Re: MyDoom download info.

[jan.muenther () nruns com]

> It's still UPX packed, but it won't unpack with "UPX -d" because the author 
> used a simple UPX scrambler. Either undo what he did or unpack it manually 
> and you'll see all the code. 

It actually un-UPX-ed just fine for me. What version have you been trying?
It disassembled nicely after that. The only other obfuscation (apart from
quite a bit of wild jmp'ing around) is the rot13'ed strings, which isn't,
erm, too challenging. Anything else? I've only looked quickly at it during a
train ride.


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html