watch my back technique?

teletype wrote:

> There is this technique now no longer rare in the parasites world,
> where a few processes running in the background, and once "you" try
> to terminate one of them, the other process tries to restore it
> immediately. The same with deleting files.
>
> I wonder if this technique has a name.
>
> Telli

I don't know, but if you type the following search phrase into Google
(with the quotes exactly as given) you'll find lots of references to
an early example. Maybe some research based on that will yield a term
for the technique. Failing that, perhaps a new name could be based on
the example...

"Robin Hood" "Friar Tuck" computer virus

HTH

John
 >> Stay informed about: watch my back technique? 

"teletype" <teletype DeleteThis @address.is.invalid> wrote in message news:673j329quoc1gjj639hte88do6ech5eoo9@4ax.com...
> There is this technique now no longer rare in the parasites world, where
> a few processes running in the background, and once "you" try to
> terminate one of them, the other process tries to restore it
> immediately. The same with deleting files.
>
> I wonder if this technique has a name.

Guardian.
 >> Stay informed about: watch my back technique? 

On that special day, John Foster, (john@address.invalid) said...

> Failing that, perhaps a new name could be based on
> the example...

Companion resurrection?


Gabriele Neukam

Gabriele.Spamfighter.Neukam.TakeThisOut@t-online.de


--
Ah, Information. A property, too valuable these days, to give it away,
just so, at no cost.
 >> Stay informed about: watch my back technique? 

On Sun, 09 Apr 2006 23:40:29 +0000, John Foster <john.TakeThisOut@address.invalid>
wrote:

>I don't know, but if you type the following search phrase into Google
>(with the quotes exactly as given) you'll find lots of references to
>an early example. Maybe some research based on that will yield a term
>for the technique. Failing that, perhaps a new name could be based on
>the example...
>
>"Robin Hood" "Friar Tuck" computer virus

Thank for this interesting info.

Looking for this combination of keywords, I found an article in the Sep
2002 issue of Virus Bulletin, where they mention a presentation by Peter
Szor in the 1999 conference of the Virus Bulletin, where he called this
technique "The Twins". I prefer either Gabriele Neukam's "companion
resurrection" or my "watch my back".

Telli
 >> Stay informed about: watch my back technique? 

"teletype" <teletype.TakeThisOut@address.is.invalid> wrote:

> There is this technique now no longer rare in the parasites world, where
> a few processes running in the background, and once "you" try to
> terminate one of them, the other process tries to restore it
> immediately. The same with deleting files.
>
> I wonder if this technique has a name.

That is one of several techniques that falls under the general term
"guardian". I use this a fair deal, but I'd hesitate to say it is common
usage yet.


--
Nick FitzGerald
 >> Stay informed about: watch my back technique?