I have some funny problem with this worm. It is not detected On-Access and not in the Chest (if i use Scan feature). But it is detected if i scan it with ashQuick (right-click).
Can anyone from Alwil contact me,so i’ll send you this problematic sample.
I’m using latest avast! 4.6.665 with VPS 0520-4
You can send it to me 
Thanks.
Sample sent 
The sample is heavily corrupted (well, “heavily”… the first 4 bytes of the file were overwritten, so it’s not a valid executable file anymore).
So, ashQuick detects it (since it has the “Scan whole files” flag set), but the resident protection does not because it (correctly) decides that it is not an executable file, so it doesn’t scan the file parts it would scan if it was an executable.
Thats odd. At first it was detected On-Acess and even in Chest,but i don’t know what happend later. I’ll try to dig the original sample again…
Sorry for confusion. File was ideed corruped when i found it again.
You can delete this topic so it won’t confuse other users…