Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail From: tom Newsgroups: comp.lang.javascript Subject: Re: This is a VIRUS - how does it works? Date: Thu, 06 Apr 2017 23:54:01 +0200 Organization: A noiseless patient Spider Lines: 43 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Injection-Info: mx02.eternal-september.org; posting-host="60768a12c350c2a33d21c772357ac465"; logging-data="28987"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1/rBYvDJLhzdJKSiu+LIxxT" X-Newsreader: Forte Agent 1.93/32.576 English (American) Cancel-Lock: sha1:/EVmTrMsS10FPgjyJGyQPHShHnE= Xref: csiph.com comp.lang.javascript:32951 to Stefan, but to everyone too: in the meanwhile, for analyzing purpose, I used "Recuva" and another recovery software (but not performing the longest scan because it would have required more than 20 hours...) on my machine to try to undelete - the "bbb.png" file - and the suspected "mswKs.exe" (I spoke about it in my very first post) but with no result; so I grabbed the "bbb.png" file provided by Stefan a post ago and had a scan at virustotal.com site; this is the result https://www.virustotal.com/it/file/f5fc3d694ce407203bd1471c75a02f12ddf88cd124fd8e05dad79956209fd650/analysis/ As we can see, Avast, SpyHunter and Malaware didn't not recognized it, and this is a bad news for me, because I used these antivirus few days ago to try to detect something related to this virus... Note: I also tried to run the "bbb.png" file: I renamed it "bbb.exe" file (a nice icon appeared...) and executed it on an old Windows 98 machine with few monitoring tools, but the file istantly crashed and performed nothing (my Windows 98 machine reported no differeneces at all after that execution)