Samples missed by avast (VirusTotal links only!)

[razoreqx]

Trojan.Karagany

http://www.virustotal.com/file-scan/report.html?id=a31b5e52c2fb8d0f2e98a4a2ef9c5aa7e3fb1105274251cfea2167fdc910161b-1324479799

http://virusscan.jotti.org/en/scanresult/f3a129b6467e19ebb8f5445e4635caf5d8bd69a2

http://urlquery.net/report.php?id=12955

[razoreqx]

Adware Downloader

http://www.virustotal.com/file-scan/report.html?id=05aee16f88b45a8bfb81d1083fb298193d68942f1b16612b225ce2e77e6d03c5-1324483656

http://virusscan.jotti.org/en/scanresult/328f87e09b442d34377f9e1b8ae6f38ba8590946

http://www.threatexpert.com/report.aspx?md5=38a7083ec6feb55dfca2a0c2607701e4

[polonus]

Hi razoreqx,

Is this report somehow related to it? see: http://www.threatexpert.com/report.aspx?md5=5281fd5adcfc75202622bc586043e282
See: http://jsunpack.jeek.org/dec/go?report=d495bbeb8ebb44c204e25422b65d814d1f220d0e

polonus

[razoreqx]

Hi razoreqx,

Is this report somehow related to it? see: http://www.threatexpert.com/report.aspx?md5=5281fd5adcfc75202622bc586043e282
See: http://jsunpack.jeek.org/dec/go?report=d495bbeb8ebb44c204e25422b65d814d1f220d0e

polonus

\
I just got that back about 10 mins ago.. You're fast

[razoreqx]

Not bashing CNET but anything that modifies my firewall rules, and without asking I have an issue with!


http://www.virustotal.com/file-scan/report.html?id=751850a5e527c5987201d400fae2ac8aab0f644a042af89c2e02aaa757f06ea3-1324494179

http://www.threatexpert.com/report.aspx?md5=bb411fef75d17a07bc82da72b67919cc

http://virusscan.jotti.org/nl/scanresult/d443623bd73f4f10a8caa76b5902bf5d1524716a

http://support.clean-mx.de/clean-mx/viruses.php?domain=we-care.com&sort=email%20asc

https://anubis.iseclab.org/?action=result&task_id=174430ff4cd876654254372d4c6abb2de&format=html

http://urlquery.net/report.php?id=12984

[polonus]

Hi razoreqx,

This is what I get back  from abad iFrame detektor scan:

Check took 6.06 seconds

(Level: 0) Url checked:
-http://we-care.com
Zeroiframes detected on this site: 0
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.we-care.com/templates/ac_runactivecontent.js
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.we-care.com/templates/wc.js
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.we-care.com/templates/fat.js
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
-http://we-care.com//scripts/jquery.js
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
-http://tag.didit.com/js/tman_iframe.js
Zeroiframes detected on this site: 1
No ad codes identified

(Level: 2) Url checked: (iframe source)
-http://tag.didit.com/js/+d+
Blank page / could not connect
No ad codes identified

(Level: 2) Url checked: (script source)
-http://tag.didit.com/js/+scriptstr;jscall+=&tmlogit=0;if(tmparam.tmcampid||tmparam.levrev||tmparam.levresdes)window.tmcbrequired=1;jscall+=&tmtag=js
Blank page / could not connect
No ad codes identified

(Level: 1) Url checked: (script source)
-http://www.google-analytics.com/urchin.js
Zeroiframes detected on this site: 0
No ad codes identified

see (embed) -cdn.we-care.com/Content/SWF/titles.swf?tvalue=Responsible+Shopping+and+the+We-Care.com+Community&tcolor=0xFF6600

All there will redirect eventually to appnexus.com an ad retargeter with not such a very good web rep:
http://www.mywot.com/en/scorecard/appnexus.com
http://www.webutation.net/go/review/appnexus.com

polonus

[polonus]

Avast does not detect this SpyEye binairy:
http://www.virustotal.com/url-scan/report.html?id=c37f975f900b98d2b5d61a18f69c1e2b-1324488656
and
http://www.virustotal.com/file-scan/report.html?id=e4767c0989108a271011e117871e0fad141bd44ec3a119080e2bac864a7b0ad3-1324492270
Anubis report from SpyEyeTracker: http://anubis.iseclab.org/?action=result&task_id=13c4c9e7e7c442f5419f26785d839c2cc

polonus

[Pondus]

The link is dead now

http://www.virustotal.com/url-scan/report.html?id=c37f975f900b98d2b5d61a18f69c1e2b-1324505134

[polonus]

Hi Pondus,

You are right status: offline. But avast did not have had it, if it had been up and alive,

pol

[Pondus]

sooner or later they recive it from VT

[Lisandro]

What? CNET is messing firewall rules? Is it posible? Am I reading correctly?

[razoreqx]

What? CNET is messing firewall rules? Is it posible? Am I reading correctly?

User desktop firewalll... Not parameter fw...  the details are in the sandbox output

[razoreqx]

http://www.virustotal.com/file-scan/report.html?id=d9c38651d8b9e3bfb50eb19070e49398599f60b2413554e6cf0103f4680ba8da-1324560750

Sample sent

[polonus]

Not detected: TR/Hijacker.Gen
See: http://www.virustotal.com/url-scan/report.html?id=5c6dd3a08ed1467955086049015a5d38-1324677601
and
http://www.virustotal.com/file-scan/report.html?id=1221916ed2f4bcab2141e378aa0670601742fdad787c0b7d59dc93f977125ea8-1324681317
See: http://reports.antivirus-lab.com/13726/winudapter-exe-2/

polonus

[Lisandro]

Polonus: we'll never thank you enough for helping improving deteccion. Merry Christmas.