Avast WEBforum

Other => Viruses and worms => Topic started by: 12-es_csaj on September 26, 2010, 03:18:34 PM

Title: Malware Sites
Post by: 12-es_csaj on September 26, 2010, 03:18:34 PM

Maybe Malware sites; no reacts from avast!:

hxxp://goxohic.co.cc
hxxp://www1.ingodswetrust20.co.cc

Title: Re: Malware Sites
Post by: 13thSlayer on September 26, 2010, 03:23:09 PM

First one just requests a password. Don't know it thus can't go further. Second one just returns a 404. However, someone submitted them to Firefox dangerous sites database. Don't know who to trust but code presents nothing of possible danger. So whatever. tl;dr: ulol.

Title: Re: Malware Sites
Post by: !Donovan on September 26, 2010, 03:24:59 PM

http://www.virustotal.com/url-scan/report.html?id=80a1cf524c20ee146c4857bef6a5ef11-1285500144

http://www.virustotal.com/url-scan/report.html?id=fedc6136e26271e09e4ab1baf71b198a-1285500224

They are both malware sites.

Title: Re: Malware Sites
Post by: 13thSlayer on September 26, 2010, 03:26:55 PM

Quote from: Donovansrb10 on September 26, 2010, 03:24:59 PM

http://www.virustotal.com/url-scan/report.html?id=80a1cf524c20ee146c4857bef6a5ef11-1285500144

http://www.virustotal.com/url-scan/report.html?id=fedc6136e26271e09e4ab1baf71b198a-1285500224

They are both malware sites.

Both show just 2/6 (Firefox and Google Safebrowsing are same)

Title: Re: Malware Sites
Post by: 12-es_csaj on September 26, 2010, 03:28:37 PM

I know that downloaded file analysis reports nothing, but in a forum some people checked the sites, and their antivirus alerted.

Title: Re: Malware Sites
Post by: polonus on September 26, 2010, 04:37:16 PM

Hi

The first site had malicious content also in the past, so is suspicious: http://www.google.com/safebrowsing/diagnostic?site=goxohic.co.cc
The second is a malware site according to: http://www.threatlog.com/search/www1.ingodswetrust20.co.cc

polonus

Title: Re: Malware Sites
Post by: 12-es_csaj on September 26, 2010, 05:27:43 PM

So, if they are really malicious sites, what should I do to add them to the newxt virus update?

Title: Re: Malware Sites
Post by: iRonzel on September 26, 2010, 06:14:54 PM

Quote from: 12-es_csaj on September 26, 2010, 05:27:43 PM

So, if they are really malicious sites, what should I do to add them to the newxt virus update?

Send an email with the information to virus@avast.com

Include all info necessary, including the VT results. 

Title: Re: Malware Sites
Post by: Sirmer on September 26, 2010, 06:26:17 PM

Hello,
these sites will be catched in next VPS.
Best regards
Jan Sirmer

Title: Re: Malware Sites
Post by: 12-es_csaj on September 26, 2010, 07:14:52 PM

Quote from: Sirmer on September 26, 2010, 06:26:17 PM

Hello,
these sites will be catched in next VPS.
Best regards
Jan Sirmer

Thank you very much!
Good to know that avast!-guys are so fast; and writing to the forums is not useless  :)

Title: Re: Malware Sites
Post by: 12-es_csaj on September 26, 2010, 09:14:02 PM

The second page has a 404 error, but here is the result for the first one:
http://kepfeltoltes.hu/view/100926/eredmeny_www.kepfeltoltes.hu_.png (I uploaded the picture to a Hungarian upload site)

Title: Re: Malware Sites
Post by: 12-es_csaj on October 06, 2010, 06:17:09 PM

I sent an e-mail to AVAST on 26th of September (before an avast! team member reacted here), and I only got a reply today. So it means that if I send a sample/link to AVAST via chest or mail, it won't be analyzed / added  in few days? This process needs few weeks?
If we complain in the forum, malicious URL/sample will be added few hours later. But I think the most of your users sent malicious codes via e-mail..... And it is slow.
I hope that the reply e-mail what is only slow. If the analyzis too, I am disappointing because of it.