Samples missed by avast (VirusTotal links only!)

[mmmm]

http://www.virustotal.com/file-scan/report.html?id=b5bb33c3d08e98d3ab4c01fbc86894d5de4e40dcdbde49c7111193fd37326a46-1316718030

Trojan?

[Pondus]

Posting VT results here will not help unless you also upload the samples to avast.....did you?

[mmmm]

sorry guys :'(

if i am doing things wrong....i dont know much just want to help!

I am just a compulsive tinkerer who has been watching this forum from past 1 week...i am a avast! user no doubt...i just love avast! 

[mmmm]

I will try and get some samples from Malc0de...

[Asyn]

I will try and get some samples from Malc0de...

First, thanks for trying to help..!
But be very careful, if you are not sure how to do this, it's better to stay away.

[polonus]

Not found Trojan-PSW.Win32.Kykymber.ajbc - see: http://www.nictasoft.com/angel/md5/07694F50E98C1D8406E70A8002D9F7B0
see: http://www.virustotal.com/file-scan/report.html?id=67054abbff844da60f546064d484f09aacf658cc9a78b13b1e6b7bc70301476e-1319134424
Nothing here: http://wepawet.iseclab.org/view.php?hash=0008c26da3a22394da5967cae423368b&t=1319366553&type=js
and nothing here:
http://vscan.urlvoid.com/analysis/2a15fe4e164249efc7e130e5f635913e/cGFjaw==/

polonus

[REDACTED]

Not found Trojan-PSW.Win32.Kykymber.ajbc - see: http://www.nictasoft.com/angel/md5/07694F50E98C1D8406E70A8002D9F7B0
see: http://www.virustotal.com/file-scan/report.html?id=67054abbff844da60f546064d484f09aacf658cc9a78b13b1e6b7bc70301476e-1319134424
Nothing here: http://wepawet.iseclab.org/view.php?hash=0008c26da3a22394da5967cae423368b&t=1319366553&type=js
and nothing here:
http://vscan.urlvoid.com/analysis/2a15fe4e164249efc7e130e5f635913e/cGFjaw==/

polonus

hХХp://zerbilisim.com/patch//pack/
hХХp://zerbilisim.com/patch//pack/troy.exe
hХХp://zerbilisim.com/patch//patch.exe

http://online.us.drweb.com/cache/?i=50ef4246150d7b2342a55b9436595310
http://www.virustotal.com/file-scan/report.html?id=6680d01f92c1426ca3aa5d4930c452cfc7bb079425431c140f76eb2cee581184-1319367455

http://virusscan.jotti.org/ru/scanresult/f90c010e12a9c0b9366e79d57d8b0a96856f69df

[polonus]

Hi Dim@rik,

Certainly a malware site: http://www.virustotal.com/url-scan/report.html?id=eff2622252021746e44c3e64802486a6-1319381223
Thanks for your further evaluation.
But avast does not detect: http://www.virustotal.com/file-scan/report.html?id=92200560416ccbd1f9f4ac23a9ab3df4ce31fbb6587ca410ba49a159869ee428-1319154103
But I hit at these results: http://www.virustotal.com/file-scan/report.html?id=67054abbff844da60f546064d484f09aacf658cc9a78b13b1e6b7bc70301476e-1319134424
Not found by DrWeb as it does not unpack the ASPACK packer: http://online.us.drweb.com/result/?lng=en&chromeplugin=1&url=http%3A%2F%2Fzerbilisim.com%2Fpatch%2F%2Fpack%2F
else it does find it as you have shown: http://online.us.drweb.com/result/?lng=en&chromeplugin=1&url=http%3A%2F%2Fzerbilisim.com%2Fpatch%2F%2Fpack%2Ftroy.exe
also: http://vscan.urlvoid.com/file/07694f50e98c1d8406e70a8002d9f7b0/dHJveS1leGU=/
http://urlquery.net/queued.php?id=5867
= virusname:   Trojan-PSW.Win32.Kykymber.ajbc found at ip:   46.45.136.234
from Istanbul - previous at -http://privategoldtrader.com/templates/beez/
and before that at =http://privategoldtrader.com/templates

MD5 hashes resp.: md5:   0209aa4baab3df392e487bb7d5f538a6 (the one I reported)
md5:   0209aa4baab3df392e487bb7d5f538a & md5:   3dd46205274955be03c2e8e4674011ea

Normally avast should have a good score for this malware with 34.02%

polonus

[REDACTED]

Hi Dim@rik,

Not found by DrWeb as it does not unpack the ASPACK packer: http://online.us.drweb.com/result/?lng=en&chromeplugin=1&url=http%3A%2F%2Fzerbilisim.com%2Fpatch%2F%2Fpack%2F
else it does find it as you have shown: http://online.us.drweb.com/result/?lng=en&chromeplugin=1&url=http%3A%2F%2Fzerbilisim.com%2Fpatch%2F%2Fpack%2Ftroy.exe

polonus

That's right ... this path directory where there are viruses.

hХХp://zerbilisim.com/patch//pack/troy.exe
hХХp://zerbilisim.com/patch//patch.exe

Send to Avast.

[polonus]

Hi Dim@rik,

Site Inspector's cloud detection has it also: http://siteinspector.comodo.com/public/reports/463988
& while this one is missed by it: http://siteinspector.comodo.com/public/reports/464884
I reported there,

polonus

[JuninhoSlo]

undetected malwares

1: http://www.virustotal.com/file-scan/report.html?id=2b601b9b309a1c173f34fb9dcbcd9391a1b1c692a615c1e02747d8adb27b1b09-1319476939

2: http://www.virustotal.com/file-scan/report.html?id=8a68cff52f13b825062bb53f27428f4fe85bdfbbd07550487b0777bb0af972ad-1319286992

3: http://www.virustotal.com/file-scan/report.html?id=bd31db0b57939d330032579515b1b70b9717819ef8fecff566df0597b199d982-1319480831

[Lisandro]

JuninhoSlo, did you send the samples to avast? Otherwise they cannot improve detection of those ones.

[JuninhoSlo]

JuninhoSlo, did you send the samples to avast? Otherwise they cannot improve detection of those ones.

Of course

Via:

- Email
- Chest
- http://www.avast.com/en-eu/contacts

[Lisandro]

Sorry to have asked. Thanks for improving detection.

[JuninhoSlo]

Sorry to have asked. Thanks for improving detection.

It,s OK  Thank you