I decide to test how protected I am!!
I paused avast! web shield and standard shield and download a virus sample from TheSerials.com (infected) web site, run it as administartor and wait to see what would happen, and then run avast! again, now I am infected, after a scan with avast, avast found these:
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Users\Omid Farhang\AppData\Local\Temp\VRTD280.tmp” file.
Sign of “Win32:JunkPoly [Cryp]” has been found in “D:\Desktop\microsoft_office__enterprise.exe” file.
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Users\Omid Farhang\AppData\Local\Temp\VRTF6ED.tmp” file.
Sign of “Win32:Vitro” has been found in “C:\Windows\System32\conime.exe” file.
Sign of “Win32:Vitro” has been found in “C:\Windows\System32\dllhost.exe” file.
Sign of “Win32:Vitro” has been found in “C:\Windows\System32\cacls.exe” file.
Sign of “Win32:Vitro” has been found in “C:\Windows\System32\msdtc.exe” file.
Sign of “Win32:Vitro” has been found in “C:\Windows\System32\SearchFilterHost.exe” file.
Sign of “Win32:Vitro” has been found in “C:\Windows\System32\SearchProtocolHost.exe” file.
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Windows\Temp\VRT48B2.tmp” file.
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Windows\Temp\VRT8813.tmp” file.
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Windows\Temp\VRT30CF.tmp” file.
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Windows\Temp\VRT698C.tmp” file.
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Windows\Temp\VRTA15E.tmp” file.
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Windows\Temp\VRT4B92.tmp” file.
Sign of “Win32:Trojan-gen {Other}” has been found in “C:\Windows\Temp\VRT5996.tmp” file.
I watched and found suspicion transfer in these place:
TCP and HTTP to/from these IP using these process:
WMIPRVSE.EXE WMI Provider Host
WINLOGON.EXE Windows Logon Application
211.95.79.6
218.93.205.24
after every send/recieve to these bad IP, avast! found a new “Win32:Trojan-gen {Other}” in “C:\Windows\Temp\VRTXXXX.tmp”
ok, and now after scan with MBAM, SAS and avast I could not find anything, only normal process with their usual command line are running in my computer, I would post my hijackthis log now in the reply
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:20:43 AM, on 3/31/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
now I’ve blocked these IP and did not get any more alert by avast!, but, still those 2 process are trying to connect to those IP server in China and IP are blocked and they cannot:
211.95.79.6
218.93.205.24
because I like to risk and see and feel them in real action, I want to feel their real impact on system performance and actions in real, not in a virtual…
I hope you don’t have that much to lose… documents and data, in this particular computer…
In fact, the impact or infection in virtual will be the same as in real… just that you can backup (take a shot) of the system and have it clean back in 10 seconds…
ok! now my system is clean, but with a clean install of my windows now…! avast killed my windows!!
the file logonUI.exe got infected and avast! could not clean it and delete that…! I could not back to windows after reboot and I decide to re-install windows instead repair…
No, lets get that straight, ‘you’ killed your windows but infecting it deliberately with a virulent .exe file infecter. One that had you checked the forums has resulted in virtually all ending up formatting and starting again.
As I said in my last post:
Well vitro is an alias for virut which is a virulent .exe file infecter so your lucky to get away with so few infected files.
So it looks like you weren’t so lucky as it continued infecting files.
If you are going to take these risks then you really need to get your back-up and recovery strategy bullet proof first. Had you used hard disk imaging software and taken a disk image before, when everything fell down, you could have restored the hard disk image to did before the experiment. That would probably have taken 20-30 minutes tops to have your system as it was.
Or use VMware or some other virtual environment, but you chose not to do that, you could just as easily have seen this work in a virtual environment.
So I repeat again, avast didn’t kill your system ‘you’ did by starting the experiment in the first place.
ok! DavidR, I Killed my system, so, now a few questions:
What should do VRDB Generator? should not it get back up from important files like logonUI.exe and…?
should not a good antivirus be able to Repair infected files?
that virus was working and has his own risk, but it did not removed any files, it was avast! that delete my system files because of their infections, so, now who caused problem? virus or my antivirus?
an antivirus should be able to clean a infected system, did avast that for me?
the VRDB only protects certain files, you would have to have run the VRDB prior to infection, whilst that may be one of them, it would have the same problems in repairing a file as in point 2 below. If the VRDB covered the file, e.g. included in a VRDB generation prior to infection, then the Repair button on detection would be available (and a repair can be attempted), otherwise the repair option would be greyed out.
there are many viruses that encrypt their infection and change the infection for each file that they infect, some are now using two levels of encryption to prevent repair. the vitro, virut, etc. are particularly virulent. So you have to give avast a fighting chance to block/detect it before it gets established and disabling avast allows it to get established and once established you are on a losing battle.
avast didn’t delete your files, it detects the infected file and alerts you to it, ‘you’ chose what action to take, move to chest, delete, etc. so ‘you’ make the choice and avast carries it out.
notes 1&2 are the same for this, when you weight the battle against your AV by disabling it and then deliberately infecting your system doesn’t give the AV a fighting chance. So in this case I’m afraid you reap what you sow.
VRDB should backup all important system files, should not it? avast! should keep system able to boot
I used repair button, when I clicked on that avast went for repairing and then told me it could not repair and I had not any other else than move to chest and delete…
ok! everything that I say you would say I did it with my system! you don’t want to accept/believe avast! could not clean my system…
it’s not bad to know main virus.exe file that i ran in my system was detected as “Clean” file by avast
I really don’t know exactly what files are covered by the VRDB, but it isn’t a back-up as in a copy of the file or the size of the VRDB database would be huge as it keeps three generations of the database. It retains only enough information to try and repair the file.
However, as I have said infections that use encryption that changes is trying to combat the ability of any AV to repair it and that doesn’t apply just to avast. The VRDB function was when introduced a very useful tool but that use with the development of malware is limited and as far as I’m aware from avast 5 the VRDB won’t be continued.
It has nothing to do with not accepting what you did or didn’t do, by disabling avast to start with you didn’t test the anti-viruses ability to protect you in the first place and once infected by one of the most virulent file infecters that has resulted in many having to format and reinstall and that isn’t just avast users all you need to do is check the various anti-malware sites to see that.
You don’t seem to want to accept that what you did was plainly stupid, sorry, but I have no other words for it.
Not, unfortunately, not.
I won’t test the security of a system the hard way you’ve taken. I’d rather use backups and keep my security programs on and updated. There will be always a way to circumvent the protection, there will be always a non-detectable malware… that does not worry me as I won’t have contact with such malware. I don’t want to work with possibilities (or sense of security). I’d rather have a plan to work effectively on protection and restoration… Talking about this, time to make backups this afternoon
