[k.huwig-uzLfvktjjWQmtGqREZrilLZUOV2mLxNinvHxlEJAGuMnyg0gEGQvImqvcF6p10795ekYBFJJPmM@public.gmane.org

> Do you mean that I must search for viruses that are compressed by UPX,
> Petite and writes some code to a segment to execute it then?

Many worms are UPX-compressed.  However, the UPX compression code is (usually)
not a part of the worm and it is not variable, so all instances of the worm
will look identical.  To detect those samples, you do not need UPX unpacking.

However, if someody takes an existing virus or worm and UPX compresses
that, an anti-virus program will not recognize the compressed file unless
can handle UPX compression, which can either be hardcoded or done by
emulating the decompression of the program itself.

-- 
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
Author of F-PROT   E-mail: [email protected]       fax:   +354-540-7401


-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND