| Simon Finnigan 2007-09-03, 1:19 pm |
| "kony" <spam@spam.com> wrote in message
news:ullnd3taos5sfcj1r56nk899qvlfcapr8s@
4ax.com...
> On Mon, 3 Sep 2007 09:32:28 +0100, "Simon Finnigan"
> <SimonFinnigan@Hotmail.Com> wrote:
>
>
>
> One of modern sophisticated malware's strength's is that it
> seeks to be, and remain, hidden. Consider it a goal, that a
> virus writer was seeking to avoid detection through common
> means.
>
> To think "I didn't find it and therefore it doesn't exist"
> is just vanity, not proof.
>
> You have pointed out another important test, that there is
> no network traffic, but so it would also be with many
> malwares, like the types attached to office documents or
> BHOs, untill the associated application is ran, it will be
> dormant.
>
> If you would rather think it paranoid to be cautious, you
> have already lost the security race, because it is all about
> a certain level of paranoia, preparing for things before
> they happen, seeing the potential for problems regardless of
> whether you see an active exploit.
>
> To back up a bit, let's consider what any intelligent
> malware author would do. They would assess contemporary
> meaures used to detect malware. They would deliberately
> take note of what YOU would do, and design such that it
> didn't reveal itself under those tests. What does this
> really mean? All your scanners are useless if the malware
> has not been detected and reported, and enough time has
> passed for it to be added to databases of the scanners you
> use. What it really means is, the scanners you use came as
> a result of someone who actually WAS infected already. If
> you think you are the exception from the rule, that only
> someone else would be infected before a virus was widespread
> enough to be added to a database for detection scanning, you
> are not knowing anything, only playing odds that you are
> luckier than most. If your system had low risk, it might
> be enough, but nevertheless it is no proof, only a arrogant
> assumption that you know what you have not found, must not
> exist.
Ok, so nothing has shown up at all, and every scan performed on the machine
declares it free of any infection, exactly what is the malware on the
machine doing? It`s not sending anything out over the network at all, it`s
not modifying any files on the PC, so what is it doing?
|