How do MtE utilizing viruses detect themselves? (PC)

Thread View: comp.virus

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by David M. Chess Mon, 18 Jan 1993 21:07

#4711

Author: David M. Chess
Date: Mon, 18 Jan 1993 21:07

14 lines
1197 bytes

>From:    Malte_Eppert@f535.n240.z2.fidonet.bad.se (Malte Eppert)
>
>Can anybody tell me how MtE utilizing viruses detect themselves in an
>infected file? Or do they reinfect the file each time they attack it,
>like old Jerusalem?  Can't an algorithmic scanner use the method used
>by MtE itself to detect it?

The MtE itself is just a garbler-generator, and so doesn't contain any
self-id code of any kind.  Viruses that use the MtE just use some sort
of simple test that will have lots of false positives ("Is there an M
in the first four bytes of this file" or "Is the seconds field on this
file 14?" or whatever).  This is fine for the virus (since it's OK if
it fails to infect 1% of files), but unusable for anti-virus programs
(since a 1% false positive rate would be unacceptable).  DC

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads