This article presents information on manual unpacking of protected malicious Windows executables using the OllyDbg debugger. It also involve in fully rebuild the import table so the file can be restored to its original state and executed. Many anti-virus vendors categorized UPX, NsPack, ASpack and many other PE packers as malicious software.

Packers ???

A 'Packer' is a compression routine that squeezes an executable file. These programs created to reduce disk space and make downloads faster. It makes difficult to understand the original file and make it tricky to match the file signature of a compressed file. Packers initially send PE internal structures and then it identifies PE header, Export table, and import table in new structures & attaches code segment before OEP, called as STUB .i.e. the compressed executable is shifted to data section of newly created file. PE header & section header is no more useful since data is compressed means...

MSExchange.org holds a monthly readers poll to discover which product is preferred by Exchange administrators in a particular category of third party solutions for Microsoft Exchange Server.  July’s polling topic was antispam, and Symantec Mail Security for Microsoft Exchange was selected as Reader's Choice with 19% of the vote. http://bit.ly/p9Hx59

"Our Readers' Choice Awards give visitors to our site the opportunity to vote for the products they view as the very best in their respective category," said Sean Buttigieg, MSExchange.org manager. "MSExchange.org users are specialists in their field who encounter various solutions for Exchange Server at the workplace. Their vote serves as a solid peer-to-peer recommendation of the winning product."

MSExchange.org is a Microsoft Exchange Server 2007/2003/2000...

Even spammers take a holiday break after all.

Spam made up 81.69% of all messages in December, compared with 84.31% in November. We have been tracking the decline in spam for few months now, and there were several interesting developments in this area.

Some botnets went virtually silent around the Christmas holiday, but the break did not last very long. On January 10, the botnet activity returned and we saw a spike in spam volume. There is also an interesting relationship between the uptick in spam to ‘.ru’ domain URL spam messages. To find out more, click here to download the January 2011 State of Spam & Phishing Report, which highlights the following trends:

·         Did Spammers Take a Holiday Break?

·        ...

The monthly State of Spam & Phishing report has been tracking the decline of overall spam in recent months. The chart below shows the global spam volume dropping significantly since August.

An even more significant drop was observed during the Christmas holiday. The chart below shows the global spam volume for the month of December 2010 and first few days of January 2011.

What could have caused such a big drop?  We have some potential answers.  According to MessageLabs, there was a huge reduction in output from the Rustock botnet, which was by far the most dominant spam botnet in 2010.  Since December...