W32.SafeSys.Worm

[Jaymz]

Used search on the entire forum and also this sub-section,but I didn't find anything related to SafeSys virus...

Here's a download link for it,if you want to examine it..

Notice that ALL THE FILES IN THE PACKAGE ARE INFECTED!

The package is password protected,so it does not do any harm to your computer...

Quote:

"The worm is called W32.SafeSys.Worm and attacks a particular program called Deep Freeze.

Deepfreeze is a computer protection utility that prevents malicious code from writing to the hard drive itself. Any malicious code is written to a memory buffer which then gets erased upon reboot. The original hard drive data is untouched and can simply be reloaded during bootup.

The W32.SafeSys.Worm bypasses the Deep Freeze method and writes data to the buffer, which then enables direct writing to the hard drive sectors. Thus allowing full access to the PC's hard drive."

http://rs659.rapidshare.com/files/245210018/SafeSys.rarArchive password: SafesysCRC-32: 5136200f
MD4: 1c5acc095590b39e0b7dd1eda034e518
MD5: d545356e2015a610354e42d7a8c8e62d
SHA-1: 9782010c91dc8a7e2145a1d4d2e1bc9b1f957819

whatever you do with it,you do it at YOUR OWN RISK,

Do not blame ME.

edit: I encourage anyone downloading this to test the files in a SAFE

environment eg. a sandbox or virtual machine ..

edit2: as for my own testing in a VM, Vipre Antivirus did not block all of them exe's and the

machine got infected.. Avast finds the threat in all of them files..

Edited September 13, 2010 by Jaymz

[JMC31337]

heres the same rar archive

rar passwd: virus

thnx Arab reversing Team for this one...

SafeSys.rar

شكرا

shokran

Edited September 26, 2010 by JMC31337