Article View: comp.virus
Article #3133Re: MtE ?? (PC)
From: David M. Chess
Date: Tue, 10 Nov 1992 14:54
Date: Tue, 10 Nov 1992 14:54
17 lines
1237 bytes
1237 bytes
From: Y. Radai <RADAI@vms.huji.ac.il> >A few scanners succeed in detecting all >such viruses in some existing text suites, but it is apparently >impossible to obtain 100% detection on all possible MtE mutations >(i.e. even when the underlying virus is unknown) in those cases in >which an MtE encryption is not performed. ? Not sure why you say that. Any unencrypted instance of a virus that uses the MtE will contain the MtE itself in the file. Just doing a thorough scan for a signature from the engine will then detect the infected file. That's what we do, and it works. (Of course, any brand-new virus can have some brand-new method of encryption, and therefore not be detected by a known-virus detector, but that's well known, and has nothing to do with the MtE itself.) DC
Technical Details
Message-ID:
<0006.9211121928.AA09892@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!ornl!utkcs2!darwin.sura.net!zaphod.mps.ohio-state.edu!magnus.acs.ohio-state.edu!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!ornl!utkcs2!darwin.sura.net!zaphod.mps.ohio-state.edu!magnus.acs.ohio-state.edu!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: chess@watson.ibm.com (David M. Chess) Newsgroups: comp.virus Subject: Re: MtE ?? (PC) Message-ID: <0006.9211121928.AA09892@barnabas.cert.org> Date: 10 Nov 92 14:54:05 GMT Sender: virus-l@lehigh.edu Lines: 17 Approved: news@netnews.cc.lehigh.edu