Re: MtE ?? (PC)

Thread View: comp.virus

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by Vesselin Bontchev Mon, 16 Nov 1992 15:14

#4228

Author: Vesselin Bontchev
Date: Mon, 16 Nov 1992 15:14

23 lines
1539 bytes

chess@watson.ibm.com (David M. Chess) writes:

> ? Not sure why you say that.  Any unencrypted instance of a virus that
> uses the MtE will contain the MtE itself in the file.  Just doing a
> thorough scan for a signature from the engine will then detect the
> infected file.  That's what we do, and it works.  (Of course, any
> brand-new virus can have some brand-new method of encryption, and
> therefore not be detected by a known-virus detector, but that's well
> known, and has nothing to do with the MtE itself.)

Yes, this is what Yisrael means. It is not possible to achieve 100%
detection of some unknown MtE-based viruses when they are in
unencrypted replicants. However, it is possible to achieve 100%
detection of all known MtE-based viruses in both encrypted and
unencrypted replicants.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads