MSMVPS.COM

The Ultimate Destination for Blogs by Current and Former Microsoft Most Valuable Professionals.
Welcome to MSMVPS.COM Sign in | Help
in Search

Harry Waldron - Corporate and Home Security

Latest Security Developments and Best Practices are shared to help keep users safe

W64.Rugrat - The First 64 bit Windows virus

Unfortunately, the innovation continues with this new proof-of-concept PE infector that will run in native 64 bit mode.

W64.Rugrat - The First 64 bit Windows virus
http://www.sarc.com/avcenter/venc/data/w64.rugrat.3344.html

W64.Rugrat.3344 is a direct-action infector (it exits memory after execution) of IA64 Windows Portable Executable (PE) files - this includes most Windows applications - excluding .dlls. It infects files that are in the same folder as the virus and in all subfolders.

It is the first known virus for 64-bit Windows, and it uses the Thread Local Storage structures to execute the viral code. This is an unusual method of executing code. It does not infect 32-bit Portable Executable files, and it will not run on 32-bit Windows platforms. The virus is written in IA64 assembly code.

W64.Rugrat is a fairly simple proof-of-concept virus. However, it is the first known virus to attack 64-bit Windows executables on IA64 systems intentionally, and it does so successfully. The virus uses a handful of Win64 API-s from 3 different libraries, NTDLL.DLL, SFC_OS.DLL and KERNEL32 respectively.
Only published comments... May 27 2004, 03:45 AM by Harry Waldron

Leave a Comment

(required) 
(optional)
(required) 
Submit
Powered by Community Server (Commercial Edition), by Telligent Systems