funsec mailing list archives

Re: Question about Viruses


From: "Dude VanWinkle" <dudevanwinkle () gmail com>
Date: Fri, 7 Jul 2006 16:51:32 -0400

On 7/7/06, Drsolly <drsollyp () drsolly com> wrote:
We used to call this situation "dual infected files, but what would happen
more often, was a "virus sandwich". The virus checks something
about the file and doesn't infect it doubly (true for nearly all viruses).
But if a second virus infects the file, it will often mask that marker, so
the first virus would reinfect. Then the second virus would infect again.
Then the first, then the second, ... and so on. So you could have a
situation where you'd peel off layer after layer of infections, before
eventually getting down to the original file.


Cool beans! Thats what I was looking for, thanks 'Solly!

-JP
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.


Current thread: