Full Disclosure mailing list archives
Re[2]: MyDoom download info.
From: Papp Geza <pappgeza () tolna net>
Date: Sat, 31 Jan 2004 16:04:47 +0100
Hello last 2004. január 31., 13:07:27, írtad:
It's still UPX packed, but it won't unpack with "UPX -d" because theauthorused a simple UPX scrambler. Either undo what he did or unpack itmanually
This below VMware run and legalized this also we can at that time we be aware of because well, already. So that the worm is one selfextract archiv file. Infect only so for the first time when if form himself executing unfolds. This coming-out really infects dared infection to be little, what the, MyDoom b contains.letter worm executing (29,184 byte) inside. The AV we can industry stock, to send always virus.zip form. One yet undiscovered bug in the MyDoom b over there may be, how.letter code, but I do not calculate, so that encrypted would be able spreading. Encrypted you process if intensively worm that way you anatomize, MydoomB division several enkrypted also is between internally codes code. I deem, so that this within is not classified other, as: biddings. This I mean this so, how core worm is our task, and execution's time she. Since the author does not undo utilize UPX scramblin, the UPX D. Either you want what unpacked you did you undo simpler, if this hand-held to see, may not be to know to see all the code. True runs, how this the lightest road towards anybody inexpert this him only dump the memory one file when the virus. I am aware of to deem, the anti-virus companies could this what already every virus? Time found between two virus little, but during this little time prospectors plenty of information. More prolonged assaying confirmed after this him. Must deem she virus, infection, while the UPX packed malware "dared "UPX D"will not unpack this. True MyDoom b gave up letter as by this somebody other agendum. UPX D does not work so which must do one problem must not be she hand-held. This disassemble beautifully and then natural, how to be challenge, and non other. Anybody would mean collect can not BASIC lingua knowledge, MyDoom and any other virus his gear, their codes. The encrypted are codes the fascinating: may not be to be aware of, so that within is hide. Virus's writing how bidding yet decoded solves and somebody this, shock due will be aware of that what awaiting virus. -- Üdvözlettel, Geysap mailto:pappgeza () tolna net www.gyik.com "VIRUS CORE TEAM" ==================================== Fiat justitia, pereat mundus! ------------------------------------ we protect your digital worlds... ==================================== _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- MyDoom download info. Feher Tamas (Jan 31)
- <Possible follow-ups>
- RE: MyDoom download info. first last (Jan 31)
- Re: MyDoom download info. jan . muenther (Jan 31)
- Re: MyDoom download info. first last (Jan 31)
- Re: MyDoom download info. jan . muenther (Jan 31)
- Re[2]: MyDoom download info. Papp Geza (Jan 31)