Reply
Contributor
lordergf
Posts: 24
Registered: ‎01-16-2010
Accepted Solution

Win32/LockScreen bypass again SONAR 4 !

[ Edited ]

Hi, Norton community. I use the latest version of Norton 360 and this file lock my PC without any reaction of Norton!
OS Windows 7 sp1 32 bit Ultimate fully patched!

https://www.virustotal.com/file/d38139a47125eaa8df527b80ced9acd633d53f069600275eb309b3718667386c/ana...

Bot Obliterator
Quads
Posts: 13,919
Registered: ‎07-21-2008

Re: Win32/LockScreen bypass again SONAR 4 !

Are you wanting help breaking the Winlock??

 

Quads

Contributor
lordergf
Posts: 24
Registered: ‎01-16-2010

Re: Win32/LockScreen bypass again SONAR 4 !

No, thanks. I fixed this problem .

Bot Obliterator
elsewhere
Posts: 1,148
Registered: ‎05-30-2009

Re: Win32/LockScreen bypass again SONAR 4 !

Were you actively testing this malware? If so, then please advise the path of the directory that this malware sample was launched from eg: C:\Users\Public\Downloads.

 

Thanks

 

Contributor
lordergf
Posts: 24
Registered: ‎01-16-2010

Re: Win32/LockScreen bypass again SONAR 4 !

I downloaded this file with Internet download manager in archive. Then i started file in this directory: C:\Users\URIEL\Desktop.

And my PC was locked.

 

Bot Obliterator
elsewhere
Posts: 1,148
Registered: ‎05-30-2009

Re: Win32/LockScreen bypass again SONAR 4 !

Thanks

 

If you run this file from a location other than 'C:\Users\URIEL\Desktop', does SONAR block it? If it does, then this is a known issue. Please see the following thread for details:

 

http://community.norton.com/t5/Norton-Internet-Security-Norton/Sonar-4-problem/m-p/640165/highlight/...

Contributor
lordergf
Posts: 24
Registered: ‎01-16-2010

Re: Win32/LockScreen bypass again SONAR 4 !

[ Edited ]

SONAR totally fail on this file ! Location does not matter!

Bot Obliterator
elsewhere
Posts: 1,148
Registered: ‎05-30-2009

Re: Win32/LockScreen bypass again SONAR 4 !

Consider uploading the infected file to Symantec Security Response:

 

https://submit.symantec.com/websubmit/retail.cgi

 

If you do this, then please let us know the outcome.

Contributor
lordergf
Posts: 24
Registered: ‎01-16-2010

Re: Win32/LockScreen bypass again SONAR 4 !

[ Edited ]

I uploaded infected file a week ago and no result..  https://www.virustotal.com/file/d38139a47125eaa8df527b80ced9acd633d53f069600275eb309b3718667386c/ana... Plamen Stamenov This message is an automatically generated reply -- do not reply to this message. This system is designed to analyze and process suspicious file submissions into Symantec Security Response and cannot accept correspondence or inquiries. Your submission (xxxxxxx) has been received and is being processed. Please reference this tracking number in any future correspondence. --------------------------------------------------------------------------- Customer Notes --------------------------------------------------------------------------- Lock my PC Trojan Ransom

 

Contributor
lordergf
Posts: 24
Registered: ‎01-16-2010

Re: Win32/LockScreen bypass again SONAR 4 !

[ Edited ]

 Finally SONAR  detected and removed  this file.