Possible Virus

[wolvy68]

I would like to know if anyone else has heard of this www. haibitrung .info/play.exe it always pops up in yahoo messenger I ahve scanned it with sevral virus scanners and ad aware and spybot search and destroy but none of them detect it and I have manually searched for it and could not find it but I know it was there and that it was my computer because it never popped up from the other peoples messages I have reinstalled windows and got rid of it but would like to know what it is an warn other people of it I have done google searches and it seems to have come from vietnam or france these are the only two places I found anything about it and the where in forums which I do not speak either language and google and yahoo would not translate it so I do not know what they where saying but in the french forum it was showing msn messenger any help on this subject is greatly appreciated thank you.

[DavidR]

If this is in any way suspicious you shouldn't post a live link to it, accidents do happen to the cuirous and I sure you wouldn't want the same to happen to others. Please edit/modify your post and put a space before and after the dot like this www . haibitrung.info/play.exe this way the curious can't accidently go there. Those that have the systems in place to check this can always cut paste and edit the url.

You could also check the offending/suspect file at: Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can't do this with the file in the chest, you will need to move it out.
Or VirusTotal - Multi engine on-line virus scanner

I tried to check the home page of  www . haibitrung.info only to get an error

[polonus]

Hi wolvy68,

Was not this misspelled for Haibatrung, that is in Hanoi. Is there a vietnamese connection here?

greets,

polonus

[Jlo]

Hi,

Here are the results from Virus Total.

File already submitted to Avast plus other AV Vendos.

Kind Regards

Jlo

AntiVir 6.31.1.0 09.02.2005 no virus found
Avast 4.6.695.0 09.02.2005 no virus found
AVG 718 08.31.2005 no virus found
Avira 6.31.1.0 09.02.2005 no virus found
BitDefender 7.0 09.02.2005 no virus found
CAT-QuickHeal 8.00 09.03.2005 no virus found
ClamAV devel-20050725 09.04.2005 no virus found
DrWeb 4.32b 09.02.2005 BACKDOOR.Trojan
eTrust-Iris 7.1.194.0 09.02.2005 no virus found
eTrust-Vet 11.9.1.0 09.02.2005 no virus found
Fortinet 2.41.0.0 09.03.2005 no virus found
F-Prot 3.16c 09.02.2005 no virus found
Ikarus 0.2.59.0 09.02.2005 no virus found
Kaspersky 4.0.2.24 09.04.2005 Backdoor.Win32.VB.aid
McAfee 4573 09.02.2005 no virus found
NOD32v2 1.1208 09.02.2005 probably unknown NewHeur_PE virus
Norman 5.70.10 09.02.2005 no virus found
Panda 8.02.00 09.03.2005 no virus found
Sophos 3.97.0 09.03.2005 W32/Baitap-A
Symantec 8.0 09.03.2005 Trojan Horse
TheHacker 5.8.2.099 09.02.2005 no virus found
VBA32 3.10.4 09.03.2005 Backdoor.Win32.VB.aid



VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.> Go to: Home Contact En español
--------------------------------------------------------------------------------
www.virustotal.com :: @ Hispasec Sistemas 2004 :: e-mail info@virustotal.com

[DavidR]

Thanks for posting the results which confirm that it is potentially harmful, which makes it more important for you to modify the URL in the first post, since you haven't said if the URL is correct and not a typo (just click the Modify button within the post).