Thread View: comp.virus
1 messages
1 total messages
Started by Jimmy Kuo
Thu, 10 Dec 1992 02:15
Memory Detection methods, was: Filler Virus (PC)
Author: Jimmy Kuo
Date: Thu, 10 Dec 1992 02:15
Date: Thu, 10 Dec 1992 02:15
21 lines
1415 bytes
1415 bytes
Kevin Markus responds to my posting as follows: >>BTW, you will not (or should not :-) ) see this conflict with NAV. >>NAV does a more sophisticated search through memory with knowledge of >>where viruses store themselves. >Hmm. That doesn't sound like the most brilliant thing. It doesn't take >too long to search through memory, and it's easy for a varient to move >to a different place in memory. Or pick a random spot. If it's a variant, it's a new virus and this line of thought is meaningless. A writer of a new variant has the available antivirus products to make sure they do not detect his new variant so it doesn't matter how you go about it. He just doctors his virus, trial and error, until it no longer gets picked up. If it's not a new variant, we do detect those viruses that have the capability of placing itself randomly in memory. I did say "more sophisticated." :-) Jimmy Kuo cjkuo@ccmail.norton.com Norton AntiVirus Research
Thread Navigation
This is a paginated view of messages in the thread with full content displayed inline.
Messages are displayed in chronological order, with the original post highlighted in green.
Use pagination controls to navigate through all messages in large threads.
Back to All Threads