To detect or not to detect?

Viruses and worms
1

Detection and flagged Detected SutraTDS URL pattern with IDS FILEMAGIC Macromedia Flash data (compressed), urlQueryClient
see: http://urlquery.net/queued.php?id=14402160
Nothing here: http://zulu.zscaler.com/submission/show/aaeaf2949114ad1c7b795e732630706d-1361224792
multiple cracked CB viewers there, in this case PurpleSL 1.23 P25 INF.rar
Leading to a phish or clean?
Read about the detection here: http://www.trendmicro.es/media/misc/malware-distribution-tools-research-paper-en.pdf
(Trend Micro Research Paper link author = Maxim Goncharov 2011)
From above research paper comes this quote:

Sutra TDS is currently the most advanced and most powerful TDS software with the
ability to process millions of requests per day. It was designed to process a significant
number of logs in real time in order to tune up redirection rules. It was developed in
2003 and has been constantly updated since then, hence the stable releases to date. It
is unique in that it uses a combination of FastCGI and a self-developed C code without
affecting the infrastructure of its database. As such, it can be deployed on almost any
kind of low-end server while still being able to process up to 30 million clicks every 24
hours. It can come with an additional module called “TS,” which serves as an interface
that emulates traffic market functionality and as a base for partner or affiliate programs.
Its and TS’s code owner also offers additional services for VPN tunneling and for traffic
reselling. Sutra TDS 3.4 is the software’s latest version, which is sold for between
US$100 and US$130, depending on a buyer’s preferred configuration.
info from 2011

polonus

2

Nothing here: https://www.virustotal.com/en/url/6f2962e229f4b7622a3235d012f339bf70e05717ec9263a7ba60bbbcec82d6c6/analysis/1361277064/
But detected here: http://urlquery.net/report.php?id=1041445
and here: http://sitecheck.sucuri.net/results/www.fastektelematica.com/
1 suspicious inline script found- Content after the < /html> tag should be considered suspicious. : window.w3ssss=function(){
var scriptlink = "htxp://jquery.googlecode.com/svn/trunk/gadget/scripts/s… [this according unmasked parasites security report]
avast! Web Shield will detect this as HTML:RedirDL-inf[Trj] → http://labs.sucuri.net/db/malware/malware-entry-mwjs62312
More general description of the malware code here: http://techcosupport.com/press/malware-scripts-added-to-websites/ (link article author = bgt)
malscript → htxp://www.pastemine.com/p7k2 (attack a.o. via reverse engineering of .apk file)

polonus

3

Not detected here: http://heartenandhearty.com/www/odnoklassniki.ru/?ncrnd=XCrbvcqnXL
and here: http://www.urlvoid.com/scan/heartenandhearty.com/
and here: http://sitecheck.sucuri.net/results/heartenandhearty.com/www/odnoklassniki.ru/
and here: http://urlquery.net/report.php?id=1042933
but flagged here: http://zulu.zscaler.com/submission/show/2b1877b2e1451ee09841f13c530b90d7-1361289613
unknown html active malware
Win32/Bicololo in htxp://heartenandhearty.com/www/odnoklassniki.ru/present.php
avast! Network Shield blocks as URL:Mal

polonus

4

Trojan.Win32.Patched.ox & BDS/Zegost.Gen not detected
See: https://www.virustotal.com/nb/url/18124a3f953223581b9226fdfa8ea4802465bfd434d4fe228d9609a09506f103/analysis/
See: http://www.mywot.com/en/scorecard/cftf.com?utm_source=addon&utm_content=popup-donuts
See: http://camas.comodo.com/cgi-bin/submit?file=67de6e9447a8975a6595643ffe178e97ed8e1eb487037710d2641625274e6729

polonus