|
Posted by VanguardLH on March 15, 2008, 10:20 am
If you were Registered and logged in, you could reply and use other advanced thread options
>
> I've been searching far and wide for something to remove a piggyback
> from a program, but I'm having no luck. Does anyone here have
> something
> I can use for it?
>
> The problem is, that AV software these days are all able to
> recognise
> piggyback software like trojan droppers or downloaders, but, unlike
> the
> way it used to be, NONE of the AV suites out there are able to
> remove
> wrappers or loaders that drop this kind of stuff on your system.
> Usually
> they are very simple programs just slapped onto the original
> program, ...
Exactly. So how does any program know exactly where the code for the
wrapper ends and the code for the original program begin without
knowing the exact copy of the original program's code? There are way
too many programs and versions of each to be tracking the exact
codebase for them all. What if the malware "slapped" itself after the
80-byte exe header instead of including its own? Is the code splitter
supposed to keep the exe header that is somehow magically discovered
after whatever byte length for the prepended maleware code or is the
exe header at the start of the file to be retained and the one after
the magically discovered byte length to be removed? Just because some
AV programs attempt to disinfect a file doesn't mean they guess how to
do it correctly. Don't expect anti-malware programs to always return
you to a usable or prior state to the infection. Sometimes the amount
of effort to thoroughly get rid of a pest is more than doing a fresh
install of the OS and applications.
Besides, once identified, you yourself could easily just replace the
entire file with an original copy from your backups. If you don't do
backups then you have deliberately deemed your files as trivial and
reproducible. You could also install the program in a VM and yank a
copy of the file from there rather than have to uninstall and
reinstall on your host OS.
> --
> Signed: Moonchild
> (remove nospam. when replying!)
>
> "When one door closes another door opens;
> but we so often look so long and so regretfully upon the closed
> door,
> that we do not see the ones which open for us."
> , ,
> |\---/|
> / , , |
> __.-'| / \ /
> __ ___.-' ._O|
> .-' ' : _/
> / , . . |
> : ; : : _/
> | | .' __: /
> | : /'----'| \ |
> \ |\ | | /| |
> '.'| / || \ |
> | /|.' '.l \_
> snd || || '-'
> '-''-'
Geez, you have no concept of Usenet netiquette. Signatures should be
4 lines, OR LESS, in length.
| 
XML site map