Re: How to measure polymorphi

Thread View: comp.virus

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by Vesselin Bontchev Thu, 14 Jan 1993 10:46

#4661

Author: Vesselin Bontchev
Date: Thu, 14 Jan 1993 10:46

23 lines
1432 bytes

bill.lambdin%acc1bbs@ssr.com (Bill Lambdin) writes:

> How about releasing a polymorphic virus on a test machine with several 
> thousand bait files that are identical. 2-5 thousand bait files should be 
> enough.

> infect these bait files, then use a program that would generate CRC's of 
> all of the infected files then delete the duplicates.
>  
> If the MtE generates fewer dupes than the others, call it the most 
> polymorphic

Not good enough... A virus that puts a single word (two bytes) of
random garbage in the decryptor will be flagged as more polymorphic
than MtE by your scheme...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads