Re: Why not a changeling?

[11a () GMX NET (Bluefish)]

Hmmmm..
1. Morphing scriptviruses has been discussed in Bugtraq after the
   melisa problems IIRC. A semi-working morphing engine for VBA was
   developed and tested.
2. Morphing executable has been known for ages.

In case 2, the code can be written so that it will be somewhat close to
what some "legal" software does. Therefor, new virusscanners often rely on
decoding the virus and then checking the contest of the encrypted
software.

Case 1 is less researched as there is no (AFAIK) morphing script virus in
the wild. But if my memory is correct, an engine has been published in
bugtraq. (don't kill me if I'm wrong, not entirely certain)

..:::::::::::::::::::::::::::::::::::::::::::::::::..
     http://www.11a.nu || http://bluefish.11a.nu
    eleventh alliance development & security team