<<< Date Index >>>     <<< Thread Index >>>

Re: new WIN virus?



Atom 'Smasher' wrote:
[...]
the original spam, the page that it requests, and the suspicious "exe"
file:
        http://smasher.suspicious.org/tmp/live-virus.tgz

[...]
updatte.exe was tested on:
   yahoo-mail
   http://www.kaspersky.com/remoteviruschk.html
   http://www.dials.ru/english/www_av/
   http://www.rav.ro/scan/indexn.php
and they all reported that the file poses no threat. i suspect they're
wrong.

I've submitted this file to AVERT WebImmune ( https://www.webimmune.net ) and they now detect it as a password phishing Trojan called "pws-polk". I've also sent a sample to newvirus (at) kaspersky.com so they get a chance to update their signatures.

- Gregor