🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #4269

Memory Detection methods, was: Filler Virus (PC)

#4269
From: Jimmy Kuo
Date: Thu, 10 Dec 1992 02:15
21 lines
1415 bytes
Kevin Markus responds to my posting as follows:
>>BTW, you will not (or should not  :-)  ) see this conflict with NAV.
>>NAV does a more sophisticated search through memory with knowledge of
>>where viruses store themselves.

>Hmm.  That doesn't sound like the most brilliant thing.  It doesn't take
>too long to search through memory, and it's easy for a varient to move
>to a different place in memory.  Or pick a random spot.

If it's a variant, it's a new virus and this line of thought is
meaningless.  A writer of a new variant has the available antivirus
products to make sure they do not detect his new variant so it doesn't
matter how you go about it.  He just doctors his virus, trial and
error, until it no longer gets picked up.

If it's not a new variant, we do detect those viruses that have the
capability of placing itself randomly in memory.  I did say "more
sophisticated."  :-)

Jimmy Kuo                                       cjkuo@ccmail.norton.com
Norton AntiVirus Research
Technical Details
Message-ID: <0005.9212141513.AA07337@barnabas.cert.org>
Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: Memory Detection methods, was: Filler Virus (PC)
Message-ID: <0005.9212141513.AA07337@barnabas.cert.org>
Date: 10 Dec 92 02:15:04 GMT
Sender: virus-l@lehigh.edu
Lines: 21
Approved: news@netnews.cc.lehigh.edu