🚀 go-pugleaf

tck@fold.ucsd.edu (Kevin Marcus) writes:

> >BTW, you will not (or should not  :-)  ) see this conflict with NAV.
> >NAV does a more sophisticated search through memory with knowledge of
> >where viruses store themselves.
> >
> Hmm.  That doesn't sound like the most brilliant thing.  It doesn't take
> too long to search through memory, and it's easy for a varient to move
> to a different place in memory.  Or pick a random spot.

Not really. It's rather hard to simply patch a virus, so that you
completely modify its memory installation strategy and still produce a
closely related variant. It's almost certain that you'll get a
completely different virus, which would be detected by a different
scan string.

I suppose that NAV is doing something similar to TbScan/HTScan - each
virus is described with the area of memory it can occupy. Such areas
could be: INT (in the interrupt table), DOS (in a memory hole in DOS),
LOW (as a normal TSR, like Jerusalem), TWIXT (shortening the last MCB
and copying itself above it), VIDEO (in the video buffer), UPPER (in
the memory between the video buffer and the 1 Mb boundary), AT (at a
particular segment), etc. There are a few other possibilities, which I
cannot recall off the top of my head.

This restricted memory search usually works in most cases. That is, it
is silly to look for Stoned in the DOS buffers, when you know that it
installs itself after the top of memory pointed by the BIOS variable
at 0:413h... The method has problems only in a few cases - for
instance, the Number of the Beast and a couple of other viruses
install themselves in the DOS buffers. When you copy an infected file,
there is fair chance that the virus code (although inactive) will be
found in one of these buffers - which is exactly where you should look
for this virus in the first place. The solution is to check whether
the signature is found in an -existing- DOS buffer (when the real
virus installs itself in a buffer, it removes that buffer from the
chain of the available ones), but I know about no program that bothers
to do that...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany