ABUNDO: What is it?

[Kral]

I just noticed a folder C:\abu, which contains the following files:
ABUNDO.exe
ABundo.bat
LIST9.bat
Are these malware?

 

[Malke]

I just noticed a folder C:\abu, which contains the following files:
ABUNDO.exe
ABundo.bat
LIST9.bat
Are these malware?

I Googled for all of those file names and only see your post. You can do
a couple of things:

1. Right-click the .bat files and Open With>Notepad. Make sure you don't
check the box that says "Always open with this program" (if you get it).
Since .bat files are in text, perhaps that will give you a clue as to
what they are and do.

2. If #1 doesn't help, send the ABUNDO.exe file to VirusTotal. They will
submit it to numerous antivirus companies for identification and send
you a report. Then post back with the findings.

http://www.virustotal.com/


Malke

 

[Detlev Dreyer]

I just noticed a folder C:\abu, which contains the following files:
ABUNDO.exe
ABundo.bat
LIST9.bat
Are these malware?

Any malware can have any filename and therefore, the filename is not
really the criteria in contrast to the virus definition signature. Update
your anti-virus and your anti-spyware software and let it run. BTW, you
failed to check the .exe file's properties and the content of the .bat
batch files in order to get some information about those files' origin.

 

[Colin Barnhorst]

Probably an undo file for a program that has AB for initials. Do you have a
program that sounds like that installed?

 

[Confusing Advice]

That's incorrect. Any malware can NOT have any filename. Malware must be an
executable type file other wise it's useless. What use would "Malware.txt" be
to a malicious software writer? None.

And as far as checking a file's properties to check it's origins. That is
incorrect too. File properties can be faked and may mean nothing.

And I don't what you mean by "the criteria in contrast to the virus
definition signature". Makes absolutely no sense whatsoever to me and
probably not to him either.

All encompassing statements, bad advice and bad english equal confusion. May
want to pick up a book on English Composition and take some courses in
computer technology before giving advice.

 

[Detlev Dreyer]

That's incorrect. Any malware can NOT have any filename. Malware must
be an executable type file other wise it's useless.

Nope. Just some examples:
http://antivirus.about.com/cs/allabout/a/bmpagent.htm
http://www.bluesbrotherscentral.com/forum/archive/index.php/t-2106.html

What use would "Malware.txt" be to a malicious software writer? None.

As for other extensions, check with your temp directory. Many *.tmp files,
for instance, are *executable* files (DLLs) which cannot be deleted since
they are in use. In fact, additional software downloaded by malware comes
as *.tmp files in many cases and giving them a *.txt extension instead
wouldn't be a problem.

And as far as checking a file's properties to check it's origins. That is
incorrect too. File properties can be faked and may mean nothing.

Although file properties can be faked, that's extra work for the creator.
Therefore, malware does not have any file information usually. When there
are file properties available, however, it's pretty easy to find the
related software under add/remove programs in most cases.

And I don't what you mean by "the criteria in contrast to the virus

^^^^^^^^^^^^^^^^ that's good english?

definition signature". Makes absolutely no sense whatsoever to me and
probably not to him either.

Why don't you use the keywords "virus definition signature" for a Google
search - you'll get many hits.

All encompassing statements, bad advice and bad english equal confusion.
May want to pick up a book on English Composition and take some courses
in computer technology before giving advice.

No comment.

 

[Confusing Advice]

You see this is a perfect example of how "Confusing Advice" propagates.

) Point 1:

You provide this link as proof.
http://antivirus.about.com/cs/allabout/a/bmpagent.htm

First, look at the author's background. She has no BS in Computer Science.
At the least she should have a major security certification. She has neither.
She "pursued" some programming courses. I pursued "medical courses". It
doesn't make me a doctor.

This guy is talking about files residing on his computer. That link talks
about attachments in emails that "drop" and "executable" file to the
computer. You're talking apples we're talking oranges. Just proves what I
stated that malware is useless unless it is in executable form.

) Point 2

You said "As for other extensions, check with your temp directory. Many
*.tmp files, for instance, are *executable* files (DLLs)"

I got news for you, a DLL is not an executable. DLLs are called by
"executables". And as far as a tmp being an executable it is not. It is a
temporary instance of another file. It the other file does not exist neither
does the tmp.

) Point 3

You said: "Although file properties can be faked, that's extra work for the
creator." So in other words I was right again. When we're talking about
malware we need to indicate they can be fake and you didn't. I did.

In summary: I work with so many people that are totally confused because
they get confusing advice from people like you. Be sure of what you say
before you say it. I think Microsoft should require users to be certified in
the areas they are offering advice in. Of course, if they did few of you
would be here with me would you?

Be careful about what you advise. Big fancy words do not equal good advice.

 

[alohatim]

Probably an undo file for a program that has AB for initials. Do you have a
program that sounds like that installed?

Colin: I think you are right. I found this folder on the root drive of a
client's PC. The PC's owner had used something called Alohabob PC Relocator.
I will bet it is related to that.

Aloha