[markusg]

removed from infected pc:
http://www.virustotal.com/file-scan/rep ... 1290354194
http://camas.comodo.com/cgi-bin/submit? ... 76158b4c20

[Jaxryley]

XP VM CPU goes to 100% and stays there.

Managed to grab several droppers which are the same size with some packed slightly different

Each has a different product version and MD5.

Droppers.rar

Pass:
infected
(143.64 KiB) Downloaded 53 times

For hidden exes you could use the below batch file to unhide if run from where they reside. May have to run it a couple of times for them to show up.

Code: Select all

ATTRIB -R -S -H *.exe

[Meriadoc]

Something is probably keeping files hidden until its suspended. vb bleh.

[EP_X0FF]

Malware copies itself to Documents and Settings\UserName and runs in background through HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, turning off view for files with "System" attribute. Primitive VB stuff.

Topic title changed to be more informative.

http://virscan.org/report/02657ae87137b ... 3d6ab.html