Dear All
Currently i had encounter a nasty virus, the virus will hide the .doc file and create .exe with the same name as per hidden file(attached pic)
Cuurently from the study of this virus i found it might be the same family for w32.mibling.
i tried to copy the .exe and submit to symantec, however the first time we able to copy, but the second time we cannot copy or even get the md5 value from the file.
The .exe i believe it had change the file ownership or it had been execute
The effected client we had isolate from the network & disable the autorun.inf. Currently we still looking for the source.
While i tried to submit the sample to Security Response Team, however the file size had shrink to 0bytes from it's original 166bytes.
Did you all had encouter such virus or can provided any advice for a newbie to me?
Thanks
CHHOWA
Malaysia
