After disassembling readme.exe and stepping through execution, it is possible to make Minda think it is already loaded and quit. If a named Mutex is already created with name "fsdhqherwqi2001", the virus will exit, preventing activation and further infection. This was tested in one configuration and works. I dont see any reason why it would not work with the other launch methods. A quick program can be written to create this mutex, however it needs to be re-run after each reboot of the system. It is also important that the mutex is created before Minda can activate. This might come in handy for systems that cannot be easily patched and are prone to reinfection. -BK ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Sep 19 2001 - 12:46:36 PDT