[R136a1]

Hey there,

has anybody the sample mentioned in the following blogpost:
http://blogs.avg.com/news-threats/threa ... xecutable/

It is a dropper (16bit Windows NE-Format) written by a chinese malware writer.

Unfortunately no hashes or name of the sample is given.

[Disillusion]

I think this is the one referenced in article? Actually plenty of 16bit samples out and about

[EP_X0FF]

Yes you are correct, this is it. Trojan StartPage aka hello16 probably from shifang :)