🚀 go-pugleaf

frisk@complex.is (Fridrik Skulason) writes:
>Stefano_Turci@f0.n462.z9.virnet.bad.se (Stefano Turci) writes:
>
>>Well, I converted the files from COM to EXE, and made some scanning
>>tests with the mentioned programs.
>
>>The results were a bit strange, in fact:
>
>>    F-prot 2.05
>>    Scan 97
>>    VirX 2.4
>
>>missed *ALL* the converted files, while
>
>Not surprising - what you did was simply to add a new layer of
>encryption to the files.  Of course, the virus could be distributed in
>this form, and would probably replicate, but all the second (and
>later) generation copies would be detected normally.
>
>I am not at all surprised that my scanner, as well as the others
>missed the virus - actually, no matter how you had encrypted it, it
>probably would be missed.
>
>>converted files are still able to propagate the virus, so I think the
>>authors of the "missing-in- action" programs should improve their a-v
>>packages. 8-)
>
>In my case the reson I miss this particular sample is simple.  I scan
>inside LZEXE-compressed files, but only for signatures - that is, I
>uncompress the virus in memory, and run my scanning engine over it.
>If I uncompressed to disk, and stripped off the COM/EXE conversion, I
>would detect it, but it would slow the scanner down considerably.
>
>I don't consider it a serious problem - basically it is equivalent to
>distributing an old virus, with a new encryption wrapper...the
>original sample will not be found, but all the second generation
>copies will.

Frisk, that is a very serious problem.  It's quite analogous to the
reason why 100% detection of MtE based .COM infectors is necessary.
It can continuously reinstate infection of a computer (or network),
and if the virus does damage slowly, it can be disastrous.