Article View: comp.virus
Article #4269Memory Detection methods, was: Filler Virus (PC)
From: Jimmy Kuo
Date: Thu, 10 Dec 1992 02:15
Date: Thu, 10 Dec 1992 02:15
21 lines
1415 bytes
1415 bytes
Kevin Markus responds to my posting as follows: >>BTW, you will not (or should not :-) ) see this conflict with NAV. >>NAV does a more sophisticated search through memory with knowledge of >>where viruses store themselves. >Hmm. That doesn't sound like the most brilliant thing. It doesn't take >too long to search through memory, and it's easy for a varient to move >to a different place in memory. Or pick a random spot. If it's a variant, it's a new virus and this line of thought is meaningless. A writer of a new variant has the available antivirus products to make sure they do not detect his new variant so it doesn't matter how you go about it. He just doctors his virus, trial and error, until it no longer gets picked up. If it's not a new variant, we do detect those viruses that have the capability of placing itself randomly in memory. I did say "more sophisticated." :-) Jimmy Kuo cjkuo@ccmail.norton.com Norton AntiVirus Research
Technical Details
Message-ID:
<0005.9212141513.AA07337@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!cis.ohio-state.edu!news.sei.cmu.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: cjkuo@ccmail.norton.com (Jimmy Kuo) Newsgroups: comp.virus Subject: Memory Detection methods, was: Filler Virus (PC) Message-ID: <0005.9212141513.AA07337@barnabas.cert.org> Date: 10 Dec 92 02:15:04 GMT Sender: virus-l@lehigh.edu Lines: 21 Approved: news@netnews.cc.lehigh.edu