Is Avast finding Zeus3

[Asyn]

Virustotal results here

Is VT down..??
Can't reach it...
asyn

[DavidR]

Whilst this is a long time after your post, VT isn't down but it is very slow in loading right now, but the delay seems to be in ajax.googleapis.com, see image.

[wompa]

How widespread is Zeus3?

[iRonzel]

Virustotal results here

Is VT down..??
Can't reach it...
asyn

New upload and link:

http://www.virustotal.com/file-scan/report.html?id=543d5d279e1c24f0f89e4e7a3d8411b0a58a6c3d95ef66f9c540a52f1082aa34-1282095086

Edit: The results from the first time that I uploaded the file was 2/41

Edit: One day diferrence; 19 AV detecting it

[iRonzel]

Ummm! i can see it try again:

http://www.virustotal.com/file-scan/report.html?id=543d5d279e1c24f0f89e4e7a3d8411b0a58a6c3d95ef66f9c540a52f1082aa34-1281999854

[polonus]

Hi iRanzel,

This is a proactive Heuristic Detection, which may be triggered by a file that behaves in a suspicious manner indicative of malware infection.

polonus

[mkis]

Additional detalis on F-secure's Suspicious: Gemini

Suspicious:W32/Malware!Gemini is a proactive Heuristic Detection, which may be triggered by a file that behaves in a suspicious manner indicative of malware infection.

http://www.f-secure.com/v-descs/suspicious_w32_malware!gemini.shtml

Summary -    Suspicious:W32/Malware!Gemini

The file appears to be performing suspicious or potentially undesirable actions on the system. This may potentially indicate the presence of a malware infection, or that the suspect file is malicious.

[mkis]

In the Ikarus detection the identification zbot has no further qualifier

such as with zbot.ikh  http://www.securelist.com/en/descriptions/Trojan-Spy.Win32.Zbot.ikh
or with zbot.PI    http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=PWS:Win32/Zbot.PI

so probably look to the generic grouping which are banker trojans   http://www.f-secure.com/v-descs/trojan-spy_w32_zbot.shtml
and for good measure   http://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99

So careful
But Ikarus give no indication of where the zbot ID has come from and their info center offers no further insight. Considering the zbot DNA has been out for a while now, I think you would expect a few more AVs to make detections, if not provide more specific data on the zbot ID.

But as I say be careful. What gives you the idea that is Zeus v2