Hi… I originally posted this in the “viruses and worms” subforum and didn’t get any response. This may have a simple explanation, but I still want to know because I am interested in learning about computer security and programming. And, of course, how Avast works and if its worth keeping.
In my post I included as many details as I could about my ‘procedure’. This was on Win7 64 Pro.
===========================
[i]
Hi, first post here. While in a sandbox (sandboxie), I went and found the text for the ILOVEYOU worm on some webpage and copy/pasted this into notepad and saved it as a text file. If necessary I can provide the text code and webpage, but I suspect this is against the rules so let me know if it’s not & you want to see it.
FYI I have my scan settings for individual items set to include PUP and to “scan whole files”.
Anyway, I had heard that some AV software can detect the ILOVEYOU worm even without the extension so I was just curious about this. So with the file named as “LOVE-LETTER-FOR-YOU.txt” I scanned it in Avast… no threat detected. Next I added the *.vbs extension to the file so it was named “LOVE-LETTER-FOR-YOU.txt.vbs” and scanned it again… no threat detected. Finally I pulled up MalwareBytes and scanned it once more with that, and it also did not detect anything. However immediately after MalwareBytes was done scanning it, Avast detected the threat and said something like “it was removed right before being opened”. Seems weird to me… do you guys know what’s going on with the detection issues here? And why is Avast indicating that the file was about to be opened when MalwareBytes finished scanning it?
Last thing I did was restore it from the chest and remove the *.vbs from the end of the filename. When I did this, Avast immediately detected it (automatically). Why does it get detected when I remove the extension but not when I add it?[/i]