taged an infected site

Viruses and worms
1

hey guys and girls

my friend has found this floating around. its a web site that is send on msn so that once you click on it, it downloads onto your computer right away. i dunno wut it does, did feel like seeing wut it does. anywho here is the link. do wut you wish with it but just letting you all know

www .stupidorbeauty.com/photo8.php

2

ok got more info its a worn. it alows the person that made it to get onto your computer. thats all i got really.

3

Hi RADICALrandy,

A few scanners are tagging the file as suspicious:

Complete scanning result of “photo8.com”, received in VirusTotal at 04.30.2007, 08:37:00 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.4.28.0 04.30.2007 no virus found
AntiVir 7.4.0.15 04.30.2007 HEUR/Crypted
Authentium 4.93.8 04.27.2007 no virus found
Avast 4.7.981.0 04.30.2007 no virus found
AVG 7.5.0.467 04.29.2007 no virus found
BitDefender 7.2 04.30.2007 no virus found
CAT-QuickHeal 9.00 04.28.2007 no virus found
ClamAV devel-20070416 04.30.2007 no virus found
DrWeb 4.33 04.29.2007 no virus found
eSafe 7.0.15.0 04.29.2007 no virus found
eTrust-Vet 30.7.3601 04.27.2007 no virus found
Ewido 4.0 04.29.2007 no virus found
FileAdvisor 1 04.30.2007 no virus found
Fortinet 2.85.0.0 04.30.2007 no virus found
F-Prot 4.3.2.48 - no virus found
F-Secure 6.70.13030.0 04.30.2007 no virus found
Ikarus T3.1.1.5 04.30.2007 no virus found
Kaspersky 4.0.2.24 04.30.2007 no virus found
McAfee 5019 04.27.2007 no virus found
Microsoft 1.2405 04.29.2007 no virus found
NOD32v2 2229 04.30.2007 no virus found
Norman 5.80.02 04.27.2007 no virus found
Panda 9.0.0.4 04.29.2007 Suspicious file
Prevx1 V2 04.30.2007 no virus found
Sophos 4.17.0 04.28.2007 no virus found
Sunbelt 2.2.907.0 04.19.2007 no virus found
Symantec 10 04.30.2007 no virus found
TheHacker 6.1.6.095 04.15.2007 no virus found
VBA32 3.11.4 04.29.2007 no virus found
VirusBuster 4.3.7:9 04.29.2007 no virus found
Webwasher-Gateway 6.0.1 04.30.2007 Heuristic.Crypted

You should submit the file in a password-protected zip file (password:virus) to virus@avast.com.

4
photo8.com_ - Backdoor.Win32.MSNMaker.ae

New malicious software was found in this file. It’s detection will be
included in the next update. Thank you for your help.

Please quote all when answering.

–
Best regards, Dmitry Shvetsov
Virus analyst, Kaspersky Lab.

::slight_smile:

5

Hi RADICALrandig,

Heuristic.Cryptic finds are detected by special general heuristic means, read here for full details:
http://www.avira.com/en/threats/section/fulldetails/id_vir/2704/heur_crypted.html
More than likely this is a new Trojan.IRC.flood variant.
Did you see the following prompt?

polonus

6

Hi RADICALrandy,
You might want to change your avatar for another, resize or use this one. We try to keep avatars around 100 X 100 for those who don’t have high resolution monitors.

Welcome to the forums.

7

Has anyone sent this file to Avast?