🚀 go-pugleaf

chess@watson.ibm.com (David M. Chess) writes:

> ? Not sure why you say that.  Any unencrypted instance of a virus that
> uses the MtE will contain the MtE itself in the file.  Just doing a
> thorough scan for a signature from the engine will then detect the
> infected file.  That's what we do, and it works.  (Of course, any
> brand-new virus can have some brand-new method of encryption, and
> therefore not be detected by a known-virus detector, but that's well
> known, and has nothing to do with the MtE itself.)

Yes, this is what Yisrael means. It is not possible to achieve 100%
detection of some unknown MtE-based viruses when they are in
unencrypted replicants. However, it is possible to achieve 100%
detection of all known MtE-based viruses in both encrypted and
unencrypted replicants.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany