funsec mailing list archives
Re: Question about Viruses
From: "Dude VanWinkle" <dudevanwinkle () gmail com>
Date: Fri, 7 Jul 2006 16:51:32 -0400
On 7/7/06, Drsolly <drsollyp () drsolly com> wrote:
We used to call this situation "dual infected files, but what would happen more often, was a "virus sandwich". The virus checks something about the file and doesn't infect it doubly (true for nearly all viruses). But if a second virus infects the file, it will often mask that marker, so the first virus would reinfect. Then the second virus would infect again. Then the first, then the second, ... and so on. So you could have a situation where you'd peel off layer after layer of infections, before eventually getting down to the original file.
Cool beans! Thats what I was looking for, thanks 'Solly! -JP _______________________________________________ Fun and Misc security discussion for OT posts. https://linuxbox.org/cgi-bin/mailman/listinfo/funsec Note: funsec is a public and open mailing list.
Current thread:
- Re: Overloading AV software, was Question about Viruses, (continued)
- Re: Overloading AV software, was Question about Viruses Dude VanWinkle (Jul 07)
- Re: Overloading AV software, was Question about Viruses Valdis . Kletnieks (Jul 07)
- Re: Question about Viruses Dude VanWinkle (Jul 07)
- Re: Question about Viruses Peter Kosinar (Jul 07)
- Re: Question about Viruses Drsolly (Jul 07)
- Re: Question about Viruses <...> (Jul 07)
- Re: Question about Viruses Axel Pettinger (Jul 08)
- Re: Question about Viruses Peter Kosinar (Jul 07)
- Re: Question about Viruses Drsolly (Jul 07)
- Re: Question about Viruses Dude VanWinkle (Jul 07)