Re: Avira missing downadup worm

[Guest 1PW]

On 02/13/2009 05:08 AM, Gaz sent:<span style="color:blue">

> Latest definitions of avira, completely missing what i believe are variants

> of the downadup worm.

>

> The bastard seems to be causing explorer DEP, renames essential windows

> login files, creates autorun.inf on attached usbs, which point either to a

> recycler folder and a 'boot' file or a misspelled recycler folder, causing

> the infection to be passed on, other files are also infected on the drive.

>

> Beware neither avira, malwarebytes or superantispyware picked up any of

> these.

>

> Gaz</span>

 

Cross Posted

 

Hello Gaz:

 

If you have any suspected malware files, send them to:

 

<http://www.virustotal.com/>

 

for possible identification.

 

If you receive evidence to corroborate your theory, also pass those

files to the Avira, Malwarebytes and SUPERAntiSpyware folks for their

examination and inclusion in their databases.

 

Warm regards,

 

Pete

--

1PW @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]

[Guest Roy]

On Feb 14, 2:47 am, 1PW <barcrnahgjuvf...@nby.pbz> wrote:<span style="color:blue">

> On 02/13/2009 05:08 AM, Gaz sent:

><span style="color:green">

> > Latest definitions of avira, completely missing what i believe are variants

> > of the downadup worm.</span>

><span style="color:green">

> > The bastard seems to be causing explorer DEP, renames essential windows

> > login files, creates autorun.inf on attached usbs, which point either to a

> > recycler folder and a 'boot' file or a misspelled recycler folder, causing

> > the infection to be passed on, other files are also infected on the drive.</span>

><span style="color:green">

> > Beware neither avira, malwarebytes or superantispyware picked up any of

> > these.</span>

><span style="color:green">

> > Gaz</span>

>

>                         Cross Posted

>

> Hello Gaz:

>

> If you have any suspected malware files, send them to:

>

>                  <http://www.virustotal.com/>

>

> for possible identification.

>

> If you receive evidence to corroborate your theory, also pass those

> files to the Avira, Malwarebytes and SUPERAntiSpyware folks for their

> examination and inclusion in their databases.

>

> Warm regards,

>

> Pete

> --

> 1PW  @?6A62?FEH9:DE=6o2@=]4@> [r4o7t]</span>

 

Another acquiantance of mine having installed Avira premium installed

in his PC did miss it also... It was not even recognized as

conficker,downadup, kido etc, but just plain recycler.