AplusWebMaster
Topic Starter
FYI…
- http://www.websense.com/securitylabs/blog/….php?BlogID=113
Mar 12 2007 10:27AM ~ "Websense has been made aware of a malware affecting a bank in Norway. The original file is called "Logo_1.exe" and its MD5 is: FDA9408A56D97019DCEE36302CCEB6D1
The file is packed with a custom packer/protector, which we had never encountered before… The protected application doesn't run in a Virtual Machine (default configuration). Once this problem is fixed, it generates 1372 (!) exceptions in the loader to thwart debuggers, tracers, emulators, and so forth… One of the first things the malware does is to scan for security applications in memory… It kills several antivirus products, if they are found in memory, as well as some firewall products…"
(More detail at the Websense URL above.)
- http://www.websense.com/securitylabs/blog/….php?BlogID=113
Mar 12 2007 10:27AM ~ "Websense has been made aware of a malware affecting a bank in Norway. The original file is called "Logo_1.exe" and its MD5 is: FDA9408A56D97019DCEE36302CCEB6D1
The file is packed with a custom packer/protector, which we had never encountered before… The protected application doesn't run in a Virtual Machine (default configuration). Once this problem is fixed, it generates 1372 (!) exceptions in the loader to thwart debuggers, tracers, emulators, and so forth… One of the first things the malware does is to scan for security applications in memory… It kills several antivirus products, if they are found in memory, as well as some firewall products…"
(More detail at the Websense URL above.)