W64.Rugrat.3344 The 1st 64bit Windows virus.!?

These hacker's are so fast it makes me wonder.
"It is the first known virus for 64-bit Windows, and it uses the Thread Local Storage structures to execute the viral code. This is an unusual method of executing code."
securityresponse.symantec.com...
Sanc'.

[Edited on 27-5-2004 by sanctum]

[Edited on 27-5-2004 by sanctum]

for those of us who know nothing about computers or viruses (virii?) what does that mean? can my computer running windows xp get the virus?

Originally posted by cmdrkeenkid
for those of us who know nothing about computers or viruses (virii?) what does that mean? can my computer running windows xp get the virus?

XP is fine it only goes after 64-bit Windows IA-64.

Originally posted by cmdrkeenkid
for those of us who know nothing about computers or viruses (virii?) what does that mean? can my computer running windows xp get the virus?

ckk, from the Symantec advisory...
"Note: A true 64 bit machine is not required for this virus, as it can be run on a 32 bit machine using 64 bit simulation software."
Sanc'.

[Edited on 27-5-2004 by sanctum]

Originally posted by sanctum

Originally posted by cmdrkeenkid
for those of us who know nothing about computers or viruses (virii?) what does that mean? can my computer running windows xp get the virus?

ckk, from the Symanec advisory...
"Note: A true 64 bit machine is not required for this virus, as it can be run on a 32 bit machine using 64 bit simulation software."
Sanc'.

But noone except some pro's developing for the I64 platform have that kind of emulation software running.

Originally posted by cmdrkeenkid
for those of us who know nothing about computers or viruses (virii?) what does that mean? can my computer running windows xp get the virus?

Yes !..

[EDITED AFTER A SMALL VERIFICATION]

I'm sorry, no, if you don't have a computer with the XP 64bits version.

[Edited on 27-5-2004 by Nans DESMICHELS]

I tought XP was 64bytes ! Windows definitively sucks !

[Edited on 27-5-2004 by Nans DESMICHELS]

W64.Rugrat is a fairly simple proof-of-concept virus. However, it is the first known virus to attack 64-bit Windows executables on IA64 systems intentionally, and it does so successfully. The virus uses a handful of Win64 API-s from 3 different libraries, NTDLL.DLL, SFC_OS.DLL and KERNEL32 respectively.

this shouldn't be KERNEL64 ?

The following 16 functions are used from KERNEL32.DLL to implement a standard file infection of a IA64 Portable Executable image:

KERNEL32.DLL on I64 windows ?

[Edited on 27-5-2004 by Nans DESMICHELS]

Originally posted by Nans DESMICHELS
KERNEL32.DLL on I64 windows ?

kernerl32.dll is part of "Windows-32-on-Windows-64 (WOW64)" that allows the 64 bit version of Windows to be backwards-compatible with 32bit applications. I wish I had more personal experience to speak of. I want a native 64 bit systems, CPU & OS, but don't have the means to aquire one ...yet!

Most AV software firms have versions of their clients that support 64 bit systems, but Ihave not read much about native 64 bit AV software.

Originally posted by Spectre

Originally posted by Nans DESMICHELS
KERNEL32.DLL on I64 windows ?

kernerl32.dll is part of "Windows-32-on-Windows-64 (WOW64)" that allows the 64 bit version of Windows to be backwards-compatible with 32bit applications. I wish I had more personal experience to speak of. I want a native 64 bit systems, CPU & OS, but don't have the means to aquire one ...yet!

Most AV software firms have versions of their clients that support 64 bit systems, but Ihave not read much about native 64 bit AV software.

try with linux. You can find something 64 native :

AlphaSparc (SUN) : A PERSONAL LINUX/ALPHA SYSTEM: 64 BITS FOR UNDER $500 >> www.linuxgazette.com...


Take also a look at :
AMD64 + linux :

librenix.com...



[Edited on 29-5-2004 by Nans DESMICHELS]

All I will say is that destructive hackers need to suffer the Edward II treatment.

For those not historically inclined ... The popular legend is that his murder was by a red-hot poker thrust up his anus through a hollow tube.

Now that is what I would do to the gits who write virii ... bastards that they are !!!