🚀 go-pugleaf

frisk@complex.is (Fridrik Skulason) writes:

[in reference to various virus scanners missing MtE in .COM's converted
 to .EXE's via COM2EXE...]

| Not surprising - what you did was simply to add a new layer of
| encryption to the files.  Of course, the virus could be distributed in
| this form, and would probably replicate, but all the second (and
| later) generation copies would be detected normally.

[...]

| I don't consider it a serious problem - basically it is equivalent to
| distributing an old virus, with a new encryption wrapper...the
| original sample will not be found, but all the second generation
| copies will.

I'm not sure that I agree with that.  While it's good that the second
generation infections will be detected, (and, presumably, eradicated),
if the original vector for the virus remains undiscovered, further
infections will inevitably occur.  If nothing else, this would be a
continual time waster, as sysadmin's go around cleaning-up detected
instances of the virus and trying to find the source of the problem,
which could be right on their own PC.

Of course, if a person didn't take the time to check the .COM for
virus before converting to .EXE (or compressing with PKLITE/LZE/etc),
s/he is asking for trouble anyway.  But that doesn't exclude a baddy
from doing this on purpose to make the virus harder to detect.
- -- 
_________________________________________________________________________
RUCS     | Mark A. Medici, Systems Programmer III, User Services Division
User     | Rutgers University Computing Services, New Brunswick, NJ 08903
Services | [medici@gandalf.rutgers.edu]                    [908-932-2412]