a virus that defies current sandbox/virtualization programs

[zopzop]

hello does bufferzone defend against the "killdisk" virus? the reason why i ask is, this virus was tested against vmware, sandoxie, and defensewall and they all could not stop it from infecting the MBR and wrecking the system.

edit:

i removed the link to the malware because a poster reminded me it's against the board guidelines. i will PM the link to the red team members.

[Uriel]

Dear Zopzop and all,

I am happy to announce that after having tested this virus inside BufferZone, the only thing it does is post an unreadable error message, nothing more.

Sincerely,
Uriel Ginsburg

[zopzop]

hello uriel, what version of bufferzone did you test it in: freeware, home (beta), or corporate (beta)? thanks

[Uriel]

Hello, zopzop and all.

I have tested it with BufferZone HomePro v1.90-11. However, the protection scheme which prevents the Killdisk virus from working is common to the home and corporate versions.

Sincerely,
Uriel Ginsburg

[zopzop]

thanks uriel, but can you tell me if the "Free" versions of bufferzone will defend against it? this is very important to know.

[Uriel]

Dear Zopzop,

That is a very important question. The answer is simply this: if you run BufferZone for Internet Explorer and you have downloaded the virus with Internet Explorer - BufferZone will protect against it. But if you run BufferZone for Internet Explorer and have downloaded the virus with eMule - BufferZone will absolutely NOT protect against it.

For short, BufferZone will protect against this virus, if you download it with an application already protected by BufferZone (Internet Explorer, P2P applications, eMail readers, etc.).

My advice, of course, is to have the complete version of BufferZone...

Sincerely,
Uriel Ginsburg.

[zopzop]

thank you for that reply uriel. yes i agree with you, obviously the full version (home) of bufferzone will protect better. i was worried that if i ran internet explorer and some webpage tried a drive by download of malware like that virus, that i'd be protected. this is good to know. thanks again.

[Guest]

thank you for that reply uriel. yes i agree with you, obviously the full version (home) of bufferzone will protect better. i was worried that if i ran internet explorer and some webpage tried a drive by download of malware like that virus, that i'd be protected. this is good to know. thanks again.

[INSANE_ORACLE]

stop repeating the post what he said... hes right what he said

[xaozon]

Sorry for off-topic, but does it really bypass vmware? I find this hard to believe.

[zopzop]

@xaozon

yes it does (or it did as of the date i posted). if you want, i can PM you a link to the virus. but i warn you, you'd better try it on a test system. it will destroy your MBR and make all partitions and the information on them unrecoverable.

[hamelame]

kindly sent me that link by PM !