Full Disclosure mailing list archives
RE: MyDoom download info
From: "first last" <randnut () hotmail com>
Date: Fri, 30 Jan 2004 22:26:15 +0000
Given that its possible for a program to detect that its being run under a debugger, wouldn't it be possible for a virus to behave differently in the debug environment?
Yes. But todays computer viruses are very simple and very weak. Wait a few years and they should be a lot more powerful.
[...]
IE: how do you know that the behavior you see in the lab reflects behavior in the real world? (I get a kind of 'schrodingers cat' deja vu).
You can always disassemble the virus, which is what people will do if it's a real "popular" one such as MyDoom. Then you know for sure what it's going to do. Viruses are very easy to understand because they're so small compared to the average windows program.
_________________________________________________________________What are the 5 hot job markets for 2004? Click here to find out. http://msn.careerbuilder.com/Custom/MSN/CareerAdvice/WPI_WhereWillWeFindJobsIn2004.htm?siteid=CBMSN3006&sc_extcmp=JS_wi08_dec03_hotmail1
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: MyDoom download info, (continued)
- RE: MyDoom download info Steve Wray (Jan 30)
- Re[2]: MyDoom download info Papp Geza (Jan 30)
- Re: MyDoom download info Scott Taylor (Jan 30)
- Re: MyDoom download info Daniel Spisak (Jan 30)
- Re: MyDoom download info Scott Taylor (Jan 30)
- Re: MyDoom download info Valdis . Kletnieks (Jan 31)
- Re: MyDoom download info Oliver Schneider (Jan 31)
- Re: MyDoom download info Daniel Spisak (Jan 30)
- Re: MyDoom download info Roland Dobbins (Jan 31)
- RE: MyDoom download info Steve Wray (Jan 30)
- mydoom.exe decyphering? Danny (Jan 31)
- Re: [Full-Disc]: mydoom.exe decyphering? Anders (Jan 31)
- RE: MyDoom download info first last (Jan 30)
- RE: MyDoom download info Steve Wray (Jan 30)
- Re: MyDoom download info Valdis . Kletnieks (Jan 31)
- Re: MyDoom download info Paul Schmehl (Jan 31)
- RE: MyDoom download info Steve Wray (Jan 31)
- RE: MyDoom download info Bojan Zdrnja (Jan 31)
- RE: MyDoom download info Steve Wray (Jan 30)
- Re: MyDoom download info Puneet Arora (Jan 31)
- RE: MyDoom download info Steve Wray (Jan 30)