« previous next »
Pages: [1]   Go Down

Author Topic: Does avast! detect this executable? Scareware?  (Read 4023 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33905
  • malware fighter
Does avast! detect this executable? Scareware?
« on: October 27, 2013, 10:37:19 PM »
See: https://www.virustotal.com/nl/url/b60de77c1616b207a931a5e79b7354ce8afa73815e8aa0ec32ec26f5ef575833/analysis/1382908880/
and https://www.virustotal.com/nl/file/3487045fe79491b901f09646835f30aaea6419cd268bdb1e2524bf10e501fe4f/analysis/1382874085/
IDS alerts here: http://urlquery.net/report.php?id=7219507
Server redirect Code: 404,  Content cannot be read!
See: http://support.clean-mx.de/clean-mx/viruses.php?ip=66.7.217.40&sort=id%20DESC
htxp://www.securitystronghold.com/files/go-remove-malware/InterpolRansomwareVirusRemovalTool.exe is in Dr.Web malicious sites list!
The WOT web rep status: http://www.mywot.com/en/scorecard/securitystronghold.com?utm_source=addon&utm_content=popup-donuts
-> http://www.mywot.com/en/scorecard/go-remove-malware.com?utm_source=addon&utm_content=popup-donuts
Quttera's scanner detects:
/rss
Severity:    Potentially Suspicious
Reason:    Detected procedure that is commonly used in suspicious activity.
Details:   Detected abnormal use of [iframe] elements. Treat it as suspicious.
File size[byte]:    27986
File type:    ASCII
MD5:    18C8729CEEB41F234B06E42F401A317A
Scan duration[sec]:    0.021000
Anubis analysis: http://anubis.iseclab.org/?action=result&task_id=1a696b88c61f499a40984dc32c9beddd4&format=html
Verdict unknown,

pol
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Secondmineboy

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3645
Re: Does avast! detect this executable? Scareware?
« Reply #1 on: October 27, 2013, 10:40:45 PM »
Avast is not detecting it on download and Scan.

I will test it in a VM now.
Logged
Windows 10 1909, 4 GB DDR3 RAM, 500 GB 5400 RPM HDD, 1366 by 768 LCD Screen, Intel Core i3 5010U Dual Core, Intel HD Graphics 5500
HUAWEI P30 Pro. Android 10

Offline Secondmineboy

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3645
Re: Does avast! detect this executable? Scareware?
« Reply #2 on: October 27, 2013, 10:52:50 PM »
The file is also installing RegCleanPro, which is Junkware.

The Program actually looks good.

And its signed by Security Stronghold.

But i would consider this as junk.
« Last Edit: October 27, 2013, 10:56:17 PM by Steven Winderlich »
Logged
Windows 10 1909, 4 GB DDR3 RAM, 500 GB 5400 RPM HDD, 1366 by 768 LCD Screen, Intel Core i3 5010U Dual Core, Intel HD Graphics 5500
HUAWEI P30 Pro. Android 10

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37535
  • Not a avast user
Re: Does avast! detect this executable? Scareware?
« Reply #3 on: October 27, 2013, 10:58:31 PM »
old file....
First submission 2013-07-16 00:39:25 UTC ( 3 months, 1 week ago )
Logged

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33905
  • malware fighter
Re: Does avast! detect this executable? Scareware?
« Reply #4 on: October 27, 2013, 10:58:47 PM »
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Secondmineboy

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3645
Re: Does avast! detect this executable? Scareware?
« Reply #5 on: October 27, 2013, 11:01:48 PM »
I will restart the VM and will see what is going on.
Logged
Windows 10 1909, 4 GB DDR3 RAM, 500 GB 5400 RPM HDD, 1366 by 768 LCD Screen, Intel Core i3 5010U Dual Core, Intel HD Graphics 5500
HUAWEI P30 Pro. Android 10

Offline Secondmineboy

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3645
Re: Does avast! detect this executable? Scareware?
« Reply #6 on: October 27, 2013, 11:08:31 PM »
Nothing in IE, Firefox or Chrome either.

Also no startup key set, just RegCleanPro starting up(and crashing).

Thera was something in Firefox and Chrome, about that just RegClean Stuff, ADW Log attached.
Logged
Windows 10 1909, 4 GB DDR3 RAM, 500 GB 5400 RPM HDD, 1366 by 768 LCD Screen, Intel Core i3 5010U Dual Core, Intel HD Graphics 5500
HUAWEI P30 Pro. Android 10

Offline Secondmineboy

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3645
Re: Does avast! detect this executable? Scareware?
« Reply #7 on: October 27, 2013, 11:18:36 PM »
OTL Logs
Logged
Windows 10 1909, 4 GB DDR3 RAM, 500 GB 5400 RPM HDD, 1366 by 768 LCD Screen, Intel Core i3 5010U Dual Core, Intel HD Graphics 5500
HUAWEI P30 Pro. Android 10

Offline Secondmineboy

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3645
Re: Does avast! detect this executable? Scareware?
« Reply #8 on: October 27, 2013, 11:53:56 PM »
Malwarebytes Log
Logged
Windows 10 1909, 4 GB DDR3 RAM, 500 GB 5400 RPM HDD, 1366 by 768 LCD Screen, Intel Core i3 5010U Dual Core, Intel HD Graphics 5500
HUAWEI P30 Pro. Android 10

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33905
  • malware fighter
Re: Does avast! detect this executable? Scareware?
« Reply #9 on: October 28, 2013, 12:03:26 AM »
There the PUP detection for Flipora is being confirmed,

pol
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline Secondmineboy

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3645
Re: Does avast! detect this executable? Scareware?
« Reply #10 on: October 28, 2013, 12:53:51 AM »
OK.

Im not that good on ADWCleaner Logs with this preferences things.
Logged
Windows 10 1909, 4 GB DDR3 RAM, 500 GB 5400 RPM HDD, 1366 by 768 LCD Screen, Intel Core i3 5010U Dual Core, Intel HD Graphics 5500
HUAWEI P30 Pro. Android 10
Pages: [1]   Go Up
« previous next »