Re: Win32/RAMNIT.A Anyone?

Article View: alt.comp.virus

Article #215

#215

From: FromTheRafters
Date: Thu, 05 Aug 2010 11:39

26 lines
3629 bytes

"~BD~" <BoaterDave~no.spam~@hotmail.co.uk> wrote in message 
news:yfqdnRgR46DJw8fRnZ2dnUVZ8nidnZ2d@bt.com...
> FromTheRafters wrote:
>
>> Viruses are rather unique
>
>
> Being pedantic and specific, FTR - explain why viruses are not simply 
> 'unique' - are they is some way /rather/ special? ;-)

In addition to being an auto-distribution method for other code, being 
self-replicating affords them the opportunity to change their appearance 
with every iteration (self-polymorphism). In this way one beast can 
result in a large number of cryptographic hashes. In addition to that, 
the code is often inserted inside the program files of other programs 
thus making detection (and hash matching) even more difficult. They are 
not unique in being polymorphic as polymorphism in other distribution 
methods such as hosting malware on a server can be achieved by 
server-side code that changes their appearance with each download.

So, they are not unique in having the ability to change their 
appearance, and they are not unique in their ability to self-replicate 
because computer worms, bacteria, and rabbits are also self-replicating 
code examples.

So, I felt that *rather unique* was the best choice of wording IMO.

Technical Details

Message-ID: <i3e7ug$vmj$1@news.eternal-september.org>

Path:

arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!feeder.erje.net!eternal-september.org!.POSTED!not-for-mail

References:

<i2lolb$s5r$1@news.eternal-september.org>   <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org> <8ND5o.33941$o27.31443@newsfe08.iad> <i37ec5$2pa$1@news.eternal-september.org> <J3j6o.48696$3%3.27633@newsfe23.iad> <JJm6o.931$1v3.218@newsfe20.iad> <i3cvbj$kiq$1@news.eternal-september.org> <yfqdnRgR46DJw8fRnZ2dnUVZ8nidnZ2d@bt.com>

Show Full Headers

Complete Article Headers

X-Google-Thread: fcd68,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 111298,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: 115dc1,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Thread: fa874,b851b95f3c6d1e77
X-Google-NewGroupId: yes
X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet
X-Google-Language: ENGLISH,ASCII-7-bit
Path: arc1-ca.pugleaf.net!g2news1.google.com!news3.google.com!feeder.news-service.com!feeder.erje.net!eternal-september.org!.POSTED!not-for-mail
From: "FromTheRafters" <erratic@nomail.afraid.org>
Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet
Subject: Re: Win32/RAMNIT.A Anyone?
Date: Thu, 5 Aug 2010 07:39:56 -0400
Organization: A noiseless patient Spider
Lines: 28
Message-ID: <i3e7ug$vmj$1@news.eternal-september.org>
References: <i2lolb$s5r$1@news.eternal-september.org>   <i2ns3d$ser$1@news.eternal-september.org> <i2nvud$mfo$4@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org> <8ND5o.33941$o27.31443@newsfe08.iad> <i37ec5$2pa$1@news.eternal-september.org> <J3j6o.48696$3%3.27633@newsfe23.iad> <JJm6o.931$1v3.218@newsfe20.iad> <i3cvbj$kiq$1@news.eternal-september.org> <yfqdnRgR46DJw8fRnZ2dnUVZ8nidnZ2d@bt.com>
Injection-Date: Thu, 5 Aug 2010 11:40:00 +0000 (UTC)
Injection-Info: mx03.eternal-september.org; posting-host="VQzj2mX5cUzDxBbN6QCb7A";
 logging-data="32467"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+u2S0UxI8NL2or8RFbN1CX"
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5931
X-RFC2646: Format=Flowed; Response
X-Newsreader: Microsoft Outlook Express 6.00.2900.5931
Cancel-Lock: sha1:Y6pfYVK6zRx+dcaZXKvSY0iZ9GQ=
X-Priority: 3
X-MSMail-Priority: Normal

Reply to Parent Message