url part clean part trojan

Viruses and worms
1

I’d like to ask to more experienced users / forum members about some “not a definitive” URL suspect.

Virustotal shows the URL itself with 1 error, 1 infected, and several cleans, but when Virustotal scans the site’s pages (index.html) it returns 17/44 infected with a trojan.

If this is a FP, then the number should eventually go down. If it is indeed infected, the number should go up. Instead, it keeps resulting in a “middle” number. Any clues? Is the specific trojan found of any importance under this situation?

[u]BACKGROUND INFO:[/u]

I used some time ago an URL to download a certain tool. On that occasion, Avast didn’t show any concerns about the specific URL.

For some time now, when I try to return to that same URL, Avast says there is a trojan and stops the connection to the site.

I have no relation to the site, so I don’t have any way to confirm or deny the warning.

After several months, the site keeps being “banned” by Avast, with the same trojan.

If I download the tool using a direct link to the zip file, without opening the site on my web browser, then the file (the tool) can be downloaded and Avast scan on the file returns no problems/infections. Only the web site is triggering the warnings.

2

Share the llnks with us…! :wink: (deactivated with hxxp)
Also post the VT results.

3

I want to make it clear that I don’t have any relation to the original site.

My questions are more general than just for this particular case, but anyway, here are the details.

URL:


hXXp://erwan.l.free.fr/clonedisk/
hXXp://erwan.l.free.fr

hXXp://erwan.boot-land.net/clonedisk/
hXXp://erwan.boot-land.net

Virustotal analysis for the URL:


hXXp://www.virustotal.com/url-scan/report.html?id=f75a6e853bed5300695f16e75a0511e4-1315480441

Current Result of VT for the URL:

Websense ThreatSeeker: Malware site

Then click on “View downloaded file analysis” link, and you get to

Virustotal analysis for index.html:


hXXp://www.virustotal.com/file-scan/report.html?id=bc5d5fb8bfefc8a1cfaf8036c8aa574707d080746738a91ffc1d1b4f7637526a-1315487643

Current Result of VT for index.html:

(currently with [b]20[/b]/44, so it is a little higher now).

MD5: f9618fbbffca61e0eee2bc49822f4c07

The same happens to the parent folder, and also to the mirror website (the 4 locations I posted above in this same post).

I am not doubting about Avast’s warning. My doubt is, why this is not completely identified by almost all scanners after months. It keeps being reported by, say, around half of the listed engines, during a long time.

And, as mentioned, the zip file can be downloaded directly and Avast is OK with it (I haven’t posted here the direct link to it though).

Thanks for sharing your knowledge :).

4

The URL scan is just a reputation scan, it is checking the URL against some list to see if it is listed as bad.
This can be totally clean but the website may still be infected

5

Interesting, thanks. Now, that’s for the URL scan, but see that the file scan is the one that I’m more interested in, not just for this particular case.

I want to understand why the file scanners are not reporting a clear tendency.

For a new malware, low percentages might be expected, as with a FP. But for a malware that is not so new, either the webmaster can solve the problem (and the percentage decreases again), or the tendency would be for all engines to find it.

For a FP, the tendency on the long run would be also to low percentages, since I assume not “each and every” scan engine will detect the index.html files as FP at the same time, and the FP would be corrected eventually.

In case the webmaster fails to solve the problem (he doesn’t even know the site was hacked), then all the engines would tend to report malware on the long run.

The same trojan is found in the 4 index.html files (of the above 4 addresses) and this is the situation for months, but not for all engines.

So, having values between, say, 10/44 to 30/44 during long periods of time (months) is what sounds strange to me.

6

also i think to be listed as bad it must have been infected over some time…or been used in distributing malware

The VT scan you posted is only one week old
http://www.virustotal.com/file-scan/report.html?id=bc5d5fb8bfefc8a1cfaf8036c8aa574707d080746738a91ffc1d1b4f7637526a-1315493909

First seen: 2011-09-02 08:29:52
Last seen : 2011-09-08 13:34:33

7

Hi ady4um & Pondus,

Here I scanned and found infected: http://vscan.urlvoid.com/analysis/f9618fbbffca61e0eee2bc49822f4c07/Y2xvbmVkaXNr/
In contradiction to: http://siteinspector.comodo.com/public/reports/318028
But there is one suspicious inline script found here:
http://www.unmaskparasites.com/web-page-options/?url=http%3A//erwan.l.free.fr/clonedisk/&susp=1
found XSS attack crawler long suspicious inline javascript, usually found to be malware, see discussion here: http://www.google.com/support/forum/p/Webmasters/thread?tid=4cf32ea2a7d0a5ed&hl=en (link answer from cristina contributor to support-Webmasters-forum)

polonus

8

You can’t compare the two as they are unique, the URL scan isn’t a live scan, but a check against a database and the file scan is effectively a live scan of the file. When comparing against a database, then that lives or dies on how up to date that database and some are woefully out of date.

The URL scan should also go on and do a scan of the index.htm file (home page), etc. which should give a better indication, but that too is only a single file.

@ Pol
Is there a reason for the 23 blank lines at the end of your post ?

9

Hi DavidR,

The posting is now more like it was meant. The scans I did was the real URL scan at urlvoid, giving the results. Unmask parasite result also very recent results. What is hindering me in scanning is the mix up of non actual third party blocking data with real time actual malscript scan results,

polonus

10

That’s better, I though it was missing an image at first ;D

Yes, my comments were about the VT URL scan and reference to some so called site inspector databases, etc.

11

To be clear:

First, I don’t think that the owner of the site is knowingly spreading malware. Either it is a FP (I don’t think so), or it was hacked a few months ago (and still is).

Second, I tried this site many months ago, and Avast was fine with it. But for months now Avast reports it as infected. The VT check is from this week, yes, but I have been seeing Avast’s warnings about the site for months now.

@DavidR, I didn’t understand you. Which comparison? Were you referring to my post?

@polonus, my apologies but I don’t understand the exact details about the specific trojan, or whatever malware is there, or if this is all a FP (and I’m fine with this “not-understanding the details”).

As I said, I am just trying to understand why the percentage of engines in VT has no clear tendency, either to fall down or to cover almost all of them, being a known trojan (not “new” situation). This is beyond the specific case I presented.

12

You were referring the the VT URL scan from Pondus that you quoted, weren’t you and that being my assumption was what I posted about.

13

maybe you could ask VT ? info@virustotal.com

14

Well, I was the one that posted the link to the URL scan, and Pondus stated that the URL is not a real “scan” but only a comparison against user reports (or something like that).

The part that I am interested in is the 4 index.html files giving a middle percentage value. In fact, I am interested in the middle percentage value, much more than my interest in the 4 files.

I don’t think this is related to VT. This is more related to the engines, how (in terms of time distribution) the trojans are detected across different engines, and somehow related to maths and statistics.

I could understand other percentage tendencies (as I presented in a previous post), but I don’t understand the “middle” values staying there for a long time.

I was (am) hopping that forum members with more experience than I might have seen this type of situations in the past, so the current “middle” situation could be explained somehow.

15
I don't think this is related to VT. This is more related to the engines, how (in terms of time distribution) the trojans are detected across different engines, and somehow related to maths and statistics.
yea...but those working at VT work with malware....so they may be able to give you the answer
16

Thank you all for the links, info and suggestions.

17

Hi ady4um,

Thank you also for posting about this here.
We learn all the time from these postings.

Just an additional thought.
This site is hosted on 1 network,and that is. AS12322 (PROXAD).

Sitevet finds 791 blacklisted URLs there,
for full report, see: http://sitevet.com/pdf/asn/AS12322

Malicious URLs 281
Zeus Servers 1
Badware Instances 791
Spam Bots 428
C&C Servers 1
Phishing Servers 11
Exploit Servers 2

So there could always be some reason for slight suspicion,

polonus