Urgent! A "killdisk" like virus that doesn't need Admin rights to run.

[zopzop]

This is pretty scary. Lot’s of talk about it on the Wilder’s Security forum, the link to the thread is here :

New sandbox/virtulization bypass under ring3

It defeats many virtualization and HIPS programs. I wanted to know if Comodo v3 with D+ enabled would catch it before it wrecks the computer. Can anyone with a test machine or one of the Comodo devs look into this? I just recently received the file.

I’ve attached the file to this message, I don’t know if this violates board rules since this is my first post here (but if it does moderator please delete the file).

If this violates the board rules, I can email it or give you the rapidshare link to it.

[Ragwing]

@Paulo post:1

• Live Malware. Comodo is in the business of helping secure the internet, not distributing malware. Thus, it is not the appropriate place to attach or link live malware (viruses, trojans, rootkits, etc) to posts. In general, a link to the download site for ‘malware’ tests/demos and other ‘proof of concept’ applications are acceptable, provided they are not intended or designed to cause harm to a computer.

I’ve deleted it from your post, but if anyone should be interested, you could PM them a rapidshare link.

Cheers,
Ragwing

[ubuntu]

Don’t worry, Comodo stopped it, It’s just no more a low level disk access sample.

http://img184.imageshack.us/img184/5890/passdisk1ou5.png

http://img184.imageshack.us/img184/1926/passdisk2aq1.png

http://img184.imageshack.us/img184/9397/passdisk3jp1.png

[zopzop]

awesome! thanks for that ubuntu! :BNC