North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: Warning - new trend of attempts to infect ISP users (possibly virus)

  • From: Kevin Oberman
  • Date: Wed Mar 03 12:53:55 2004

> Date: Wed, 3 Mar 2004 16:15:39 +0000 (GMT)
> From: "Stephen J. Wilcox" <[email protected]>
> Sender: [email protected]
> 
> 
> > > Erm is it me or are the writers of Bagle and Netsky determined to keep morphing 
> > > their code to outwit the virus scanners.. is this a new trend in virus writing - 
> > > beat the systems by evolving your code quicker than the security firms can 
> > > release updates?
> > 
> > new trend in that it started only a decade ago?
> 
> Perhaps I'm only following this as its affecting us more, but I dont recall a 
> time previously when I've had so many viruses hitting us and getting thro our 
> scanners with nothing we can do about it. I dont recall seeing viruses with 
> variants as high as 'j' before, especially in the relatively short time since 
> the previous variants were out
> 
> Seriously, drop some references if I'm off-track.. its just my perception and 
> I'm not an expert at all with viruses...

They are getting batter at it, but the WANK worm (1989) used
self-modifying code so that no two replicas were the same. (Note: This
worm only infected VMS systems running on the global DECNET internet,
mostly DOE, NASA, and DEC corporate systems.)
-- 
R. Kevin Oberman, Network Engineer
Energy Sciences Network (ESnet)
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)
E-mail: [email protected]			Phone: +1 510 486-8634