A new BeastDoor detected only by few!

Just finished a new scan. Excellent update speed by Avast 4.6 and excellent heuristics by NOD32 with AH.

Best regards,
Firefighter!

 

More results in here with McAfee VSE 8.0i.

Best regards,
Firefighter!

 

McAfee are really getting it together detection wise.

 

That is one of the reason I use NOD32 on one of my machines. The excellent heuristics by NOD32 with AH adds that extra zero-day protection.

 

New malware? It was added on 21.12.2003 !!!

VPS 0311-8, 21.12.2003
Win32:Beastdoor-B2-UPX [Trj], Win32:Beastdoor-C [Drp], Win32:Beastdoor-C [Trj], Win32:Beastdoor-C-UPX [Drp], Win32:Beastdoor-C-UPX [Trj], Win32:Beastdoor-Client [Trj], Win32:Gaobot-66 [Wrm], Win32:Gaobot-67 [Wrm], Win32:IISstorm [Trj], Win32:Ldpinch-C [Trj], Win32:Sober-C [Wrm], Win32:Trojano-003 [Trj]

 

RejZor, could you test it against KAV6 to see if it picks it up on Heuristics?

 

Unfortunatelly i don't have the sample. Ask Firefighter if he's using KAV6 at all...

 

KAV can't unpack the archive, that's it.
Beastdoor files are detected fine when archive has been unpacked.

The same might apply to other AVs.
So you should check such things before making statements.

 

Beastdoor-C-UPX is detected by KAV as Backdoor.Win32.Beastdoor.205 according to VGrep.

MKS_Vir/ArcaVir detects it as Trojan.Beastdoor.205

 

Note: on the above picture mks_vir did not detected this virus because:
a. scanner used on that site it's linux based and linux version of mks_vir/arcavir does not have all unpacking capabilities that windows version has.
b. it is using older engine then windows version does.

Mariusz

 

Well that explains a lot. I trust ArcaVir a lot so I couldn't believe the Jotti scan results.

 

BTW, will the Linux version get the new scan engine and unpacking capability of the Windows version soon?