Auto-Protect and ''hidden protected operating system files''

 (Although this happened with N 360, it shares the same engine so I'm opening the thread here for better exposure. Mods, could you please let it stay here?)

 

Today N360 cleaned a USB stick I carried home from work. It cleaned an autorun.inf file and two Trojan.Horse executables, one in the root of the stick, one in the notorious (and on a USB flash drive, unneccessary) hidden RECYCLER folder.

 

However, something happened later that I think I've noticed before, but haven't bothered to write about it yet.

 

After the initial cleaning, I unchecked the 'Hide protected operating system files' option in Explorer (Folder and Search Options),

 

Inside the hidden RECYCLER folder there was another one, ''system hidden'' folder with a recycling bin shell icon. As I proceded to erase it, N 360 then 'noticed' another malware executable from the Hacktool.Flodder family inside that folder and erased it.

 

The interesting thing here is that Auto-Protect 'saw' this file only after I had made it visible to myself.

 

There have been many cases here on the forums where pieces of malware 'evaded' the antivirus engine. Could this be the reason - that Auto-Protect doesn't seem able to see inside a 'system hidden' folder unless the user has opted to make it visible in the shell?

 

I didn't have the oportunity to check this, but the scanning engine doesn't have this 'disability', right? 

Message Edited by TomiRed on 04-28-2009 06:24 PM
Message Edited by TomiRed on 04-28-2009 06:44 PM