🚀 go-pugleaf

cjkuo@ccmail.norton.com (Jimmy Kuo) writes:

> The argument for the second opinion says that if you detect the
> infected form of the children, you will know if something is going on
> in the computer.  Once something is known to be affecting the
> computer, theories related to integrity checking can take over.  Files
> such as those created above and certain files in reviewers'
> collections cannot spread in that convoluted form and need not worry
> endusers.  (A version of this argument applies to whether it is
> necessary to detect absolutely 100% of MtE mutations, i.e.  integrity
> checking takes over.)

I tend to disagree. First, according to the above argument, you can
always use an integrity checker to detect the second-generation
infections, so you don't need a scanner at all. In fact, one of the
arguments why the integrity checkers cannot replace the scanners
completely, is that when you notice the infection, you usually want to
find and remove all sources of infection, including the file that
brought the virus to your system. Also, scanners are useful for
scanning the software -before- you run it (something that the
integrity checkers cannot do), therefore, the user wants to be able to
find the viruses at that stage, not after the virus has been released
in the system.

Second, all the scanners mentioned by the original poster claim to be
able to scan inside LZEXE compressed files. Therefore, if those claims
are correct, they should be able to detect the virus.

Third, some scanner -were- able to detect the virus.

However, I agree with you, that in general the virus droppers (because
what the original poster has done has been exactly to create a
dropper) are not a serious problem.

> It should be the form that propagates that we worry about.  And though
> you didn't note it, I'm sure all the files infected by your creations
> were detected by all the packages above.  Thus end-users need not
> worry about your peculiar forms of MtE files because you're not going
> to put those files on anyone else's computer.  :-)

Problem is, it is perfectly possible to create an MtE-based virus,
converted in the way described in the original message, which will
propagate in THAT FORM. Recall that we already have several viruses
that are propagating in LZEXE or PKLITEd form...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany