Article View: alt.comp.virus
Article #216Re: Win32/RAMNIT.A Anyone?
From: ~BD~
Date: Thu, 05 Aug 2010 12:14
Date: Thu, 05 Aug 2010 12:14
31 lines
4082 bytes
4082 bytes
FromTheRafters wrote: > "~BD~"<BoaterDave~no.spam~@hotmail.co.uk> wrote in message > news:yfqdnRgR46DJw8fRnZ2dnUVZ8nidnZ2d@bt.com... >> FromTheRafters wrote: >> >>> Viruses are rather unique >> >> >> Being pedantic and specific, FTR - explain why viruses are not simply >> 'unique' - are they is some way /rather/ special? ;-) > > In addition to being an auto-distribution method for other code, being > self-replicating affords them the opportunity to change their appearance > with every iteration (self-polymorphism). In this way one beast can > result in a large number of cryptographic hashes. In addition to that, > the code is often inserted inside the program files of other programs > thus making detection (and hash matching) even more difficult. They are > not unique in being polymorphic as polymorphism in other distribution > methods such as hosting malware on a server can be achieved by > server-side code that changes their appearance with each download. > > So, they are not unique in having the ability to change their > appearance, and they are not unique in their ability to self-replicate > because computer worms, bacteria, and rabbits are also self-replicating > code examples. > > So, I felt that *rather unique* was the best choice of wording IMO. > > Not a point to argue about - I accept your choice, FTR :)
Technical Details
Message-ID:
<reKdnQOXleWHNsfRnZ2dnUVZ7v-dnZ2d@bt.com>Path:
arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news2.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!nntp.bt.com!news.bt.com.POSTED!not-for-mailReferences:
<i2lolb$s5r$1@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org> <8ND5o.33941$o27.31443@newsfe08.iad> <i37ec5$2pa$1@news.eternal-september.org> <J3j6o.48696$3%3.27633@newsfe23.iad> <JJm6o.931$1v3.218@newsfe20.iad> <i3cvbj$kiq$1@news.eternal-september.org> <yfqdnRgR46DJw8fRnZ2dnUVZ8nidnZ2d@bt.com> <i3e7ug$vmj$1@news.eternal-september.org>Show Full Headers
Complete Article Headers
X-Google-Thread: fcd68,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 111298,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: 115dc1,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Thread: fa874,b851b95f3c6d1e77 X-Google-NewGroupId: yes X-Google-Attributes: gid67dc2eda8a,gide9d2b45abe,gidb181582988,gidaa617e85ca,domainid0,public,usenet X-Google-Language: ENGLISH,ASCII-7-bit Path: arc1-ca.pugleaf.net!g2news1.google.com!news1.google.com!news2.google.com!Xl.tags.giganews.com!border1.nntp.dca.giganews.com!nntp.giganews.com!local2.nntp.dca.giganews.com!nntp.bt.com!news.bt.com.POSTED!not-for-mail NNTP-Posting-Date: Thu, 05 Aug 2010 07:14:18 -0500 Date: Thu, 05 Aug 2010 13:14:18 +0100 From: ~BD~ <BoaterDave~no.spam~@hotmail.co.uk> User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.11) Gecko/20100701 SeaMonkey/2.0.6 MIME-Version: 1.0 Newsgroups: alt.comp.virus,alt.comp.anti-virus,microsoft.public.security.virus,ba.internet Subject: Re: Win32/RAMNIT.A Anyone? References: <i2lolb$s5r$1@news.eternal-september.org> <i2o1or01uos@news2.newsguy.com> <56e3916c-4af4-41a6-9f65-ea55a89369fa@i28g2000yqa.googlegroups.com> <i2o47d0214h@news2.newsguy.com> <dYP3o.40115$3%3.20843@newsfe23.iad> <tE74o.32165$OU6.25112@newsfe20.iad> <i2rksi028go@news3.newsguy.com> <Crj4o.33326$Bh2.32962@newsfe04.iad> <i2sopq01lhf@news4.newsguy.com> <L0p4o.32466$OU6.4877@newsfe20.iad> <Xns9DC6C5344186EHHI2948AJD832@69.16.185.247> <i32s10$653$1@news.eternal-september.org> <Xns9DC7745224A99HHI2948AJD832@69.16.185.247> <ILj5o.44119$4B7.2363@newsfe16.iad> <toGdnU4lcMazdsjRnZ2dnUVZ8hidnZ2d@bt.com> <Xyo5o.41721$OU6.25986@newsfe20.iad> <i358na$sbq$1@news.eternal-september.org> <8ND5o.33941$o27.31443@newsfe08.iad> <i37ec5$2pa$1@news.eternal-september.org> <J3j6o.48696$3%3.27633@newsfe23.iad> <JJm6o.931$1v3.218@newsfe20.iad> <i3cvbj$kiq$1@news.eternal-september.org> <yfqdnRgR46DJw8fRnZ2dnUVZ8nidnZ2d@bt.com> <i3e7ug$vmj$1@news.eternal-september.org> In-Reply-To: <i3e7ug$vmj$1@news.eternal-september.org> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Message-ID: <reKdnQOXleWHNsfRnZ2dnUVZ7v-dnZ2d@bt.com> Lines: 31 X-Usenet-Provider: http://www.giganews.com X-AuthenticatedUsername: NoAuthUser X-Trace: sv3-HqNQw5kzTlQRTpEOPaoydmLNlchvSFOKfaRMoP8DTyQIj9a+nLaWpB3IYditRwazBS8WW/BPsCYPwwb!2Q9iJIbkKWPUqVFJRACD8NhuoS6RU3URmStoXdlZno4UgZjJ3eFETrW5H5IWpVS+SOa8jZhVFssI X-Complaints-To: abuse@btinternet.com X-DMCA-Complaints-To: abuse@btinternet.com X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your complaint properly X-Postfilter: 1.3.40