DO NOT OPEN THIS FILE - Can't Get Software to "See" this Virus - Santa Clause.rar [0/1]

  • Thread starter Thread starter Ali
  • Start date Start date
A

Ali

I have scanned this file with at least 3 different AV software titles to
know avail. I am attaching this suspicious file as a rar file. Can
anyone tell if this file is infected? It appears to be a script file
masquerading as a screen saver file. I played a little Russian roulette
with it just to see what happens and lo and behold, Zone Alarm stops it
from accessing the Internet and a program becomes resident called
“dllcachev2”. I’m pretty sure this is either a virus or Trojan Horse,
but my TH checker didn’t catch it either. Thanks.

Ali
 
McAfee has identified this as "New Malware.b". Same as the Clinto post prior to yours and
has been "pushed" to UseNet over the past 36~48hrs.

Submission to Virus Total provides the following
http://www.virustotal.com/flash/index_en.html ...

AntiVir 6.29.0.5 12.31.2004 BDS/Small.CT
BitDefender 7.0 12.31.2004 -
ClamAV devel-20041205 01.01.2005 -
DrWeb 4.32b 12.31.2004 Win32.IRC.Bot.based
eTrust-Iris 7.1.194.0 12.31.2004 Win32/OutsBot.A.Trojan
eTrust-Vet 11.7.0.0 12.31.2004 -
F-Prot 3.16a 01.01.2005 could be infected with an unknown virus
Kaspersky 4.0.2.24 01.01.2005 Backdoor.Win32.Small.ct
NOD32v2 1.962 12.31.2004 probably unknown NewHeur_PE
Norman 5.70.10 12.31.2005 W32/Backdoor
Panda 8.02.00 01.01.2005 -
Sybari 7.5.1314 01.01.2005 W32/Backdoo
Symantec 8.0 01.01.2005 Backdoor.Sdbot


You should get a good spanking as you have violated the Charter of; alt.comp.virus and
alt.comp.anti-virus as they do NOT allow posting binary files as you have done. It is
better to post a URL where the suspect could be located or post in;
alt.binaries.comp.virus

--
Dave




| I have scanned this file with at least 3 different AV software titles to
| know avail. I am attaching this suspicious file as a rar file. Can
| anyone tell if this file is infected? It appears to be a script file
| masquerading as a screen saver file. I played a little Russian roulette
| with it just to see what happens and lo and behold, Zone Alarm stops it
| from accessing the Internet and a program becomes resident called
| “dllcachev2”. I’m pretty sure this is either a virus or Trojan Horse,
| but my TH checker didn’t catch it either. Thanks.
|
| Ali
 
You should get a good spanking as you have violated the Charter of; alt.comp.virus and
alt.comp.anti-virus as they do NOT allow posting binary files as you have done. It is
better to post a URL where the suspect could be located or post in;
alt.binaries.comp.virus

I know, I know. Here’s what happened. I’ve been “monitoring”, like a
good lurker should, this newsgroup, alt.comp.anti-virus, alt.comp.virus,
and decided to download a few of the AV software titles people in here
have touted. I used to use McAfee and Norton but got tired of these
behemoths, as they almost “take over” the computer. I was looking for
“small” programs that load fast and don’t take up many resources like
the aforementioned programs. I wanted to do a little bench testing and
thought I’d download a virus/Trojan to see if they worked. AVG, Avast,
McAfee on-line Scanner, and TrendMicro’s SysClean didn’t “catch” this
file, so I was wondering if anybody here would know what it was and what
it did. That’s for curiosity’s sake but wanted to know why these
programs didn’t clean this file. Again, sorry for the binary posting, I
will direct to the file next time.

Ali
 
Trend is EXTREMELY slow in updating their Pattern Files for new infectors. On a recent
adventure it took over 5 weeks to get Trend to put out a Pattern File for a SDbot variant.

You'll note in the Virus Total submission test that AntiVir caught it { AntiVir -
http://www.free-av.com/ - FREE } as well as Symantec, Kaspersky and CA Etrust.

--
Dave




|
| >
| > You should get a good spanking as you have violated the Charter of; alt.comp.virus and
| > alt.comp.anti-virus as they do NOT allow posting binary files as you have done. It is
| > better to post a URL where the suspect could be located or post in;
| > alt.binaries.comp.virus
| >
| >
|
| I know, I know. Here’s what happened. I’ve been “monitoring”, like a
| good lurker should, this newsgroup, alt.comp.anti-virus, alt.comp.virus,
| and decided to download a few of the AV software titles people in here
| have touted. I used to use McAfee and Norton but got tired of these
| behemoths, as they almost “take over” the computer. I was looking for
| “small” programs that load fast and don’t take up many resources like
| the aforementioned programs. I wanted to do a little bench testing and
| thought I’d download a virus/Trojan to see if they worked. AVG, Avast,
| McAfee on-line Scanner, and TrendMicro’s SysClean didn’t “catch” this
| file, so I was wondering if anybody here would know what it was and what
| it did. That’s for curiosity’s sake but wanted to know why these
| programs didn’t clean this file. Again, sorry for the binary posting, I
| will direct to the file next time.
|
| Ali
 
Ali said:
I know, I know. Here’s what happened. I’ve been “monitoring”,

....
or as it looks in my standards compliant newsreader:
I know, I know. Here\222s what happened. I\222ve been \223monitoring\224,


Any chance you could persuade your news composer to either avoid characters
that, according to the International Organization for Standirdization (ISO),
are control characters and don't represent any printable character.
If you insist on using a non-ISO character set, in fact any non-ASCII character
set, then _include a freaking header_ in your post so that newsreaders know
what character set you're using.


Phil
 
...
or as it looks in my standards compliant newsreader:



Any chance you could persuade your news composer to either avoid characters
that, according to the International Organization for Standirdization (ISO),
are control characters and don't represent any printable character.
If you insist on using a non-ISO character set, in fact any non-ASCII character
set, then _include a freaking header_ in your post so that newsreaders know
what character set you're using.


Phil

I is sorry, but you are the only person that has said anything about the
character set I is using. Perhaps it is your reader that has a problem
with my character set, which, by the way, IS ASCII. My newsreader does
not put out any other type of set.

One thing my reader DOES do though, is explain to me UseNet Etiquette:
Pay attention to this one: ***

-------------------------------------------------------------------

Showing HTML Source Material
Some newsreaders (e.g. Microsoft Outlook Express and Netscape) allow
articles to be composed in HTML. When these articles are posted, they
are sent in two parts – one plain text and one HTML.
When the Don’t Show HTML Source checkbox is selected, you will only see
the text part. This feature dramatically reduces the amount of clutter
that you would otherwise see due to the tags in the HTML part.

To Suppress HTML Content
1. Select the Options command from the View menu.

2. Choose the Article Layout tab.
3. Select the Don’t Show HTML Source checkbox.

4. When you are finished, click on the OK button.

-------------------------------------------------------------------

Observing Net Etiquette

USENET news is sort of like a world democracy. In order for it to work,
everyone needs to show some consideration and restraint for other users
and the system in general. The repeated calls for censorship on the
Internet are due in part to the constant violation of these common
courtesies.
The following recommendations for appropriate USENET behavior, developed
over the years by many participants, help ensure you are a good USENET
citizen.

Be Clear
· Use descriptive "Subject:" lines.

· Write as you would in a letter: use upper- and lowercase
characters (using all uppercase is interpreted as “yelling”), complete
sentences, and a ragged right margin (don't right-justify). Leave white
space between paragraphs.
· Pay attention to spelling, sentence structure and word choice
(your posting may be widely quoted!).

· If you're following up, summarize your understanding of the
previous posting, or quote enough of the original to be understandable.
If you're quoting outside sources, give references.
· Define acronyms and obscure terms.

· Be aware of irony, humor and satire.

--------------------------------------------

*** Don't jump to conclusions about other people’s posts, but try to
mark yours appropriately: the ":-) " (smiley) or its modern variation
“<g>” is one tool for this.
· Remember that subtlety is difficult to communicate, and you may be
misinterpreted.

Be Concise
· Reply to other posters via e-mail, unless you know you have
something to contribute that others will appreciate. Read other people’s
follow-up articles before you mail or post a response.

· Try to keep articles short and focused. Don't quote large portions
of referenced material. If you're summarizing a discussion, make a
summary.
· Think about your audience—post only to the appropriate groups. If
you must use more than one, cross-post (specify all groups on the same
"Newsgroups:" line—separated by commas, no spaces).

· If your article is not of worldwide interest, edit the
"Distribution:" line.
Be Kind

· Be diplomatic. A great many colleagues and/or future employers
read the net; post (and mail) only what you're willing to admit to years
from now.
· Ask for clarification, or suggest corrections gently—via e-mail.
Remember that people make mistakes, and so do you.

· If you're truly angry, take a break before responding and get some
perspective.
Be Sensible

· Get to know a group before posting. Read the group's Frequently
Asked Questions (FAQ) list (if any), as well as a few days worth of
articles.
· Do some research before you ask for help. Then describe what
you've already done to solve your problem. Don't ask for help in a group
you aren't willing to read (at least temporarily).

· Don't attempt to share late-breaking news announcements—USENET
isn't that fast.
· Double-check all header lines on your postings.

· If you can't reach someone by e-mail, contact your network
administrator for help. You can also contact your correspondent by
phone. Don't post because your e-mail bounced.
· Be aware of security issues: e-mail is not private, postings can
be forged and programs found on a network can be dangerous.

Be Aware of Others
· Realize that for many of the millions of USENET readers—in dozens
of countries—English is not a native language.

· Avoid special characters like tabs and control characters. On
someone else's screen they may look completely different.
· Don't use article numbers to refer to postings. They differ at
each site (the "previous" article varies from site to site as well).

· Refer to the article’s Message-ID, which is unique.
Be a Good net.citizen

· Don't post copyrighted material.
· Post test postings in test groups.

· Keep your signature to four lines or less.
· If you make a serious mistake in posting, cancel your article
right away.

· Remember that many groups have special rules—about marking
spoilers, rotating questionable material, and so on. Read the
"netiquette" information in news.announce.newusers.
 
Thank you, Dave, that's a new one to me (av.com/) and I will get it next
thing.
Sure glad I am subscribed here.

Harry.
 
Phil's NNTP Client...
User-Agent: Gnus/5.09 (Gnus v5.9.0) Emacs/21.3

I don't see that NNTP client very often !

I had ZERO problems reading your post :-)

--
Dave




| In article <[email protected]>,
| (e-mail address removed) says...
| > > I know, I know. Here’s what happened. I’ve been “monitoring”,
| >
| > ...
| > or as it looks in my standards compliant newsreader:
| >
| > > I know, I know. Here\222s what happened. I\222ve been \223monitoring\224,
| >
| >
| > Any chance you could persuade your news composer to either avoid characters
| > that, according to the International Organization for Standirdization (ISO),
| > are control characters and don't represent any printable character.
| > If you insist on using a non-ISO character set, in fact any non-ASCII character
| > set, then _include a freaking header_ in your post so that newsreaders know
| > what character set you're using.
| >
| >
| > Phil
|
| I is sorry, but you are the only person that has said anything about the
| character set I is using. Perhaps it is your reader that has a problem
| with my character set, which, by the way, IS ASCII. My newsreader does
| not put out any other type of set.
|
| One thing my reader DOES do though, is explain to me UseNet Etiquette:
| Pay attention to this one: ***
|
| -------------------------------------------------------------------
|
| Showing HTML Source Material
| Some newsreaders (e.g. Microsoft Outlook Express and Netscape) allow
| articles to be composed in HTML. When these articles are posted, they
| are sent in two parts – one plain text and one HTML.
| When the Don’t Show HTML Source checkbox is selected, you will only see
| the text part. This feature dramatically reduces the amount of clutter
| that you would otherwise see due to the tags in the HTML part.
|
| To Suppress HTML Content
| 1. Select the Options command from the View menu.
|
| 2. Choose the Article Layout tab.
| 3. Select the Don’t Show HTML Source checkbox.
|
| 4. When you are finished, click on the OK button.
|
| -------------------------------------------------------------------
|
| Observing Net Etiquette
|
| USENET news is sort of like a world democracy. In order for it to work,
| everyone needs to show some consideration and restraint for other users
| and the system in general. The repeated calls for censorship on the
| Internet are due in part to the constant violation of these common
| courtesies.
| The following recommendations for appropriate USENET behavior, developed
| over the years by many participants, help ensure you are a good USENET
| citizen.
|
| Be Clear
| · Use descriptive "Subject:" lines.
|
| · Write as you would in a letter: use upper- and lowercase
| characters (using all uppercase is interpreted as “yelling”), complete
| sentences, and a ragged right margin (don't right-justify). Leave white
| space between paragraphs.
| · Pay attention to spelling, sentence structure and word choice
| (your posting may be widely quoted!).
|
| · If you're following up, summarize your understanding of the
| previous posting, or quote enough of the original to be understandable.
| If you're quoting outside sources, give references.
| · Define acronyms and obscure terms.
|
| · Be aware of irony, humor and satire.
|
| --------------------------------------------
|
| *** Don't jump to conclusions about other people’s posts, but try to
| mark yours appropriately: the ":-) " (smiley) or its modern variation
| “<g>” is one tool for this.
| · Remember that subtlety is difficult to communicate, and you may be
| misinterpreted.
|
| Be Concise
| · Reply to other posters via e-mail, unless you know you have
| something to contribute that others will appreciate. Read other people’s
| follow-up articles before you mail or post a response.
|
| · Try to keep articles short and focused. Don't quote large portions
| of referenced material. If you're summarizing a discussion, make a
| summary.
| · Think about your audience—post only to the appropriate groups. If
| you must use more than one, cross-post (specify all groups on the same
| "Newsgroups:" line—separated by commas, no spaces).
|
| · If your article is not of worldwide interest, edit the
| "Distribution:" line.
| Be Kind
|
| · Be diplomatic. A great many colleagues and/or future employers
| read the net; post (and mail) only what you're willing to admit to years
| from now.
| · Ask for clarification, or suggest corrections gently—via e-mail.
| Remember that people make mistakes, and so do you.
|
| · If you're truly angry, take a break before responding and get some
| perspective.
| Be Sensible
|
| · Get to know a group before posting. Read the group's Frequently
| Asked Questions (FAQ) list (if any), as well as a few days worth of
| articles.
| · Do some research before you ask for help. Then describe what
| you've already done to solve your problem. Don't ask for help in a group
| you aren't willing to read (at least temporarily).
|
| · Don't attempt to share late-breaking news announcements—USENET
| isn't that fast.
| · Double-check all header lines on your postings.
|
| · If you can't reach someone by e-mail, contact your network
| administrator for help. You can also contact your correspondent by
| phone. Don't post because your e-mail bounced.
| · Be aware of security issues: e-mail is not private, postings can
| be forged and programs found on a network can be dangerous.
|
| Be Aware of Others
| · Realize that for many of the millions of USENET readers—in dozens
| of countries—English is not a native language.
|
| · Avoid special characters like tabs and control characters. On
| someone else's screen they may look completely different.
| · Don't use article numbers to refer to postings. They differ at
| each site (the "previous" article varies from site to site as well).
|
| · Refer to the article’s Message-ID, which is unique.
| Be a Good net.citizen
|
| · Don't post copyrighted material.
| · Post test postings in test groups.
|
| · Keep your signature to four lines or less.
| · If you make a serious mistake in posting, cancel your article
| right away.
|
| · Remember that many groups have special rules—about marking
| spoilers, rotating questionable material, and so on. Read the
| "netiquette" information in news.announce.newusers.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 
Path: News.Dal.Ca!snoopy.risq.qc.ca!in.100proofnews.com!in.100proofnews.com!border2.nntp.dca.giganews.com!nntp.giganews.com!cyclone.austin.rr.com!fe2.texas.rr.com.POSTED!not-for-mail
From: Ali <[snip]>
Newsgroups: alt.comp.anti-virus,alt.comp.antivirus.sophos,alt.comp.virus
Subject: Re: Very Sorry - Can't Get Software to "See" this Virus - Santa Clause.rar [0/1]
Message-ID: <[email protected]>
References: <[email protected]> <uPEBd.7565$Y57.4152@trnddc08> <[email protected]> <[email protected]>
X-Newsreader: MicroPlanet Gravity v2.60
Lines: 167
Date: Sun, 02 Jan 2005 18:47:19 GMT
NNTP-Posting-Host: 68.206.128.195
X-Complaints-To: (e-mail address removed)
X-Trace: fe2.texas.rr.com 1104691639 68.206.128.195 (Sun, 02 Jan 2005 12:47:19 CST)
NNTP-Posting-Date: Sun, 02 Jan 2005 12:47:19 CST
Organization: Road Runner High Speed Online http://www.rr.com
Xref: News.Dal.Ca alt.comp.anti-virus:70886 alt.comp.virus:337198

I don't see any charset parameter in the headers.

The "\222" is character 92h or 146 decimal, The Windows right single quote
which Windows software often uses for an apostrophe.
"\223" and "\224" are characters 93h and 94h (147 and 148 decimal), the
Windows characters for left and right double quotes.

You may have typed this:

I know, I know. Here's what happened. I've been "monitoring",

and, without your knowledge, your software changed it into Microsoft's
"smart" quotes[1]:

I know, I know. Here’s what happened. I've been “monitoring”,
I is sorry, but you are the only person that has said anything about the
character set I is using. Perhaps it is your reader that has a problem
with my character set, which, by the way, IS ASCII. My newsreader does
not put out any other type of set.

You are wrong. There are at least[2] two non-ASCII characters in your
post in the text that you quoted. See below:
One thing my reader DOES do though, is explain to me UseNet Etiquette:
Pay attention to this one: *** [snip]
Showing HTML Source Material
Some newsreaders (e.g. Microsoft Outlook Express and Netscape) allow
articles to be composed in HTML. When these articles are posted, they
are sent in two parts – one plain text and one HTML.
^--- Hexadecimal 96 (character 150 decimal)
When the Don’t Show HTML Source checkbox is selected, you will only see
^--- Hexadecimal 92 (character 146)
the text part. This feature dramatically reduces the amount of clutter
that you would otherwise see due to the tags in the HTML part.
[snip]

At least the software I use for reading Usenet and posting to it
(PINE 3.95.iB1.0) is smart enough to include this header:
Content-Type: TEXT/PLAIN; charset=US-ASCII
only in articles and messages that *are* plain ASCII and this header:
Content-Type: TEXT/PLAIN; charset=windows-1252
when I use or quote any non-ASCII characters in an article or message.


[1] Why is it that every feature that Microsoft software has that
has "smart" in the name is stupid?
[2] I didn't look any farther after finding those two.
 
On the other hand, Dave, I am familiar with 'AntiVir' and when I saw it,
knew exactly what the problem used to be, once I ran it.
Somehow the program was unable to scan my boot record, or something like it
and then got stuck. Even though I managed to let the program finish,
I had no choice but uninstall again.
On the positive side, the scan did not find anything.
You win some and you loose some, isn't that what they say?

Harry.
 
Hopefully you win more than you lose :-)

--
Dave




|
| On the other hand, Dave, I am familiar with 'AntiVir' and when I saw it,
| knew exactly what the problem used to be, once I ran it.
| Somehow the program was unable to scan my boot record, or something like it
| and then got stuck. Even though I managed to let the program finish,
| I had no choice but uninstall again.
| On the positive side, the scan did not find anything.
| You win some and you loose some, isn't that what they say?
|
| Harry.
|
|
|
| | > Trend is EXTREMELY slow in updating their Pattern Files for new infectors.
| On a recent
| > adventure it took over 5 weeks to get Trend to put out a Pattern File for
| a SDbot variant.
| >
| > You'll note in the Virus Total submission test that AntiVir caught it {
| AntiVir -
| > http://www.free-av.com/ - FREE } as well as Symantec, Kaspersky and CA
| Etrust.
| >
| > --
| > Dave
| >
| >
| >
| >
| > | > |
| > | >
| > | > You should get a good spanking as you have violated the Charter of;
| alt.comp.virus and
| > | > alt.comp.anti-virus as they do NOT allow posting binary files as you
| have done. It is
| > | > better to post a URL where the suspect could be located or post in;
| > | > alt.binaries.comp.virus
| > | >
| > | >
| > |
| > | I know, I know. Here's what happened. I've been "monitoring", like a
| > | good lurker should, this newsgroup, alt.comp.anti-virus, alt.comp.virus,
| > | and decided to download a few of the AV software titles people in here
| > | have touted. I used to use McAfee and Norton but got tired of these
| > | behemoths, as they almost "take over" the computer. I was looking for
| > | "small" programs that load fast and don't take up many resources like
| > | the aforementioned programs. I wanted to do a little bench testing and
| > | thought I'd download a virus/Trojan to see if they worked. AVG, Avast,
| > | McAfee on-line Scanner, and TrendMicro's SysClean didn't "catch" this
| > | file, so I was wondering if anybody here would know what it was and what
| > | it did. That's for curiosity's sake but wanted to know why these
| > | programs didn't clean this file. Again, sorry for the binary posting, I
| > | will direct to the file next time.
| > |
| > | Ali
| >
| >
|
|
 
I know, I know. Here’s what happened. I’ve been “monitoring”, like a
good lurker should, this newsgroup, alt.comp.anti-virus, alt.comp.virus,
and decided to download a few of the AV software titles people in here
have touted. I used to use McAfee and Norton but got tired of these
behemoths, as they almost “take over” the computer. I was looking for
“small” programs that load fast and don’t take up many resources like
the aforementioned programs. I wanted to do a little bench testing and
thought I’d download a virus/Trojan to see if they worked. AVG, Avast,
McAfee on-line Scanner, and TrendMicro’s SysClean didn’t “catch” this
file, so I was wondering if anybody here would know what it was and what
it did. That’s for curiosity’s sake but wanted to know why these
programs didn’t clean this file. Again, sorry for the binary posting, I
will direct to the file next time.

Ali
"" '' '' '' ""
 
David H. Lipman - 04.01.2005 05:02 :
Hopefully you win more than you lose :-)

Hi Dave, why do you post/quote so many lines after the SIG delimiter?
This is not a good usenet behavior. For good reasons quotings should not
be there but within the body and there only if really necessary and
shortened as far as possible. And the SIG should be only about max. 5
lines if any. And: Is it really necessary a x-posting over 5 NGs without
a single fup? As a more "regular" here please demonstrate a good example
for others. ;-)

THX in advance for your kind understanding.

fup2
 
Back
Top