I caught the Neuroquila virus

[whs]

Norton alerted me of this bugger whilst I was browsing the forum. Norton has quarantined it. But I wonder whether anybody ever saw this bugger and whether it could have further consequences. It seems to originate from my home country Germany - which does not make it more likeable.

 

[AussieGuy92]

that's interesting you were browsing the forum when you caught it? hope i dont get it

 

[Dinesh]

Norton and F-Secure definitions are capable of removing this virus completely. Good to know that you're using Norton.

 

[Tews]

This complex virus infects EXE files, hard disk MBRs and diskette boot sectors. On hard disks, the virus encrypts the original MBR and moves it to a different part of the disk, writing its own code in its place. Since the new MBR of an infected hard disk does not contain partition data, the hard disk cannot be seen after a clean diskette boot, and FDISK /MBR will make the machine unbootable.

source

Wolfgang.... This looks like a really nasty virus .. I wouldnt take any chances with this one. Do you have a system image that you can restore??

 

[thathagat]

Norton alerted me of this bugger whilst I was browsing the forum.

Neuroquila
NAME: Neuroquila
ALIAS: Wedding, Havoc, Neurobasher
TYPE: Stealth EXE-files MBR
SIZE: 4644-4675
ORIGIN: Germany
REPAIR: No


This complex virus infects EXE files, hard disk MBRs and diskette boot sectors. On hard disks, the virus encrypts the original MBR and moves it to a different part of the disk, writing its own code in its place. Since the new MBR of an infected hard disk does not contain partition data, the hard disk cannot be seen after a clean diskette boot, and FDISK /MBR will make the machine unbootable.

Neuroquila also encrypts the DOS boot sector on hard drives, making recovery even more difficult. On diskettes, the virus formats an additional track on which its stores its code.

Neuroquila, which is also known by the names Neuro.Havoc and Wedding, tries to load its code to the upper memory area. If there is no upper memory area available, the virus enlarges the stack memory area (STACKS) and places its code there. Neuroquila uses tunneling techniques to by-pass anti-virus programs

Neuroquila is a polymorphic virus. It contains a complex polymorphic engine which is capable of creating several different decryption modules. The variation of the decryption routines is based on the system's clock. While in memory, the virus employs versatile stealth virus techniques to hide the changes it has made to the boot sectors and files. When infected files are examined in a clean environment, they can be seen to have grown by 4644-4675 bytes.

Neuroquila is also a retrovirus. It mounts attacks against several anti-virus programs. If VIRSTOP or DOSDATA.SYS (a QEMM utility program) are loaded from CONFIG.SYS, the virus prevents them from being started. Neuroquila tries to modify the programs TBDRIVER, TBDISK, VSAFE and -D while they are in memory, and alters the partition protection created by the TBUTIL program. In addition to this, the virus is able to by-pass the error message Windows gives of a 32-bit disk operation mode, a stumbling block of many other boot sector viruses.

After Neuroquila has resided in a computer for some months, it displays the message:

HAVOC by Neurobasher'93/Germany
-GRIPPED-BY-FEAR-UNTIL-DEATH-US-DO-PART-

See: Tremor, Alphastrike, Nightfall

[Based on analysis by Stefan Kurtzhals]

 

[whs]

This complex virus infects EXE files, hard disk MBRs and diskette boot sectors. On hard disks, the virus encrypts the original MBR and moves it to a different part of the disk, writing its own code in its place. Since the new MBR of an infected hard disk does not contain partition data, the hard disk cannot be seen after a clean diskette boot, and FDISK /MBR will make the machine unbootable.

source

Wolfgang.... This looks like a really nasty virus .. I wouldnt take any chances with this one. Do you have a system image that you can restore??

I have system images. I make one every morning. But since Norton quarantined it and the system seems to work normally, I will still watch it for a while. But this may be a long term threat. I have sent a PM to Corinne to get her opinion on it.

 

[Tews]

More than likely, you will be ok... Im just anal about stuff like that, once infected, I always restore to my latest backup image... better safe than sorry..

 

[whs]

More than likely, you will be ok... Im just anal about stuff like that, once infected, I always restore to my latest backup image... better safe than sorry..

You have a good point. Especially as this bugger seems to linger around dormant for a few weeks befor it starts it's act. I will wait for Corinne's opinion - she is the expert.

 

[Jacee]

edb.chk is a checkpoint file InformIT: Understanding Active Directory Services > Active Directory Support Files
This may be a false/positive on Norton's part

 

[whs]

edb.chk is a checkpoint file InformIT: Understanding Active Directory Services > Active Directory Support Files
This may be a false/positive on Norton's part

Yeah I saw that too. But I am just a little leary about the thing. Are you sure it is harmless?

 

[Jacee]

Can you upload the quarantined file for Norton to check out?
You can also upload it here VirSCAN.org - Free Multi-Engine Online Virus Scanner v1.02, Supports 36 AntiVirus Engines! and have it scanned

 

[whs]

I am not certain whether I caught the right thing:

 

[Corrine]

From what I've seen, the path c:\windows\serviceprofiles\localservice\appdata\roaming\peernetworking is for HomeGroup on Windows 7.

 

[whs]

So I guess it is a false positive as Jacee suspected. Thank you.

 

[Jacee]

WHS, I'm pretty sure it's a F/P, but upload the file and have it scanned using the link I gave you above. I don't pull files apart to investigate, so your zipped file doesn't do any good just sitting there. You need it scanned and analyzed by the people who do that sort of thing.

 

[Corrine]

I agree with Jacee (as is probably expected ).

 

[whs]

I did scan the file online and it was all negative - no problems. Results file attached (PDF). Thanks everybody for helping to clarify this.

 

[Jacee]

You're welcome