Tuesday, June 29, 2010

Sad, Relieved and Perplexed Panda

Ok, I found -a- source of the w32.Downadup.B worm.

It was sitting in the Ecolab computer after all.

I ran a test today and jammed the thumbdrive in, brought it upstairs for my sacrificial office PC to check, and voila, w32.Downadup!autorun detected (G:\autorun.inf)

To my mild disgust, it did not detect the worm itself, lying fallow in G:\RECYCLER\s-randomstringofnumbers\jwgkvsq.vmx

Being masochistic, I tried the not-updated-since-19-Nov-09 (which is the last time I caught a worm in the office, from the kitchen lab) Malwarebytes' Anti-Malware program, and though it scanned 3 files, it was unable to detect it as a worm!

Interestingly enough, at the same time it was rifling through the files, Symantec Endpoint Protection popped up and went alert alert threat detected, w32.Downadup.B, and 2-3 minutes later, it was promptly automatically cleaned by deletion.

It may have been brought in from copying over this NUS guy's video files about mosquito larvae... but that was... last week or the week before.

The good news is that I have been slacking on transferring anything out of the thumbdrive after that, so it has been lying fallow, and I don't think I put it into any of my own home systems.

Count me mildly relieved.

Also a little stressed out, since that means I can't rely on just Malwarebytes and maybe I will have to try Kaspersky and/or AVG for the volunteer laptop.

It's currently running the SLOWEST attempt at Bitdefender Online Scanner I've ever seen - either it's already infected and the virus is putting horrible obstacles in its path, or it is a pathetic powerless netbook with a wireless adapter not worth speaking of, or both.

After this, I have to go be more masochistic and check the other lab computer because I am just hopelessly paranoid. I'm not even in MIS, but rrrr, if I don't check these things, who will?

All I need is one brainfart, and I will end up infecting my home system by accidentally plugging in tab A into slot B without realising it's previously been somewhere else unsavory. So it is rational self-interest to have anything my thumbdrive could come into contact with, scrupulously clean. Yeeccch.

No comments: