🚀 go-pugleaf

mcafee@netcom.com (McAfee Associates) writes:

> If VIRUSCAN did not pick up unencrypted copies of a virus, that means
> that we do not have a copy of the virus.  Readers may wish to note
> that sometimes the MtE produces an "unencrypted" virus, that is, one
> where no MtE encryption is performed.  In this case, no MtE virus
> would be found, and VIRUSCAN (SCAN) would have to look for the actual
> virus code.  If we do not have a copy of that particular MtE-based
> virus, then unencrypted copies will not be found until we receive a
> copy and analyse it.

There is an easy solution for this. It is so obvious, that I really do
not understand why you are not using it. The solution is to pick a
scan string from the unencrypted body of the MtE. This way you will be
able to find the unencrypted replicants - even if they contain a virus
not seen by you. It is enough that it uses the same version of the
MtE. And the encrypted samples (of an unknown virus) you should be
able to detect anyway - with your generic algorithm for detecting
MtE-generated decryptors.

The above solution is not 100% fool-proof. I mean, it will be possible
to write a virus, the unencrypted replicants of which will not be
detected by the above method. But -none- of the MtE-based viruses that
have been created yet are using this trick. Therefore, had you used
the simple method described above, you would have detected even those
MtE-based viruses of the existing ones that were unknown to you.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany