Honeypots forgotten Links...

[GaryDee]

Code: [Select]

https://64.16.211.20/dl/software/ipeye.exe

[GaryDee]

Code: [Select]

https://64.16.211.20/dl/software/ipeye.exe

To my PM Buddy:
No matter, a IP Scanner is MALWARE, nomatter which way you turn it. The file is classified for over 6 Years as Malware to leading AVScanners. There would have been enough time to classify it as f/p or whatsoever.

BTW, Cain & Abel, is also classified by Paretologic as Malware since 2010. See

http://www.malwareblacklist.com/searchClearingHouse.php?search=net-security.org

So:first look then think, next time you write PMs. THX. Cheers.

[dlipman]

IP Port Scanners are grey-ware.  You found it on a security site hosting it for use by security professionals.

They are tools that have legitimate uses but may be used maliciously.  Thus they are grey area software and not really malware and may be classified as a PUP, Tool, Hacktool, etc.

If you had a downloader or a dropper that included an IP Port Scanner and you showed how it was being used maliciously in a particular process then that would be beneficial because you would be passing on that information of the tool being used in a particular technique. 

Are you going to tell me those old archivers you posted about in late April were malware ? 
Do you remember your posting the "WinRAR from 2008" and "7-Zip 4.65 from 2009" ?
How about those UPX compressed files ?


There is so much REAL malware out there; Ransom, Bobax, ZeroAccess, FakeAlert, TDSS family, Cridex, Exploit files/code pages, the various bots (Zbot, Rbot, Qakbot, GAObot, SDbot, etc). Cutwail, Mebroot, Bredolab, Hiloti, Randex, Harniq, Sinowal, etc, etc.

Post URLs to samples of the above and not grey-ware tools, false positives and at-best heuristics.

[EP_X0FF]

Code: [Select]

https://64.16.211.20/dl/software/ipeye.exe

To my PM Buddy:
No matter, a IP Scanner is MALWARE, nomatter which way you turn it. The file is classified for over 6 Years as Malware to leading AVScanners. There would have been enough time to classify it as f/p or whatsoever.

BTW, Cain & Abel, is also classified by Paretologic as Malware since 2010. See

http://www.malwareblacklist.com/searchClearingHouse.php?search=net-security.org

So:first look then think, next time you write PMs. THX. Cheers.

This is not malware. Maximum as it can be rated - "Hacktool" or PUA. But itself this tool is not malicious at all. You are wasting your and others time posting complete junk. If you disagree then give us please a *analysis* (not a result from fake av's considering everything as malware and skipping any real malware) to prove this file is malicious software.

[GaryDee]

Code: [Select]

http://8.153.cc/0705/Password%20Agent.rar
Trojan.Win32.MicroFake.ba

[GaryDee]

Code: [Select]

http://205.196.121.158/qhm92or2r8qg/y5m992hvmfy6myx/Zynga.exe
Trojan.Win32.Jorik.Llac.ash

[GaryDee]

Code: [Select]

i2307.in/2012/04/08/page/2/
links from/to

Code: [Select]

http://install.secure-softwaremanager.com/installer/zcdownload/c061a9ad328c637a2d044ef0daf638c86cefde9c8845b33c39e219fa4500e8d7e1589a5693:70522e5fd1a61b0f77a4cb83a0f1ecd3?ld=1
redirects to:

Code: [Select]

http://a.cryingbabee.com/IC/GPLAppBundler78/37280/1/9ff58cab-2959-41a2-b777-c4f7c3442ece/MPLSetup.exe
code is suspicious/malicious

not-a-virus:AdWare.Win32

[GaryDee]

Code: [Select]

http://www.regeasycleaner.com/RegistryEasy_Lite.exe
Risky

[GaryDee]

Code: [Select]

http://premiumstorage.info/v54
Suspicious Adware

[GaryDee]

Code: [Select]

http://rivia.net/Products/Friendzee/Friendzee_Setup.exe
Potential Malware

[EP_X0FF]

Code: [Select]

http://rivia.net/Products/Friendzee/Friendzee_Setup.exe
Potential Malware

Your analysis to prove "potentiality"? Maybe you will mail your Kaspersky guy for confirmation?

Actually this is installer for Windows Mobile 5 application, dated back to 2007(!).

http://rivia.net/Friendzee.aspx

[dlipman]

Your analysis to prove "potentiality"? Maybe you will mail your Kaspersky guy for confirmation?

Actually this is installer for Windows Mobile 5 application, dated back to 2007(!).

http://rivia.net/Friendzee.aspx

[GaryDee]

Code: [Select]

http://dubno-rada.rv.ua/components/com_jcomments/libraries/joomlatune/ajax.js
Trojan Script

[GaryDee]

Code: [Select]

http://download-soft99.info/engine/classes/js/dle_js.js

http://download-soft99.info/engine/classes/js/jquery.js

http://download-soft99.info/engine/classes/js/jqueryui.js
Trojan Scripts

[GaryDee]

Code: [Select]

adideco.es/wp-includes/js/l10n.js?ver=20101110
Trojan JS