No coffee, but here's another Bagle

TalkBack 9 of 20:

Next »

« Previous

• Thread View
• Flat View

Encysted code, maybe?

I'm thinking that the worm would be able to create an undetected piece of code to await activation, something that makes no changes on the machine, but just sits there looking like something else and awaiting a password. A scan would find an ordinary, harmless seeming little file.
An anti-virus company investigation would be able to see any changes to Windows, but maybe not something inactive. The problem is, they have the virus code, and should be able to tell that it's adding the trojan file. But I've also read that parts of the code of worms are encrypted, so maybe they can't read everything. And maybe the worm writer has arranged that the trojan file is activated by the action of the antivirus in removing the worm.
Anyway, I think we're missing something important.

By the way, the leaked windows code isn't that extensive, and as another news story shows, it's being looked at closely for vulnerabilities revealed. I don't think worm writers could count on getting much valuable information from it. Other leaks, though...

Posted by: Anton Philidor   Posted on: 02/18/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Get top-ranked Novell support for Red Hat when you switch Novell If Linux is going to power your mission-critical applications, you'd ... Download Now
• Using Log Messages and Alert Actions in Dell OpenManage Server Administrator Dell Dell OpenManage Server Administrator has an excellent logging feature that ... Download Now
• Selecting the Right NAS Appliance for Your Workgroup LAN Dell Data storage is a major concern for enterprises today. Network attached ... Download Now