Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

According to Symantec's write up "it also infects .exe and .scr files in folders containing [RANDOM CHARACTERS].t".

  1. What if one of the .exe/.src files is run on the same computer - then all the same files would be infected again and eventually would all be corrupted, or is there a check against this?

  2. If one of those infected files were manually transferred to a new computer and run, that computer will now be compromised?

  3. Regarding the fact "the worm ends security-related processes, if one of the following words is included in the window title: [lengthy list follows]" how does an AV defend against this? (3a) How is removal possible if each time a program starts it's knocked out?

share|improve this question
3  
That's a lot of questions :) The first couple may only be answered by source code or binary analysis. As to the last, offline access may be needed to complete removal/eradication of this threat. Booting with a livecd or from other trusted media to run anti-malware tools is a common example of offline access. –  adric Aug 28 '12 at 19:27
1  
While there are a lot of related questions in there, you would probably get a better response by breaking them up into separate posts. –  this.josh Aug 29 '12 at 6:27
add comment

1 Answer

up vote 1 down vote accepted
  1. Depends on how well written the virus is. (Most of them are pretty badly written!) However, I doubt the writer cares much about the long term survival of the worm once it's grabbed all your email addresses and then mailed itself to them.
  2. It's not the intended vector for infecting other machines, but yes, that would work.
  3. AV tries to intercept the worm before it gets resident in memory (by checking files when written to the disk, scanning attachments in mail, etc.) but once the worm is running the AV is indeed vulnerable to having it's processes attacked, which is why booting from a clean disk (such as a LiveCD) is such a vital part of malware cleanup.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.