potential malware not detected!!!

[polonus]

Hi harman123,

Mal/Emogen-P is a malicious program for the Windows platform. This malcode bugger registers itself as a system service and collects certain essential information from the system. It is also a keylogger. What this means is that it runs continually and watches keystrokes and anything else that it finds useful and uses it for the creators devious purposes.

Detection for members of Mal/Emogen-P malware is behavior based. It is extremely important that users report detections of Mal/Emogen-P to avast and send a sample for analysis.

Now also read this here: http://www.pc1news.com/news/1003/remove-the-svchust-exe-file.html

Another variant: http://www.threatexpert.com/report.aspx?md5=f0b2de1086f03079f463b6b2254f3d03

and this: https://www.microsoft.com/Security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm:Win32/Lashplay.gen!A&ThreatID=-2147362362

polonus

[harman123]

I'd already sent the sample to alwil and microsoft but they took forever to add these samples.
maybe I'm a little pushy but I want to help out as much as I can.

There is another site which most Chinese users know as hxxp://download.tech.qq.com/
in this site there are several potential unwanted programs and adware/spyware disguise programs.

[eplose]

lol  

well I've tried thier product support Live chat... you have to read this:

 Welcome to our site ! How can I be of assistance today?

you: hey...my antivirus software blocks my installation

Sam: Sorry for the inconvenience,

Sam: Can you please let me know, which company/software you are looking for?

you: what do you mean?

you: don't you serve one company only?

Sam: Yes we do

Sam: Our product name is AntiVirus Professional. Did you purchase our software (AntiVirus Professional)?

you: no. I am speaking about adware professional

Sam: I am transferring you to Adware Professional support guy. just a moment please.

Please wait while you're being switched (transferred) to 'Nicholas'.

You are now chatting with 'Nicholas'

Nicholas: Hello,

Nicholas: How can I help you?

you: hello... tried installing the software, but my AV detected it as malware

Nicholas: Can you kindly let me know the name and email address you used when ordering our software?

you: didnt order it, just downloaded it for trialing it.

Nicholas: ok.

Nicholas: Adware Professional is not a scam, is not a virus, and is in no way harmful to your PC.

Nicholas:

Nicholas: We have an excellent product that we stand behind 100%, and it's backed by our excellent support team that is here and happy to assist you with any troubles you might experience.

Nicholas: Our site obviously has nothing to do with the infection on your computer.

Nicholas: We sell an anti-spyware product, we don't infect people with anything, nor do we advertise our product using anything like you mentioned .Our site is heavily involved in anti-spyware legislation, and is one of the most widely used anti-spyware products on the market today.

Nicholas: So, please be not worried about the issue you concern just go ahead and install our software.

Nicholas: The free version of Adware Professional is for the free PC scan and is available at :

Nicholas: hxxp://www.adwareprofessional.com/download.html

Nicholas: But, Only scanning of your system is for free. To remove infected items, you have to purchase our product.

Nicholas:

Nicholas: We offer a free scan to show customers what we are able to detect and remove, and then should the customer wish, they can purchase our software.

Nicholas: To purchase our product, can you kindly try at:

Nicholas: hxxp://www.adwareprofessional.com/purchase

Nicholas: (It is available here for a sum of $27.00which is a yearly subscription amount with a 60 Days Money Back Guarantee).

you: hmm...so what should i do with my AntiVirus?

Nicholas: Please disable it first

Nicholas: After that try to download our software.

Nicholas: Using the above given links

you: obviously it won't work with your software...the moment i'll activate it, the files will be deleted.

you: can't you solve this problem with the antivirus company?

Nicholas: Several companies have raised issues with the fact that (*the name of the product i mentioned*) will, in many cases, identify legitimate programs as malicious purely as an anti-competitive measure. We are in the process of working with (*the name of the product i mentioned*)  to have this error repaired on their end.

Nicholas: So, please be not worried about the issue  you concern.

you: ok. thank you.

Nicholas: Thank you very much for chatting with us today. We hope the rest of your day is an excellent one.

Nicholas: Please Feel free to come back, for any further assistance !

 Wot a scam

I simply don't get it. They have opened a support center for a fake software? wow, they are getting smarter and smarter. They almost convinced me.

[harman123]

If you search avast or avg on google, on top of google sponsor , it say avast antivirus, but when you click on it, it link their site selling their product and trick user installing it.

hxxp://www.adwareprofessional.com

http://www.virustotal.com/analisis/1b27b8c81e763d1eeb61a8ed054575a476f4688b9c3907283492786d1af2fc89-1255988320

http://virusscan.jotti.org/en/scanresult/1c80f8cdcb500c2d877040e1050a77940799e9aa

[harman123]

finally
adware professional is detect by avast  

but baidu sobar not detected by avast

baidu toolbar are found in hxxp://bar.baidu.com/sobar/promotion.html

http://www.virustotal.com/analisis/49407fa162c65df6eefa36a8e89c45b16945ea84463e78842c02306e34315426-1256087904  :'(

[Milos]

finally
adware professional is detect by avast  

but baidu sobar not detected by avast

baidu toolbar are found in hxxp://bar.baidu.com/sobar/promotion.html

http://www.virustotal.com/analisis/49407fa162c65df6eefa36a8e89c45b16945ea84463e78842c02306e34315426-1256087904  :'(

Hi,
thanks for feedback, but baidu sobar don't seems to be bad.

Milos

[harman123]

another sample only comodo detected

potential unwanted program

hxxp://www.registryeasy.com/

http://www.virustotal.com/analisis/41b322e1340dbf158b536c08023a52d31a0bc84d6fb67c15f62d152c2b957b63-1256134241

hxxp://www.errorfix.com/download_now.php

http://virusscan.jotti.org/en/scanresult/2b26832482117ca6a23f405162ee3fe81c86e8b0

http://www.virustotal.com/analisis/5997da4f645ab6d47ee7e7f1331cecce71b6ee91b9928fbcfe1ff72ba4378e4a-1256135202

[harman123]

avast! Professional Edition Failed to block the following Rogue Software samples:
Computer Defender 2009, Error Wiz, Optimizer Easy, Windows Antivirus Pro, PC Doc Pro, PC On Point, Perfect Optimizer, Registry Fix Program, Adware Spyware Remover, Registry Repair, Advanced Audio CD Burner, Advanced Audio DJ Mixer, Advanced Audio CD Ripper,Advanced Video Editing, Advanced Audio Extractor, Clean N' Optimize, Audio Converter Extractor Mix, Software Depo DVD Player, Software Depo DVD Ripper, FTP and Download helper,Software Depo FLV Player, Advanced Icon Editor, Software Depo iPodManager, Advanced Image Viewer, Advanced MP3-WAV Converter, Free Internet Speedd Up Lite, Advanced Net Speed Up, Advanced DVD Rip and Burn, SWD Spy Message, Advanced System TuneUp, Video Converter Max, Advanced Video Editor, MySpace.com Video Grabber, Video Cutter Max, Reg Genie, Reg Tool, Antivirus Pro, Windows Security Suite, Error Fix, Antispyware 2009, Adware Alert, Spyware STOP, SPYware REMOVER, Malware Removal Bot, Registry Smart, Antispyware Bot, Macro Virus.

above is from malware research group rogue test and avast did not detected above samples

[Milos]

Hi,
send us the samples (virus@avast.com) or link to download whole archive, please.

Thanks,
Milos

[caseyv]

Avast 5.0.167 detects this as Win32:Trojan-gen

How were you able to get Avast 5.0.167?  Am I missing it somewhere?  Because 4.8 is starting to miss a lot of viruses.

[DavidR]

It is a beta build of the new avast version 5.

[harman123]

rogue-ware:

hxxp://www.pcdocpro.com

hxxp://www.pconpoint.com/

hxxp://www.perfectoptimizer.com/

hxxp://www.registryfix.com/

Advanced Audio CD Burner ->multiple source google it

Advanced Audio DJ Mixer ->multiple source google it

Advanced Audio CD Ripper ->multiple source

hxxp://www.softwaredepo.com/v-editing.html

hxxp://www.softwaredepo.com/audio_extractor.html

Clean N' Optimize ->multiple source on google

Audio Converter Extractor Mix ->multiple source on google

hxxp://www.softwaredepo.com/

Advanced Icon Editor ->multiple source on google

hxxp://www.creabit.com/viewer/

hxxp://www.softwaredepo.com/mp3.html

Free Internet Speed Up Lite->multiple source on google

Advanced Net Speed Up->multiple source on google

Advanced DVD Rip and Burn->multiple source on google

SWD Spy Message->multiple source on google

Advanced System TuneUp->multiple source on google

Video Converter Max->multiple source on google

Advanced Video Editor->multiple source on google

hxxp://www.softwaredepo.com/v-grabber.html

Video Cutter Max->multiple source on google

hxxp://www.reggenie.com/

hxxp://www.regtool.com/

hxxp://www.errorfix.com/download_now.php

hxxp://www.adwarealert.com/

hxxp://spywarestop.com/

hxxp://www.malwareremovalbot.com/

hxxp://registrysmart.com/

hxxp://www.antispywarebot.com/

hxxp://www.trackzapper.com/spyware.html

wow long list so happy hunting 

[Yanto.Chiang]

Hi Harman,

I don't think all of them was infected by malware, sometimes ecah antivirus vendor would detected another antivirus vendor as malware.
To sure you could check with Unmaskparasites and Norton Safe Web

It could be a false positive..

Regards,
Yanto Chiang

[harman123]

hxxp://www.pcdocpro.com

hxxp://www.pconpoint.com/

hxxp://www.perfectoptimizer.com/

hxxp://www.registryfix.com/

hxxp://www.softwaredepo.com/------------------->multiple programs within this site contain adware and keylogger

hxxp://www.reggenie.com/

hxxp://www.regtool.com/

hxxp://www.errorfix.com/download_now.php

hxxp://www.adwarealert.com/

hxxp://spywarestop.com/

hxxp://www.malwareremovalbot.com/

hxxp://registrysmart.com/

hxxp://www.antispywarebot.com/

[harman123]

hxxp://www.antispywarebot.com/

avast detected as trojan-gen  

the rests still not detected  :'(