The Mudcat Café TM
Thread #102133   Message #2068733
Posted By: JohnInKansas
04-Jun-07 - 10:07 PM
Thread Name: Tech: Comp Virus Crush 'Em 2.0
Subject: RE: Tech: Comp Virus Crush 'Em 2.0
A Google search for "Crush 'Em" (with the quotes) plus ".exe" (without the quotes) will find some information on a potential malware called "screensaver.exe."

Of 19 variants of the "screensaver" found in circulation by spywaredata, only one is classed as other than "?Safe"

One of the variants found (a ?Safe one) loads:

[%PROGRAM_FILES%]\bearpaw 4800ta pro\crush em\bin\
[%PROGRAM_FILES%]\scanexpress a3 usb\crush em\bin\
[%program_files%]\mvvr-100\crush em\bin\
[%PROGRAM_FILES%]\packard bell diamond 2400\crush em\bin\
[%PROGRAM_FILES%]\diamond 1200plus\crush em\bin\

There is no known source for this "program," however the packard bell diamond 2400 and diamond 1200plus are obsolete Packard Bell scanners. So far as I can determine, Packard Bell no longer manufactures or sells any scanner in their line of trash1 and offers NO SUPPORT for ones it's dropped, so anyone who has one of these scanners would have to resort to "random web sources" for a driver for it. This package could have come as part of a "bundle" when a driver was downloaded(?). There is no indication that this "screensaver" has any known viral or other malware content.

The single "screensaver.exe" that shows as a threat is listed as produced and distributed by a company called "MacSourcery." The download is called simply "[%PROGRAM_FILES%]\downloads\" and should be caught by any current AV/Antimalware protections either at download or at first attempt to open any files in the folder. The source also perhaps implies a "Mac Only" malware. No "crush 'em" files are indicated, but they could possibly be contained in the folder shown, since no detailed file list is given.

Note that one of the other ?Safe "screensaver" sources is Macromedia, which is generally considered a safe, if buggy, producer.

1 I'm aware that Packard Bell is a fairly popular maker in the UK, and perhaps elsewhere; but they were literally run out of the US several years ago for producing random/undocumented hardware changes, using used parts and selling them as new, and for nonexistent support. Hopefully, for those who may have patronized them, they're better now.

John