Trojan.Gen.2 not detected by avast at these sites...[SOLVED]

Viruses and worms
1

Malware could reside here: htxp://maisanuncios.net/images/ (Trojan.Heur.JP.gmGfaK0xAul aka Trojan.Gen.2)
not detected here: http://wepawet.iseclab.org/view.php?hash=9494e64a413f55f802cd20998dee5f0c&t=1301839619&type=js
flagged here twice: http://www.urlvoid.com/scan/maisanuncios.net
Trojan.Gen.2 found here: htxp://maisanuncios.net/images/jpg01042011.exe (see attached malzilla screendump)
Sucuri results:
web site:
htxp://maisanuncios.net/images/
status:
Site verified to be secure and free of malware.
web trust:
Site not blacklisted.

Same malware also detected at htxp://ceaircelle76.org/

not found here: http://wepawet.iseclab.org/view.php?hash=4916161acbb80faedf6f0158c007fb4b&t=1301826900&type=js
also flagged thrice here: http://www.urlvoid.com/scan/ceaircelle76.org

malware here not found by avast: htxp://ceaircelle76.org/album2.exe (Trojan/Win32.CSon)
see: http://www.virustotal.com/file-scan/report.html?id=79a262eebdb2a057ae0817679894c51b4ea9931491abc28bc4aa36973681750f-1301821512
sucuri misses it when scanned: htxp://ceaircelle76.org//intro.htm

polonus

2

So what detected this, as I really see nothing in the links that you gate, parental logic, suspicious, etc. But a whole slew of others not finding anything.

However, http://wepawet.iseclab.org/domain.php?hash=bf3a91873bf2f5ecab4c953bd27968e6&type=js this finds two suspect files and guess what avast alerts on them.

So I really have no idea what the purpose of this topic is.

3

Hi DavidR,

Great the webshield got it, but I reported because of these virustotal scan results:
http://www.virustotal.com/file-scan/report.html?id=79a262eebdb2a057ae0817679894c51b4ea9931491abc28bc4aa36973681750f-1301821512 but the updated scan flagged it as from 2011-04-03 18:17:31 (UTC) Win32:Malware-gen
We can now tag the topic as [SOLVED]
This was one reported where the scanner updated as flagged by avast,
this one is still open: http://forum.avast.com/index.php?topic=75311.0
and this one too:
http://forum.avast.com/index.php?topic=75130.msg621919#msg621919
allas no comments there…

polonus

4

Well that wasn’t picked up by wepawet either. Those that pick it up in urlvoid are as already mentioned WOT, parental logic, malware patrol (whatever that is), etc. But a whole slew of others not finding anything. Aside from that avast detects it anyway.

But honestly I can’t get excited about this and to multiple posting of new topics, if you find it just send the sample to avast. As this is even worst than that single topic that post what hasn’t been detected, yet there is zero follow-up when it is detected.

This carpet bombing approach (a new topic for every occurrence) makes it even harder to follow and ensure that when avast does detect it then that should be updated reflected or it is one sided. If that doesn’t happen then I really do think it pointless.

Perhaps I shouldn’t have bothered to reply in the first place as it really isn’t achieving anything.