Trouble is coming - Case in point.

[thehorse13]

For those who have read a few posts I have made here in the past about what certainly is coming down the pipe (because I feel that most of the releases in the past year are nothing more than tests for horribleness yet to come), I have gathered some info from a very reliable source about polymorphic viruses that will be coming to a theatre near you...

For reference purposes:
http://www.antionline.com/showthread...335#post740335

Author: Dr3f (You probably dont know him -- I only know of one other virus that he has coded - WM.NotFam)
Name of virus: Win32.Voltage
Detected: Not yet.. he says it 'may' be in the wild, but he hasn't released it yet.
It is written in ASM and is about 3800 lines of code (I dont have the source.. but that is how long he said it was)
Description: (From Dr3f) My new worm has the follow capabilities: global resident,PE\RAR infector,polymorphic with EPO feature,has mail worm that spoof address,that send itself to all temp inet files addresses and to all friends in the WAB.
Win32.Voltage is infected over a script encoder in this sample.
It drops a copy of the original virus as the name wvltg.exe into the system directory.
I found this interesting as it is a polymorphic, file infecting, mass mailing worm. There aren't many of these floating around.

[Cybr1d]

BRING IT ON!

thats all I can say...other than that...we're fukced :*(

[mjk]

What exactly does polymorphic mean? Is it like - the worm can change its executable so it still operates but escapes AV's?

[Jabberwocky]

polymorphic means that each time the virus copies itself, the fingerprint looks a little different, like varying the size or pattern of the executable. it does that so it's harder for av software to detect.

[mjk]

polymorphic means that each time the virus copies itself, the fingerprint looks a little different, like varying the size or pattern of the executable. it does that so it's harder for av software to detect.

Ah, that's what I thought. Thanks for the clarification

mjk

[Tedob1]

oh boy! what an accomplishment. his folks must be so proud.

[Axeman]

I wonder how well the anti-virus companies are going to handle this. I agree with cybr1d.

[Cybr1d]

Well I'm guessing the usual, Wreck havoc for a while just like melissa and code red and whatnot, and then get fixed, and then have about 100 new people on AO asking us how to fix their problem *whatever might the virus cause*

[Axeman]

I bow to your ability to read the future OH Great One. (bow,bow,bow dance around fire.)

[Cybr1d]

can you do a rain dance?