Undetected Malware needs to be added ASAP

[avastuser3796]

I sent a file to Avast! 1-2 days ago. It’s absolutely urgent that it’s added. It is a pain to remove and was confirmed by Malwarebytes, Norman Labs and essex is working on a fix.

Milo’s or another Avast! Team Member PM me for a download link. Thank-YOu

[avastuser3796]

^^ Bump?

[essexboy]

Did you also send it via e-mail to the virus lab with a link to the thread ?

[polonus]

Yep, send it along with a password to virus AT avast dot com attn. to that avast team member, and everything will be OK.
Do not expect them to react. They only let you know whenever additional info is needed.
Thanks from the avast! community for adding to avast! detection.
You have done your good deed for to-day,

polonus

[avastuser3796]

Edit: Deleted. Avast! wasn’t updating properly. Now detected as MSIL:Injector-GI [Trj]
Edit 2: MBAM w/ Latest Defs still detects nothing.

[essexboy]

Good to hear, surprised MBAM is lagging

[polonus]

Always a problematic detection those Delf aliases.
MBAM may be contemplating an eventual FP ;D
Malicious code is injected in legit system processes.
Good there is detection for this trojan with rootkitlike properties,

polonus

[avastuser3796]

@polonus post:7

Always a problematic detection those Delf aliases.
MBAM may be contemplating an eventual FP ;D
Malicious code is injected in legit system processes.
Good there is detection for this trojan with rootkitlike properties,

polonus

Ah, have you been following my thread for Bailey? This thing is nasty. I pointed FatDcuk in the direction of Bailey’s thread and he himself said this.

Hi.

Support dat (non public use\share!)

Ok the multiple IFEO’s are just one of its self defence (mbam.exe is in the blacklist along with most common fix it tool’s).

Inserting the IFEO and making the debugger point to a non existent file is a way of crashing the target executable. (easy fix, tools such as autoruns by Sysinternals can be used to delete the registry key.

The 2nd and far more nastiar self defence is it changes folder /file permissions for blacklisted folders.

No software can protect these permissions once the malware has executed with admin rights.

Net result is this screws over a whole lot more software/fixs then just us, there is quite an extensive blacklist.

Basically permissions have to be reset for the folder and files contained within inorder for the that folder to become available again.If not the application is toast

This is currently a standard install for some MSIL BitCoinMiners doing the rounds on some dark places on the web.Thankfully they are not mainstream malware(more common)

Sadly, and what I forgot to mention to hack. Is Malwarebytes currently is useless on his PC since it reset the permissions. (I don’t think Combofix fixed his (MBAM.exe) perms.)

Anyways, This Trojan is quite a pain to remove. And the fight is still raging between Essex + His tools and the Malware. Thank you soo much Essex for helping Bailey!

[Pondus]

@essexboy post:6

Good to hear, surprised MBAM is lagging

It depends how old it is, MBAM only want fresh samples …and they often remove detection when they see all AV vendors detect it

[system]

Just because avast doesnt detect it normally it doesnt mean it missed it.

Always execute the file in VM with avast installed a lot of times the backend filerep or evo-gen catches them very quickly.Dont forget deepscreen too.