Re: MtE ?? (PC)

Thread View: comp.virus

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by David M. Chess Tue, 10 Nov 1992 14:54

#3133

Author: David M. Chess
Date: Tue, 10 Nov 1992 14:54

17 lines
1237 bytes

From:    Y. Radai <RADAI@vms.huji.ac.il>

>A few scanners succeed in detecting all
>such viruses in some existing text suites, but it is apparently
>impossible to obtain 100% detection on all possible MtE mutations
>(i.e. even when the underlying virus is unknown) in those cases in
>which an MtE encryption is not performed.

? Not sure why you say that.  Any unencrypted instance of a virus that
uses the MtE will contain the MtE itself in the file.  Just doing a
thorough scan for a signature from the engine will then detect the
infected file.  That's what we do, and it works.  (Of course, any
brand-new virus can have some brand-new method of encryption, and
therefore not be detected by a known-virus detector, but that's well
known, and has nothing to do with the MtE itself.)

DC

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads