And 45 days after I sent the worm to AVAST

"Shadow" <Sh@dow> wrote in message
news:35v8955bk9q3gj37loeqnr1pq1349mj50m@4ax.com...

> I disabled my antivirus and I uploaded C:\Documents and
> Settings\nemesis\Meus documentos\qpqdcj.virus.exe.zip. I used pathcopy
> and pasted in the whole path. I don't follow your logic. It's exactly
> the same file I posted to virustotal. Try and see.
> The csrcs.exe file is what the virus becomes when it is
> loaded in memory. It is written with that name to system32 folder. On
> the pendrive it adopts at least 4 different names. The csrcs is a type
> of memory-resident thingy that writes to any pendrive introduced into
> the machine. It also tries to connect to the internet, messes around
> with some share (registry) permissions, alters the explorers shell
> command so you cannot see it in a browser, and dunno what else. The
> virus csrcs.exe (inside the zip) has an md5 of:
>
> 3DE68324891964BDD2227141474797BB
>
> and exactly 725.796 bytes.
>
> Ooops, was that dangerous ? I had to turn my AV off to give
> you that ....

Some on-access scanners will even alert when the file is accessed for
icon information for displaying in a filesystem browser. It is not
dangerous to open a file for other than execution, but if the AV scans
on "open" it will alert even though your action posed no real risk.

On Wed, 26 Aug 2009 06:08:41 -0400, "David H. Lipman"
<DLipman~nospam~@Verizon.Net> wrote:

>From: "Shadow" <Sh@dow>
>The answer from VT...
>
>"Well, it seems that there's something weird, as besides Avast, GData also doesn't detect
>it here (using the Avast engine) so it could be a limitation of the command line scanner,
>or maybe they detect it with an AV feature I don't have here "

Uploaded oswnbi.tar.gz to your site. I just picked it up at
the local hospital. AVG is running , fully updated, on the machine I
got it from. This time I booted into linux, tar.gz the file and posted
that. So you can see what the autorun.inf looks like. Notice it has
changed name again.
Virustotal
http://www.virustotal.com/analisis/af8292fc53daeba7bd615d584af77c3d4d6...5a263ec
FWIW
Back to work .....