🚀 go-pugleaf

Hello all,

Malte Eppert (2:240/535) writes:

> Can anybody tell me how MtE utilizing viruses detect themselves in an
> infected file?

The polymorphic viruses (including MtE based viruses) detects the
infected files at the same way as old not-polymorphic viruses. Several
of them set the specific date/time stamp of infected files and checks
it upon infection (for example, Vienna set 13th month or 62 seconds
and polymorphic Todor sets it to 22 seconds).

Other viruses set the fixed byte or word of infected file to the
specific value and check it (Pogue, Groove).

Several MtE viruses set the length of infected files to the value
which is divided by 10h. Uruguay viruses (not MtE but polymorphic)
infect the files so that the length of infected file is divided by 13h
(or 17h). Those viruses infects the files if the file length is not
divided by 10h (13h,17h).

Commander Bomber (not MtE but polymorphic) infects the COM-file twice,
but on executing infected program saves the memory image of the file
on disk and as result the one-time infection is present only.

Mutant viruses (not MtE but polymorphic) infect the files several
times, but these viruses pack the file upon infection and the length
of the infected file doesn't grow.

> Or do they reinfect the file each time they attack it, like old
> Jerusalem?

Those are 'good' viruses, but MtE (and polymorphic too) virus can be
very primitive and it can infect the files several times.

> Can't an algorithmic scanner use the method used by MtE itself to detect
> it?

Those methods are not enough to detect the virus, see above.

Best regards,

Eugene.

- -- 
- --  Eugene Kaspersky, KAMI Group, Moscow, Russia  
- --  eugene@kamis.msk.su, +7 (095) 499-1500