[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: gpel at mpex.net (Gregor Lawatscheck)
Subject: Backdoor not recognized by Kaspersky
Suresh Ponnusami wrote:
> Another variant against the Netsky virus. It's is packed with
> UPX. It spreads with the password protected zip file, which
> gets bypassed through all most all the AV scanners with
> latest signature updates because No AV can decrypt it
> without the password. (though password is in the message
> content), we humans tend to open it after reading the message.
Kaspersky, NAI and possibly some other AV-vendors now parse the password
from the body of the email to extract the zip and then scan it.
Obviously this only helps if it can scan the complete email i.e. on the
mailserver. They might need to adapt to new varitions of how the
password is included in the body, which will take some analysis when new
variants emerge.
Powered by blists - more mailing lists