'Stealth' Worm Hinders Sandbox Analysis

Tuxedo Jack writes "The Register reports that the new Atak worm cannot be analyzed or debugged by antivirus companies without quite a bit of work, due to the author being sloppy with his or her code. Windows machines, as per the norm, are the only vulnerable ones, and it still requires user intervention to infect. Perhaps future worms will start including this 'bug' in their releases. We can only hope not." It doesn't sound like a bug at all, from the virus writer's perpective.

Comments

Re:Mailers?

[JohnFluxx]

That doesn't mean it can't just starting changing random numbers slowly in a spreadsheet etc.
That would be incrediably damaging.

Re:More damaging.

[KilobyteKnight]

But I could imagine that making Windows just look a bit less stable (like, every now and then, a save from a random program destroys the file instead, programs start to crash randomly once in a while, ...) would be more effective in making Windows look bad. After all, instability is what everyone expects from Windows anyway, so if the increase if instability isn't too rapid, you wouldn't really suspect a virus, but just blame Microsoft: Thus, such a "slightly destructive" virus would probably cause more long-term damage to the Windows platform than a "wiping Windows" virus.

You've described the normal behavior of Windows. How could you tell Windows had a virus?