🚀 go-pugleaf

Stefano_Turci@f108.n391.z9.virnet.bad.se (Stefano Turci) writes:

> F-prot says that it is possibly a new variant of Dir-II, and it doesn't say 
> that the file is infected by Dir-II, however I am a little worry about it 
> because.....I am the author of that program. :-)

> I wrote that program using assembler, and I found the piece of source code 
> that produces the above warning:

> - ------------------------------------------------        
>         mov     bx,offset message
>         mov     cx,46d
> decrypt:
>         xor     byte ptr [bx],0ffh
>         inc     bx
>         loop    decrypt
> - ------------------------------------------------

> I can only suppose that the virus uses a very similar decrypting routine, 
> however I think there is something wrong in the way used by F-prot to search 
> for new variants of Dir-II.

[stuff deleted]

Hmmm.... The worst of all is that the real working virus (Dir_II)
*doesn't* contain such piece of code... Except... Well, there is one
"variant" of this virus, which tries to be polymorphic and uses
something similar to the above to variably encrypt/decrypt itself...
However, as pointed out by the Russian anti-virus researcher Dmitry
Gryaznov, this variant of Dir_II will never work, due to some serious
bugs in it... Maybe F-Prot should just not try to detect it?

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany