Full Disclosure mailing list archives
Re: Microsoft Update Loader msrtwd.exe
From: Jan Muenther <jan.muenther () nruns com>
Date: Thu, 2 Sep 2004 08:30:07 +0200
google came back with a forum to do with sdbot; however, the file was listed as "Morphine".
Morphine is not a virus or malware in itself, it's a tool for PE binary en- cryption, self-decrypting on execution. It actually places the whole source image into the .data section of a newly produced file. Basically, this should hinder your virus scanner from recognizing what this binary really is, since it only matches on the pattern for the Morphine engine itself. See http://rootkit.host.sk Regards, J. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Microsoft Update Loader msrtwd.exe S.A. Birl (Sep 01)
- Re: Microsoft Update Loader msrtwd.exe James Tucker (Sep 01)
- Re: Microsoft Update Loader msrtwd.exe Jan Muenther (Sep 02)
- Re: Microsoft Update Loader msrtwd.exe Harlan Carvey (Sep 01)
- Re: Microsoft Update Loader msrtwd.exe joe smith (Sep 01)
- Re: Microsoft Update Loader msrtwd.exe Joe Stewart (Sep 02)
- <Possible follow-ups>
- RE: Microsoft Update Loader msrtwd.exe Todd Towles (Sep 01)
- Re: Microsoft Update Loader msrtwd.exe S.A. Birl (Sep 02)
- RE: Microsoft Update Loader msrtwd.exe Todd Towles (Sep 02)
- Re: Microsoft Update Loader msrtwd.exe James Tucker (Sep 01)