Trojan-PSW.Win32.Papras.dk not recognized by Avast

[mec]

I want to report this post by ObiWan [MVP] on italian Microsoft Security Newsgroups:
http://www.microsoft.com/italy/communities/newsgroups/default.mspx?&lang=it&cr=IT&guid=&sloc=it-IT&dg=microsoft.public.it.sicurezza&p=1&tid=70366b70-f604-42b9-9fd9-eb8488db944e&mid=70366b70-f604-42b9-9fd9-eb8488db944e

Appears that the malware Trojan-PSW.Win32.Papras.dk discovered in date 2008-04-16 by F-Secure still is not recognized by Avast (and other famous antivirus products) now :
http://www.virustotal.com/analisis/c2d2e400f67cbb1ad22d1189e00e6bae

mec

[mec]

This malware appears very dangerous!
About Trojan-PSW.Win32.Papras.dk by F-Secure:
http://www.f-secure.com/v-descs/trojan-psw_w32_papras_dc.shtml

[DavidR]

Is this your VT analysis ?

If so, send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and undetected malware in the subject.

Or you can also add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.

[mec]

No, the VT analysis is by ObiWan, reported on Microsoft Newsgroup. 
I haven't the analysed file. 
I have reported this news because the issue appears potentially dangerous for the Avast users!

[DavidR]

Unfortunately there isn't much that can be done without a sample to analyse and create a detection signature for it.

Hopefully VT will forward the sample to those scanners which didn't detect it as is one of the things it should do.

[polonus]

Hi DavidR,

This again proves why Bob3160 and Polonus have the additional protection of non-resident ClamAV. ClamAv detects this. I always have a combination of one resident (Avast) and some non-resident scanners aboard:
ClamAv, DrWebCureIt, and eventual some online,

polonus

[DavidR]

I don't bother with any other AV nor have I done an on-line scan for a number of years, mainly as most require activeX and I hate IE with a passion.

That doesn't mean I'm more susceptible to virus infection as I believe you can take other passive precautions like DMR, etc. and a healthy dose of common sense, backed up by a good back-up and recovery strategy.

If I ever got infected (and I haven't with avast and the proactive measures taken in just over 4 years) I wouldn't waste time trying to remove, repair, etc. I would simply restore the last weekly HDD image I took from my regular system maintenance. For me that is better than overloading my system with multiple on-demand AVs.