Two questions regarding Mixor worm

Question

According to Symantec's write up "it also infects .exe and .scr files in folders containing [RANDOM CHARACTERS].t".

What if one of the .exe/.src files is run on the same computer - then all the same files would be infected again and eventually would all be corrupted, or is there a check against this?
If one of those infected files were manually transferred to a new computer and run, that computer will now be compromised?
Regarding the fact "the worm ends security-related processes, if one of the following words is included in the window title: [lengthy list follows]" how does an AV defend against this? (3a) How is removal possible if each time a program starts it's knocked out?

That's a lot of questions :) The first couple may only be answered by source code or binary analysis. As to the last, offline access may be needed to complete removal/eradication of this threat. Booting with a livecd or from other trusted media to run anti-malware tools is a common example of offline access. — adric, Commented Aug 28, 2012 at 19:27
While there are a lot of related questions in there, you would probably get a better response by breaking them up into separate posts. — this.josh, Commented Aug 29, 2012 at 6:27

Graham Hill · Accepted Answer · 2012-08-30 11:52:40Z

Depends on how well written the virus is. (Most of them are pretty badly written!) However, I doubt the writer cares much about the long term survival of the worm once it's grabbed all your email addresses and then mailed itself to them.
It's not the intended vector for infecting other machines, but yes, that would work.
AV tries to intercept the worm before it gets resident in memory (by checking files when written to the disk, scanning attachments in mail, etc.) but once the worm is running the AV is indeed vulnerable to having it's processes attacked, which is why booting from a clean disk (such as a LiveCD) is such a vital part of malware cleanup.

1 Answer 1