I'm looking for Internet Security 2010. This is the rogue malware that changes the Winlogon registry entry to winlogon32.exe. I need this infection to test our security software to ensure it does not remove the infection and render our PCs unbootable with userinit.exe missing from the Winlogon reg key. The Winlogo32.exe infected file would suffice.

I'm looking for Internet Security 2010. I need this for testing purposes of our security software. The winlogon32.exe file would suffice.

The malicious doc mail has been sent to the organization.I am analyzing it but it don't contain any malicious VB script but officemalwarescanner does show it as creating
Api-Name GetTempPath
Api-Name CreateFile
Api-Name CloseHandle
Api-name WriteFile

I am trying to find any shell code if any .

i have posted the doc file at h__p://www.offensivecomputing.net/?q=ocsearch&ocq=aada36da206a13ed56979c1a6838a1e6.

http://www.av-expert.in/wordpress/?p=104

I am looking for this malware in order to demonstrate how it works and proper removal for a seminar I am going to hold.

Look for detailed analysis of Induc virus with source code:

http://virgentools.blogspot.com/2010/01/tracing-infecting-code-in.html

I recently ran across some malware on a site and am trying to figure out how it works. I've been trying to unpack the original file I downloaded, but haven't been having much success. The original executable deletes itself and creates another executable in C:\WINDOWS\system32. Attempts to disassemble it with IDA, ollydbg, and PE Browse all don't work. I've put what dumpbin has to say at the bottom of the post. I figure it's packed somehow. Any tips? I've uploaded the file, you can find it here:

http://www.offensivecomputing.net/?q=ocsearch&ocq=2d7a7bceac89a0ae7c6edcbf62252bc5

Could you tell me about how to remove this malware ?

When I manually edit and delete this file or registry,
the access denial message is displayed.
When I check attribute command for this file,
I cannot change any attribute for this.

trace:
c:\windows\system32\drivers\fzbilwy.sys

registry:
HKLM\System\CurrentControlSet\Service\fzbilwy

regards
-hisaki

Would love to get my hands on a copy of this. McAfee has it....

http://www.wired.com/threatlevel/2010/01/operation-aurora