🚀 go-pugleaf

>From:    Malte_Eppert@f535.n240.z2.fidonet.bad.se (Malte Eppert)
>
>Can anybody tell me how MtE utilizing viruses detect themselves in an
>infected file? Or do they reinfect the file each time they attack it,
>like old Jerusalem?  Can't an algorithmic scanner use the method used
>by MtE itself to detect it?

The MtE itself is just a garbler-generator, and so doesn't contain any
self-id code of any kind.  Viruses that use the MtE just use some sort
of simple test that will have lots of false positives ("Is there an M
in the first four bytes of this file" or "Is the seconds field on this
file 14?" or whatever).  This is fine for the virus (since it's OK if
it fails to infect 1% of files), but unusable for anti-virus programs
(since a 1% false positive rate would be unacceptable).  DC