[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [Full-Disclosure] MyDoom download info



Given that its possible for a program to detect that its being run under
a debugger,
wouldn't it be possible for a virus to behave differently in the debug
environment?

Yes. But todays computer viruses are very simple and very weak. Wait a few years and they should be a lot more powerful.


[...]
IE: how do you know that the behavior you see in the lab reflects
behavior in
the real world? (I get a kind of 'schrodingers cat' deja vu).

You can always disassemble the virus, which is what people will do if it's a real "popular" one such as MyDoom. Then you know for sure what it's going to do. Viruses are very easy to understand because they're so small compared to the average windows program.


_________________________________________________________________
What are the 5 hot job markets for 2004? Click here to find out. http://msn.careerbuilder.com/Custom/MSN/CareerAdvice/WPI_WhereWillWeFindJobsIn2004.htm?siteid=CBMSN3006&sc_extcmp=JS_wi08_dec03_hotmail1


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html