Servieca.vbs Virus even the famouse antivirus can't detect

[gasparmx]

Recently my PC in Mexico got infected by an annoying virus who replaces every file in usb with shortcuts. Avast can't detect this thing, bypassed my Avast Internet Security. Im kinda annoyed because i tought Avast could protect me for everything, anyway i leave this.

A tutorial how to eliminate this annoying virus called Servieca.vbs http://www.taringa.net/posts/hazlo-tu-mismo/15946707/Como-eliminar-el-Virus-Servieca_vbs-Crea-Accesos-Directos.html

I atacched the file Servieca.vbs anyway im uninstalling it manually. Even the famouse antivirys Bitdefender and avast can't detect this thing.


All files on my usb are like this.
C:\Windows\system32\cmd.exe /c start Servieca.vbs&start mumble-1.2.3a.msi & exit

Malwarebytes, Kaspersky, Bitdefender detects nothing even adwcleaner 2.0 show my pc as clean.
Im scared of put my usb on my pc because this virus can back.

Servieca
Link removed

[Pondus]

Im kinda annoyed because i tought Avast could protect me for everything, anyway i leave this.

no security program have 100% detection....and never will

if you have a infection problem....
follow the guide here and attach the logs.   http://forum.avast.com/index.php?topic=53253.0

[Pondus]

Avast can't detect this thing, bypassed my Avast Internet Security.

https://www.virustotal.com/file/dbc0ec30e3dc431ff9c7559479901ee6fd0a7298bf16148e10004efaf12c1b68/analysis/1355484806/

Sendt avast lab   

[polonus]

Hi gasparmx,

Break that second link as hxtp pr wXw, so the unaware wont click through, please.
Quttera flagged this as potentionally suspicious file:
/js/master_85930.js
File size[byte]:   
553962
Severity:   
Potentially Suspicious
Details:   
Detected procedure that is commonly used in suspicious activity.
Reason:   
Too low entropy detected in string 'undefined|undefined|undefined|undefined|undefined|undefined|undefined|undefined|undefined|undefined|' of length 5119 which may points to obfuscation or shellcode.
MD5:   
4E6D0946F43611FAEE3F6E62D42CBB0A
Quttera scan results

polonus

[DavidR]

@ gasparmx
I don't believe the link should be broken, it should be completely removed.

Samples should be sent directly to avast not hosted on a file sharing site where you have no control over who can download it or what they might do with it.

It has already been sent to the avast labs, so that mediafire link can now be removed completely.

[polonus]

Agree with DavidR,

Better to remove that link alltogether, as these should be send directly to virus AT avast dot com. Always remember that malcreants look over our shoulder here as well,

polonus

[polonus]

Consider this concerning detection: http://f.virscan.org/Servieca.vbs.html
analysis: http://anubis.iseclab.org/?action=result&task_id=197664c88c0074f440199f6016e45619b

polonus

[true indian]

https://www.virustotal.com/file/dbc0ec30e3dc431ff9c7559479901ee6fd0a7298bf16148e10004efaf12c1b68/analysis/
Even the big K kaspersky doesnt get it

[magna86]

@ gasparmx

This is a new type of infection. MCShield is a program that will prevent and disinfect any infection that comes with a USB device.
Although he has able to see, disinfect and remove this malware (due to MCShield detecting heur. routines) these days MCShield has been fully optimized for this type of malware.

---------------------------------




Download MCShield from one of the following links:

MyCity -  Official download link
Softpedija - Mirror download link

• Double click MCShield-Setup to install the application.
  
• Wait a few seconds to MCShield finish initial scan.

Recommendation to under General and Scanner tab you click on Defaults button to choose recommended options.

• Connect your USB storage devices to the computer one at a time. Scanning will be done automatically.

When all scanning is done, you need to attach a logreport that has made MCShield.

Start -> All Programs -> MCShield -> Logs

Attach here -> AllScans.txt

Explanation: USB storage devices are all the USB devices that get their own partition letter at connecting to the PC,
e.g. flash drives (thumb/pen drives, USB sticks), external HDDs, MP3/MP4 players, digital cameras,
memory cards (SD cards, Sony Memory Stick, MultiMedia Cards etc.), some mobile phones, some GPS navigation devices etc.


--------------------------




It would be good to check OS for malware. Read these instructions for running AdwCleaner, OTL and aswMBR tool and attach here their reports for review.
http://forum.avast.com/index.php?topic=53253.0

[essexboy]

Hi Magna86 where do I go to report a false positive ? 

It is detecting Reatogo.exe as infected, this is part of the programme I use with OTLPE to work outside of windows
http://www.reatogo.de/REATOGO.htm

[magna86]

Hi essexboy,

You may report FP to MCShield author's.

This is MCShield support mail.

MCShield.Support|AT|gmail.com (replace |AT| with @).

(dr_Bora is mostly behind the mail)
Thanks for reporting.