can malware execute itself on safe mode ?

[Guest]

[ganda]

 (:WAV)hi all,
i've read it in another forum (non comp/security forum)
the virus name is : Worm.VBWorm.NUJ AKA. Moontox Bro.
so is it true?

Ganda

 

[Soyabeaner]

May I ask you a question firstly?   Why is a now-security expert asking this question?  Is it to tease us non-techie folks?

Googling "Worm.VBWorm.NUJ AKA. Moontox Bro.", I found only 2 search results leading to http://www.vaksin.com/2007/1107/moontox-bro.htm

[ganda]

  i forgot that i'm an expert now.

Googling "Worm.VBWorm.NUJ AKA. Moontox Bro.", I found only 2 search results leading to http://www.vaksin.com/2007/1107/moontox-bro.htm

oh, so it's true    . www.vaksin.com is indonesian Norman Virus control website. i hope Defense+ can block it.

[Soyabeaner]

I forgot to answer your thread title question: Nothing is impossible

Some related threads (doesn't necessarily answer your question, but revolves around it):
http://boards.cexx.org/index.php?topic=15787.0;prev_next=prev
http://www.windowsmaven.com/Scan_Virus_Spyware_Safe_Mode.htm
http://wiki.castlecops.com/Malware_Removal:_Trojan_Removal_Programs

They basically state that most malware can't load in safe mode.  "Most" does not = "All".

[ganda]

I forgot to answer your thread title question: Nothing is impossible

i hate the answer

They basically state that most malware can't load in safe mode. 

i prefer this

of all viruses in all countries, and indonesian create this virus  , why don't they just make some tofu 

[Soyabeaner]

of all viruses in all countries, and indonesian create this virus  , why don't they just make some tofu 

Don't you be giving the malware programmers any ideas now. *cough* tofu.32.virus *cough*

[ganda]

, so the name "tofu" has already taken

[Toggie]

Wonder how long it will be before there's a 'soya' virus

[hbobeck]

not there yet? hmmm surprising....

Harry

[Japo]

The safe mode loads as few services as possible to make Windows go, but it has to load some...

[MorphOS REBOL]

So there's the answer, I guess. Only a thought....

Yes, "correctly" and "professionally" programmed malware would, of course, and not only in theory, be able at any time to start itself, even if, as a user, being on "safe mode". Yes, of course it's true. And it's a serious problem within this Billy OS, methinks....
(Sorry to say so, but a lot of malware able to exchange sys files would be capable of doing so...)

That's the reason for real preventive software being needed more than ever. The better your preventive measures, the lesser the chance for your sys getting "zombified"...

Cheers, though

The REBOL

[ganda]

Cheers, though

no cheers for malware,but.........okay   

[Info-Sec]

(:WAV)hi all,
i've read it in another forum (non comp/security forum)
the virus name is : Worm.VBWorm.NUJ AKA. Moontox Bro.
so is it true?

Ganda

 

As far as i know, its impossible.  Especially because when booting into safe mode, the internet drivers, and several other crucial drivers/services dont load when in safe mode.  If the worm does start up, it is most likely a very crippled version: 

1) most likely dosnt function just runs
2) prob. lost its stealth

Ect, ect.  No worries, actually booting into safe mode has been known to permanantly disable some viruses.  O.o

[ganda]

As far as i know, its impossible.  Especially because when booting into safe mode, the internet drivers, and several other crucial drivers/services dont load when in safe mode.  If the worm does start up, it is most likely a very crippled version: 

1) most likely dosnt function just runs
2) prob. lost its stealth

Ect, ect.  No worries, actually booting into safe mode has been known to permanantly disable some viruses.  O.o

really ? i love you info-sec 

[Info-Sec]

really ? i love you info-sec 

Np np man.  If you want to get rid of the worm try a system restore.  It may not eliminate the whole worm, but it will most definatly kill its main components so its more useless then well, norton.  (if thats possible )

[Tags:]