🚀 go-pugleaf

From: "John Slade" <hhitman86@pacbell.net>

| On 8/1/2010 4:09 PM, David H. Lipman wrote:
>> From: "Dustin"<bughunter.dustin@gmail.com>

>> <  snip>

>>>>            I don't know why you would find it funny because a
>>>> virus writer will use anything to hide a virus. What smarter way
>>>> is to hide them in each and every folder in "system volume
>>>> information"? I do believe that what the system had was a
>>>> variant of the Virtumonde trojan. If you did research on malware
>>>> then you know virus writers will take existing malware and
>>>> modify it. I found one thing to be true in the world of malware,
>>>> NOBODY knows everything about every malware variant out there.
>>>> You can believe me or not, it doesn't matter.

>> | Well, I found it funny from the point of view of a former virus writer
>> | turned whitehat. Does that make any sense to you?

>> | Why would I spend the time to hide a virus in a folder, when I could
>> | choose files? You could just delete me if I stored myself in a folder
>> | in a binary format alone. If I reside in your files instead, I'm alot
>> | harder to deal with.

>> | I know some virus writers have used existing code and modified that
>> | yes. However, the majority of the crap I've seen passing for malware
>> | these days typically isn't actually viral in nature. A virus is no
>> | accident, ya see.

>> | It's entirely possible the individual does have a virut varient, I
>> | haven't seen the sample to confirm or deny that. Based only on what Ant
>> | has written up about it tho, doesn't seem to indicate virut; but
>> | something possibly forked from the same original codebase.

>> | How as a virus would I be able to hide if you examined the drive from a
>> | system that didn't start off of it? It's a rhetorical question... :)


>> The important aspect is one of NTFS permissions.  More than just the average malware
>> can't
>> access "system volume information" and certainly NOT the Vundo family (including
>> Virtumone
>> adware).


|       As far as you know...

And I *know* a lot.  It is known for hooking into IE through BHO and Winlogon via 
Winlogon\Notify and more recently via the Local Security Authority Subsystem Service.  And 
I know its intial infection vector was through Java Exploits.  I remember when they first 
hit and I have seen the tools that were used to erradicate up to and including MBAM.  You 
read where Dustin was an employee of Malwarebytes.  Dustin and I were both employee 
Malware Researchers for Malwarebytes  :-)

{ BTW: I also know I spelled Virtumonde wrong :-) }


-- 
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp