaf87bb8b1ad173f91b85f2ab4a863a4b4ec5227e8ba4f02879-1285831256

backdoor: winlogon.exe connected to 74.55.58.173 under weird url like 2-3-v-5-6-l-w-1-q-9-j-n-6-2-n-8-…

avast disabled by: programs will be disabled or shall we say redirect to this winlogon.exe at this registry [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

programs running: winlogon.exe under windows current user name with svhost.exe child process

version: 206

how to keep your programs running?
put all access to this registry in read only…
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]

this is the 3rd time same virus variant undetected but every time I’ve uploaded to avast virus-lab It took a week before avast detects(update config every 5mins).

38

http://www.virustotal.com/file-scan/report.html?id=de2a6bc545a34cc4f3644936c544960dde26377317f543f30c50670a22192e0e-1285782978

http://www.virustotal.com/file-scan/report.html?id=7d6df2766434882417f243e236c192fbee5c8c1479858c6dde5c001d31ee13d8-1285790457

http://www.virustotal.com/file-scan/report.html?id=dec90d6cacde9d8c96addfaee8b6b88a3f0072ba7860a81a0bd1ca95cdc9079e-1285801510

http://www.virustotal.com/file-scan/report.html?id=2bbba7c64d0fc0ad05f6079838a7663f71f0bd5028f67da3af42757417c83486-1285846090

off topic: a link for you marc57 http://www.youtube.com/watch?v=ce87ckRKrzk kiss madiam won greece got talent,well done ;D ;D

39

Thanks for the link Left123.

40

http://www.virustotal.com/file-scan/report.html?id=842080c6fcf6418ca93f86fd036beede353b2585f28a523f18381526424376e3-1285835020

http://www.virustotal.com/file-scan/report.html?id=61aac71f0b59c6f008307ab38b4cc8beba7c88189e9cebc63607b3fd39ebb89b-1285942131