🚀 go-pugleaf

Stefano_Turci@f0.n462.z9.virnet.bad.se (Stefano Turci) writes:

>Well, I converted the files from COM to EXE, and made some scanning
>tests with the mentioned programs.

>The results were a bit strange, in fact:

>    F-prot 2.05
>    Scan 97
>    VirX 2.4

>missed *ALL* the converted files, while

Not surprising - what you did was simply to add a new layer of
encryption to the files.  Of course, the virus could be distributed in
this form, and would probably replicate, but all the second (and
later) generation copies would be detected normally.

I am not at all surprised that my scanner, as well as the others
missed the virus - actually, no matter how you had encrypted it, it
probably would be missed.

>converted files are still able to propagate the virus, so I think the
>authors of the "missing-in- action" programs should improve their a-v
>packages. 8-)

In my case the reson I miss this particular sample is simple.  I scan
inside LZEXE-compressed files, but only for signatures - that is, I
uncompress the virus in memory, and run my scanning engine over it.
If I uncompressed to disk, and stripped off the COM/EXE conversion, I
would detect it, but it would slow the scanner down considerably.

I don't consider it a serious problem - basically it is equivalent to
distributing an old virus, with a new encryption wrapper...the
original sample will not be found, but all the second generation
copies will.

- -frisk