RE: [Full-Disclosure] MyDoom download info

[Steve Wray <steve.wray@paradise.net.nz>]

> From: full-disclosure-admin@lists.netsys.com 
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of 
> first last
[snip]
> >
> >IIRC there are viruses that are encrypted and are almost impossible
> >to disassemble?
> >
> >Would that be true?
> >
> 
> Sobig.F was packed with tElock. It's a PE file protector. It 
> "encrypts" the program's code and data, and tries to detect debuggers
before 
[snip]
> to successfully unpack the program. All they really needed to 
> do was dump it from memory while it was running and they could've
analyzed 
> it immediately with any disassembler.

Forgive me, I am no assembly hacker nor much of a programmer, 
but would it be possible for a program to 'react' in some way
were one to try to dump it from memory?


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html