🚀 go-pugleaf

  To: alt.comp.virus,alt.comp.a
On 8/1/2010 6:54 PM, David H. Lipman wrote:
> From: "John Slade"<hhitman86@pacbell.net>
>
> | On 8/1/2010 4:09 PM, David H. Lipman wrote:
>>> From: "Dustin"<bughunter.dustin@gmail.com>
>
>>> <   snip>
>
>>>>>             I don't know why you would find it funny because a
>>>>> virus writer will use anything to hide a virus. What smarter way
>>>>> is to hide them in each and every folder in "system volume
>>>>> information"? I do believe that what the system had was a
>>>>> variant of the Virtumonde trojan. If you did research on malware
>>>>> then you know virus writers will take existing malware and
>>>>> modify it. I found one thing to be true in the world of malware,
>>>>> NOBODY knows everything about every malware variant out there.
>>>>> You can believe me or not, it doesn't matter.
>
>>> | Well, I found it funny from the point of view of a former virus writer
>>> | turned whitehat. Does that make any sense to you?
>
>>> | Why would I spend the time to hide a virus in a folder, when I could
>>> | choose files? You could just delete me if I stored myself in a folder
>>> | in a binary format alone. If I reside in your files instead, I'm alot
>>> | harder to deal with.
>
>>> | I know some virus writers have used existing code and modified that
>>> | yes. However, the majority of the crap I've seen passing for malware
>>> | these days typically isn't actually viral in nature. A virus is no
>>> | accident, ya see.
>
>>> | It's entirely possible the individual does have a virut varient, I
>>> | haven't seen the sample to confirm or deny that. Based only on what Ant
>>> | has written up about it tho, doesn't seem to indicate virut; but
>>> | something possibly forked from the same original codebase.
>
>>> | How as a virus would I be able to hide if you examined the drive from a
>>> | system that didn't start off of it? It's a rhetorical question... :)
>
>
>>> The important aspect is one of NTFS permissions.  More than just the average malware
>>> can't
>>> access "system volume information" and certainly NOT the Vundo family (including
>>> Virtumone
>>> adware).
>
>
> |       As far as you know...
>
> And I *know* a lot.  It is known for hooking into IE through BHO and Winlogon via
> Winlogon\Notify and more recently via the Local Security Authority Subsystem Service.  And
> I know its intial infection vector was through Java Exploits.  I remember when they first
> hit and I have seen the tools that were used to erradicate up to and including MBAM.  You
> read where Dustin was an employee of Malwarebytes.  Dustin and I were both employee
> Malware Researchers for Malwarebytes  :-)
>

     That's all well and good but as you know there are strains 
of trojans and worms that are unknown. It may or may not have 
been Virtumonde or a version of it, it very well may have been 
some other malware that dropped Virtumonde. I'm sure you know 
there is malware out there that will drop multiple trojans and 
worms on a system. But whatever it was, I was never afraid to do 
what it took to get rid of it. That's why I make a backup before 
I clean badly infected systems.

      I can tell you this, after I got rid of all the system 
restore points, some malware looked for files in the restore 
folders and couldn't find them. I got the popup saying the files 
were not found in that directory. I did a final scan and when I 
removed the malware this time it stayed gone. The system ran 
with no problems until the teenager put something else on it 
months later.

John

---
 * Synchronet * The Whitehouse BBS --- whitehouse.hulds.com --- check it out free usenet!
--- Synchronet 3.15a-Win32 NewsLink 1.92
Time Warp of the Future BBS - telnet://time.synchro.net:24