[ Pobierz całość w formacie PDF ]
among many variants of the same worm is the different compression methods used. Worm
authors compile the worm and compress the newly created executable in a different compressed
.EXE file. When antivirus vendors detect it, the authors just recompress it with a different
algorithm and start the process again. There are hundreds of different compression algorithms to
use, which makes the detection of bot worms not an easy task.
Copyright 2005 by Trend Micro Incorporated. All rights reserved. Trend Micro and the t-ball logo are trademarks or registered trademarks of Trend
Micro Incorporated. TrendLabs is a service mark of Trend Micro Incorporated. All other company and/or product names may be trademarks or
registered trademarks of their owners. Information contained in this document is subject to change without notice.
>> TREND MICRO: THE FUTURE OF BOT WORMS
The tendency is, of course, to be able to detect different compression methods before isolating
specific detection patterns. Expect new advances on this in the coming months. Trend Micro is
already working in a scan engine that can detect compressed samples. Trend Micro scan engine
7.7 is expected to be released early next year, and it is designed to detect bot worms as soon as
they are being released thanks to this new detection technology.
Bot worms are the most dangerous pieces of malware currently in the wild. Users need to be
aware of them and the methods they use to infect other computers in order to prevent being
affected by them. This document tries to point out possible future attack avenues to raise
awareness about new technologies and their possible misuse.
About Trend Micro
Trend Micro Inc. provides centrally controlled server-based virus protection and content filtering products and services. By
protecting information that flows through Internet gateways, email servers, and file servers, Trend Micro allows companies
worldwide to stop viruses and other malicious codes at a central access point before they reach the desktop.
Copyright 2005 by Trend Micro Incorporated. All rights reserved. Trend Micro and the t-ball logo are trademarks or registered trademarks of Trend
Micro Incorporated. TrendLabs is a service mark of Trend Micro Incorporated. All other company and/or product names may be trademarks or
registered trademarks of their owners. Information contained in this document is subject to change without notice.
[ Pobierz całość w formacie PDF ]