One of the phish sites that wants you to download an "update"

The file size seems small; possibly it is corrupted and that's why so few detect it?

I have an infected file with the same detection names as you have in your scans - but is only 11,776 bytes in size - and very much active and not corrupted. Nasty little b****r - downloads all its friends (more spyware and a virus) and really screwed my computer. Disabled ability to run EXE files and embedded itself into the Winlogon service.

Mine also copied itself to a USB Stick I had plugged in - creating an Autorun INF and EXE in the root - set as Hidden and System files. All ready to infect any other PC I plugged into.

Yech! And as I recall, this one was 25K. It did appear to have a lot of English commands at the end of the gobbledygook in text view that looked like it was getting files from elsewhere (and that it hadn't been truncated).

Interestingly, since only AntiVir detected it on Jotti, they said they weren't going to submit it to malware companies, as apparently AntiVir is considered more likely to have false positives. Whatever. This is why I switched from Panda to AntiVir.

Thanks for uploading the file. I've added it to the malware listserv.

/t224071-MD5_f5ce9e806ba61f77798aa99bca4c75e9_CVE_2008_5601_exe.html