Stealth virus is stealthiest of all - Printable Version +- VadaVaka (https://vadavaka.com/forums) +-- Forum: General Forums (https://vadavaka.com/forums/forumdisplay.php?fid=5) +--- Forum: General Stuff (https://vadavaka.com/forums/forumdisplay.php?fid=38) +--- Thread: Stealth virus is stealthiest of all (/showthread.php?tid=1660)

Stealth virus is stealthiest of all - FuzzyShoting - 07-15-2004 Stealth virus is stealthiest of all By John Leyden Published Wednesday 14th July 2004 09:31 GMT There's a new mass mailing virus in town, and it's built to make life even more difficult for anti-virus researchers. Atak uses a variety of tactics in its attempts to escape antivirus analysis. Its main trick is to check to see if it's being run in a debugging environment. If so, it exits to avoid detection. The ploy prevents casual perusal of the code by researchers and (potentially) rival virus writers. A possible bug, related to the way Atak checks its activation date, prevents it from being run in a "sandbox". A sandbox is a virtual environment commonly used by AV researchers to look at the behaviour of malware in a safe place. "I haven't seen such ruses used in a mass mailer in a long time. This piece of code is so sloppy, it's devious," said Mircea Ciubotariu, a researcher at Romanian AV firm BitDefender. Aside from its stealth behaviour the virus is a fairly standard mass mailer. It infects Windows PCs only (natch). Atak is spreading, albeit modestly, and most AV firms rate it as a low-to-medium risk threat. ® Stealth virus is stealthiest of all - FuzzyShoting - 07-15-2004 Link: http://www.theregister.co.uk/2004/07/14/at..._stealth_virus/