Doin’ the eagle rock

2010-03-01

Peter Ferrie

Microsoft, USA

Editor: Helen Martin

Abstract

If a file contains no code, can it be executed? Can arithmetic operations be malicious? In W32/Lerock we have a file that contains no code, and no data in any meaningful sense. All it contains is a block of relocation items. Peter Ferrie untangles the mystery.

The full article is available to registered users. Click here for free registration or, if you already are a registered user, login to access the full article.

Magazine


	March 2010 PDF Please register to download the PDF Comment Why flash web pages are like collateralized debt obligations News HMRC addresses security Microsoft tackles Waledac Mcafee growth plan unveiled Malware prevalence report January 2010 Malware analyses Doin’ the eagle rock BackDoor.Tdss.565 and its modifications (aka TDL3) Conference report The 26C3 Congress of the Chaos Computer Club Tutorial Memory analysis - examples Product review CA Internet Security Suite Plus 2010 Comparative review VBSpam comparative review Calendar Anti-malware industry events See also Virus Bulletin archives How to become a subscriber Reprints

Quick Links

Poll

The Japanese government is reported to have commissioned a 'defensive virus'. Is 'defensive' malware ever a good idea?
Leave a comment
View 11 comments

VB100 certification


	This month's VB100 test saw some major changes and a radical overhaul of the VB100 test methodology - for the first time allowing products to use their 'cloud' look-up systems. John Hawes has all the details. See full results.

Virus Bulletin currently has 224,243 registered users.

Fighting malware and spam

Doin’ the eagle rock

Peter Ferrie

PDF

Comment

News

Malware prevalence report

Malware analyses

Conference report

Tutorial

Product review

Comparative review

Calendar

See also