Win.32.Lamy. Any information on this?

[hotfusion]

My son has just been alerted that one of his files (fruityloops.exe) is infected with the 'win.32.Lamy' virus.
I've never heard of it, and it's a mystery how it managed to slip in without real-time monitoring picking it up. Has anyone got any info on this one such as mode of propagation, payload, registry changes and damage etc? My suggestions are what I would try myself. If incorrect, I welcome corrections to my rather limited knowledge. Andy.

 

[FatesWebb]

I ll bet that was a heuristics detection as I have never heard of any LAMY virus, but LAMY could be a heuristics characteristics code. in other words only heuristics will catch it too. also this means it COULD BE a false detection. what AV suite detected it? FatesWebb

if you do what I suggested it is not my fault...

 

[Kento]

It must be a new virus cause nobody that I could find in a quick search has any info on it yet but it is real...

http://securityresponse.symantec.com/avcenter/venc/dyn/33243.html

 

[Kento]

My Norton's virus definitions detect it as W32.Lamy.gen. eTrust Antivirus and noculateIT detect it as WIN32/LAMY.1751 and WIN32/LAMY.1813 as shown here:

http://support.ca.com/techbases/ilnt/31033.html

 

[Kento]

That link for eTrust Antivirus and InoculateIT got meesed up there so here it is again:

http://support.ca.com/techbases/ilnt/31033.html

or

http://216.239.39.100/search?q=cach...om/techbases/ilnt/31033.html+lamy+virus&hl=en

 

[hotfusion]

Thanks for that link. That'll tell me what I want to know.
Cheers. My suggestions are what I would try myself. If incorrect, I welcome corrections to my rather limited knowledge. Andy.

 

[hotfusion]

Addition to previous post:
This virus is classed as newly detected, but it must have lain undetected in the host file for nearly a year. It was also present in an executable used to install a program - undetectable in this state, but when a re-install was initiated, an alert was issued.
We may hear more of this one yet then.......... My suggestions are what I would try myself. If incorrect, I welcome corrections to my rather limited knowledge. Andy.