virus or not?

Viruses and worms
1

hi…

i would like to ask about this file:

mozilla_firefox_1.0.1_remote_local_gif_heap_overflow

i’ve got this from this website:

http://dlarchiv.securitx.de/index.php

actually this website is a kind of virus database…this file is under exploit folder…the problem is…normally my avast will able to detect if i download something which contain with virus…or if that file zipped, n i able to download it, but after i unzip it, my avast will block it…but not for this file…so…is this a kind of virus or not? if yes, why my avast can’t detect it…

note: my avast is daily update… ;D;D;D

tq

2

actually, i’m a bit fooled by your troubles… can you describe them more?

3

Although, Dr. Web does not check the downloads available, page seems ok and not a kind of virus database.

4

I too am confused what the problem is, but more so why you would want to download what is supposed to be an exploit in the first place. Especially as this is your first post on the forums asking about downloading an exploit from The German Underground Hacking Resource site ?

DrWeb link checker doesn’t detect anything in the mozilla_firefox_1.0.1_remote_local_gif_heap_overflow.zip file it contains a folder of the same name that contains a file called firefox.exe, which obviously isn’t firefox.

It is detected as ‘EXP/FirefoxRemote’ on VirusTotal by only 2 scanners and avast isn’t one of them.

5

i’m not gonna do anything bad bro…just test my AV…because…normally if i download something related with exploit my AV will dtect as virus…than bfore i met this web site i read some article (forgot the name) which list down all virus that able to dtect by Avast…but in the list there’s no virus named Brontox, u definitelly know this rite…i never try download this brontox…so i try the simple one…but just like u said bfore…that firefox remote blah…blah…blah…is not a virus…so mean my Avast is correct…

tq

6

Well I wouldn’t consider using a possible live virus/exploit to test my AV. whilst that particular firefox.exe is only detected as an exploit by two of the 32 scanners at VT we/you don’t really know what the exploit code in that file might do. Exploits I would also say may not be as readily picked up by AVs but the most common ones will like the jpg exploit, but you wouldn’t want to use something like that to test your AV.

If you are trying to find out what the alerts are, etc then there is the eicar test/s, which is specifically designed under a specified control on what can be done to test. http://www.eicar.com/anti_virus_test_file.htm