🚀 go-pugleaf

Malte_Eppert@f535.n240.z2.fidonet.bad.se (Malte Eppert) writes:

> Can anybody tell me how MtE utilizing viruses detect themselves in an
> infected file?

It depends - the different MtE-based viruses use different methods.
The variants of Dedicated pad the infected files to the next multiple
of 256 when infecting it and do not infect files with size that is an
exact multiple of 256. Pogue puts an 'M' in the first byte of the
infected COM files and uses this as an infection marker. And so on.

Because those viruses to not have an exact MtE-detection mechanism,
this means that they might not infect some infectable files (they will
think that those files are already infected). This is sometimes called
"sparse infection".

> Or do they reinfect the file each time they attack it,
> like old Jerusalem? 

No, they are not -that- stupid... :-)

> Can't an algorithmic scanner use the method used
> by MtE itself to detect it?

Unfortunately - not. The virus author does not care if his virus does
not infect some infectable files, while a producer of an anti-virus
program cannot permit himself to erroneously flag a perfectly valid
file as infected... The only thing that can be done is to use the
infection marker of the virus as an heuristic to sieve out the files
that are obviously not infected. For instance, if you need to detect
only Pogue, you can check if the file is a COM file and its first byte
contains the character 'M'. If it is not or it doesn't, then you know
that it is not infected by Pogue and don't need to spend more time
checking... Only if it looks like a Pogue-infected file, you'll have
to apply your algorithmic detection...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany