| View previous topic :: View next topic |
| Author |
Message |
AlphaCentauri
SIRT Handler
Premium Member
Joined: Nov 20, 2003
Posts: 2895
|
 Posted: Tue Feb 12, 2008 5:22 am Post subject: Storm worm goes emo |
|
|
Typical storm spam:
| Quote: | Subject: Love Machine
Valentine's Day http://99.230.92.255/ |
Site has a new valentine image, involving wounded hearts dripping blood.
Detection is poor:
VirusTotal:
File valentine.zip received on 02.12.2008 06:12:12 (CET)
Result: 3/32 (9.38%)
Antivirus Version Last Update Result
AhnLab-V3 2008.2.12.11 2008.02.12 -
AntiVir 7.6.0.62 2008.02.11 -
Authentium 4.93.8 2008.02.11 -
Avast 4.7.1098.0 2008.02.11 -
AVG 7.5.0.516 2008.02.11 -
BitDefender 7.2 2008.02.12 -
CAT-QuickHeal None 2008.02.11 -
ClamAV 0.92 2008.02.11 -
DrWeb 4.44.0.09170 2008.02.11 -
eSafe 7.0.15.0 2008.02.11 Suspicious File
eTrust-Vet 31.3.5529 2008.02.11 -
Ewido 4.0 2008.02.11 -
FileAdvisor 1 2008.02.12 -
Fortinet 3.14.0.0 2008.02.12 -
F-Prot 4.4.2.54 2008.02.11 -
F-Secure 6.70.13260.0 2008.02.12 -
Ikarus T3.1.1.20 2008.02.12 -
Kaspersky 7.0.0.125 2008.02.12 -
McAfee 5227 2008.02.11 -
Microsoft 1.3204 2008.02.11 -
NOD32v2 2866 2008.02.11 -
Norman 5.80.02 2008.02.11 -
Panda 9.0.0.4 2008.02.11 -
Prevx1 V2 2008.02.12 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.26.0 2008.02.12 W32/Dorf-AW
Sunbelt 2.2.907.0 2008.02.12 -
Symantec 10 2008.02.12 -
TheHacker 6.2.9.217 2008.02.11 W32/Mydoom.gen@MM.zip
VBA32 3.12.6.0 2008.02.11 -
VirusBuster 4.3.26:9 2008.02.11 -
Webwasher-Gateway 6.6.2 2008.02.12 -
Additional information
File size: 119421 bytes
MD5: 6fd6ecc932d6748a84f1f06ed0267a5e
SHA1: 12bd4ec6d1ef16a4e4364714c4556dc0f4e153c5
PEiD: -
Jotti:
Scan taken on 12 Feb 2008 05:11:59 (GMT)
A-Squared - Found nothing
AntiVir - Found nothing
ArcaVir - Found nothing
Avast - Found nothing
AVG Antivirus- Found nothing
BitDefender - Found nothing
ClamAV - Found nothing
CPsecure- Found nothing
Dr.Web - Found nothing
F-Prot Antivirus- Found nothing
F-Secure Anti-Virus- Found nothing
Fortinet - Found nothing
Ikarus- Found nothing
Kaspersky Anti-Virus- Found nothing
NOD32 - Found nothing
Norman Virus Control- Found nothing
Panda Antivirus- Found nothing
Rising Antivirus- Found nothing
Sophos Antivirus- Found W32/Dorf-AW
VirusBuster - Found nothing
VBA32- Found nothing
|
|
| Back to top |
|
 |
tetak
MIRT Team Lead
Premium Member
Joined: Jan 19, 2007
Posts: 5878
|
| Posted: Wed Feb 13, 2008 5:26 am Post subject: |
|
|
Result: 18/32 (56.25%) this file is now well detected so I didn't add it to the malware listserv.
_________________
Got Windows XP? Help protect your PC from malware with Microsofts anti-spyware program Windows Defender.
Download it for free from http://www.microsoft.com/athome/security/spyware/software/default.mspx
|
|
| Back to top |
|
|
IP: 193.190.*.*
Guest
|
| Posted: Thu Apr 10, 2008 11:31 am Post subject: |
|
|
You might want to obscure the IP address you link to in the first post.
|
|
| Back to top |
|
|
AlphaCentauri
SIRT Handler
Premium Member
Joined: Nov 20, 2003
Posts: 2895
|
| Posted: Sat Apr 12, 2008 10:03 pm Post subject: |
|
|
I can't tell if I goofed up someone went and edited it later, but the way it is now is obscured so it cannot be clicked, but can be copied and pasted, by inserting italics tags around some of the characters in the URL.
For example, http:[ i ]//[ /i ]example.com (without the spaces I added to keep the italics tags from functioning)
|
|
| Back to top |
|
|
|
|
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
