OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: [Full-Disclosure] Microsoft Update Loader msrtwd.exe

From: Jan Muenther (jan.muenthernruns.com)
Date: Thu Sep 02 2004 - 01:30:07 CDT

> google came back with a forum to do with sdbot; however, the file was
> listed as "Morphine".

Morphine is not a virus or malware in itself, it's a tool for PE binary en-
cryption, self-decrypting on execution. It actually places the whole
source image into the .data section of a newly produced file.
Basically, this should hinder your virus scanner from recognizing what this
binary really is, since it only matches on the pattern for the Morphine engine
itself.

See http://rootkit.host.sk

Regards,

J.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html