Bryan Burns wrote > According to Trend: htm.exe, txt.exe, txt.scr > > According to McAfee: EXE, COM, SCR, PIF, BAT, CMD > > According to Symantec: exe, txt.exe, htm.exe, txt.scr, zip > > Hmm, I wonder who is right... Here's a generic explanation that may or may not apply to this specific case: Initial spammed distributions of email viruses do not always match the pattern of the virus itself. The malware author can easily send it out with one arbitrary set of extensions but have infected computers use a totally different set that is written into the worm. A description that is based on extensions seen in the wild will not necessarily match a description that is based on analysis of the worm's code. Worms, like any software, contain bugs of their own. They might also behave differently depending on characteristics of the infected computer. Many modern worms also have internal calculations that assign different probabilities to each permutation of itself that the worm might send out. Some worms update themselves from other infected systems or fixed web sites - so variable behaviors can possibly be introduced without actually generating an officially new variant. Different analysts may sometimes come to different conclusions about how the worm will actually behave on execution. Plus, the first quick description from any vendor frequently gets revised after further analysis. One approach to consider is not to rely on any fixed list of extensions for a specific worm, and instead mistrust any extension that invites execution. Even better, mistrust any file whose internal type allows execution.
