[Xylitol]

Interesting article from the MMPC ~ Easy Money: Program:Win32/Pameseg (part one)
http://blogs.technet.com/b/mmpc/archive ... t-one.aspx

HoaxSMS Skype in attach.
http://www.virustotal.com/file-scan/rep ... 1321358231

[bitx]

System Fix

[Xylitol]

zscaler.com: More free software repackaged for money
Xylibox: CenterCash affiliate (Hoax SMS/Fake Installer)

In attach, two centercash samples and the archive generator with styles for icq/firefox/skype etc..
18/42 >> 42.9% ~ http://www.virustotal.com/file-scan/rep ... 1321538649
18/42 >> 42.9% ~ http://www.virustotal.com/file-scan/rep ... 1321540394

[icr]

Variant of security shield

MD5 : 327A5F001B9F922912E6DCE239B2CB98 http://www.virustotal.com/file-scan/rep ... 1321810298

MD5 : EA77763BDC21F76166A056BD6360DF26 http://www.virustotal.com/file-scan/rep ... 1321880331

regards,
icr ;)

[Xylitol]

System fix 2/43 >> 4.7%
http://www.virustotal.com/file-scan/rep ... 1322683788

with fake error flood and shit's like in movies

[rough_spear]

Hi All, :D
Probably be a Win32.Banker as i didn't tested it yet.

VT link - https://www.virustotal.com/file/bbff0da ... /analysis/
SHA256: bbff0dad6a97b0de581aa100db6405154f9f789a02f23d140e1abb2b867fd361

web link - hxxp://www.spyware-adware-remover.com/sr/FixEr ... ryScan.exe

Regards,

rough_spear. ;)

[EP_X0FF]

Hi All, :D
Probably be a Win32.Banker as i didn't tested it yet.

VT link - https://www.virustotal.com/file/bbff0da ... /analysis/
SHA256: bbff0dad6a97b0de581aa100db6405154f9f789a02f23d140e1abb2b867fd361

web link - hxxp://www.spyware-adware-remover.com/sr/FixEr ... ryScan.exe

Regards,

rough_spear. ;)

It is a fake registry fixer packed in SFX archive and created with AutoPlay Media Studio 5 Runtime.
Posts moved.

[HackJack]

Pass: infected

[Cody Johnston]

Another fake HDD scanner

SMART_HDD



VT: 4/42

SHA256: 06d6cecba33b796a44fbeb931425280786b1d7438f26f0765704c32673ad478c

https://www.virustotal.com/file/06d6cec ... 333166038/

[thisisu]

This has been reported to be S.M.A.R.T. - Data Recovery

Guessing it has some type of VMDetect code. Help making VM friendly appreciated :)
https://www.virustotal.com/file/a5992ff ... 335670348/