http://www.theregister.co.uk/2004/07/14/atak_stealth_virus/
There's a new mass mailing virus in town, and it's built to make life even more difficult for anti-virus researchers.
Atak uses a variety of tactics in its attempts to escape antivirus analysis. Its main trick is to check to see if it's being run in a debugging environment. If so, it exits to avoid detection. The ploy prevents casual perusal of the code by researchers and (potentially) rival virus writers.
A possible bug, related to the way Atak checks its activation date, prevents it from being run in a "sandbox". A sandbox is a virtual environment commonly used by AV researchers to look at the behaviour of malware in a safe place.
"I haven't seen such ruses used in a mass mailer in a long time. This piece of code is so sloppy, it's devious," said Mircea Ciubotariu, a researcher at Romanian AV firm BitDefender.
Aside from its stealth behaviour the virus is a fairly standard mass mailer. It infects Windows PCs only (natch). Atak is spreading, albeit modestly, and most AV firms rate it as a low-to-medium risk threat.
**************** *****************************
Kiggundu Mukasa # Computer Network Consultancy###
KYM-NET LTD. # Intranets & Internet Solutions#
Plot 80 Kanjokya Street
P.O. Box 24284 Kampala, Uganda
Tel: +256 77 972255
+256 71 221141
Fax: +256 31 262122
*****************************************************************
