SoftwareMisuse1 - page 18 of 49

Home

Print document

13 14 15 16 17 18 19 20 21 22 23

Backdoor.Win32.Rbot.IN

The results were sad; only one antivirus detected the encrypted Agobot sample

and two antivirus products detected Bagle sample.

NOTE: It seems to me, that the Ikarus antivirus has false positive detection, as

two samples were detected as the same virus.

As my initial test showed, using commercial software protection programs by

virus writers can pose significant problems (technical and non-technical) to

antivirus programs in their mission to detect malware.

An interesting idea come into view after this test – when I execute a file with the

protection of the SoftwarePassport demo version, the pop-up window appears.

This pop-up has just one button "OK", when I press it - protected program starts.

Therefore, it can be anti-emulation technique against antivirus software, because

the execution flow stopped in the code decryption section waiting for the user

input and only then – the code is decrypted and protected program starts.

2.3 A detour around Antivirus software or how “legally”

change PE files, intercept API calls, inject DLL and

First, when I see this, I probably overreacted and did not believe that this is for