From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Auto-detecting virus (PC)
Date: 7 Sep 92 19:37:02 GMT

beaurega@ireq.hydro.qc.ca (Denis Beauregard) writes:

> Compile the program.
> Compute the checksum of the program.
> Put the checksum in the program.
> When starting the program : Stop the program if the checksum has been altered.

> Advantages :
> 1- User can not modify the program to remove the copyright notice
>    (whic I can code anyway)

He still can - if he bothers to find out where your checksum is and to
patch it or to patch the piece of code that is performing the check.

> 2- Virus modifying hte program would be catched immediately so that
>    my programs will be reputed for being virus-safe

Not true. First, a virus which knows where your checksum is, could
simply re-compute it on the already infected file and patch it. Or
just remove it. Or patch the checking code. Or modify the file without
modifying the checksum (I understand that you intend to use CRC-32 and
in this case it is trivial, if the generator is known).

Second, the virus could be a stealth one. When you start the infected
program, the virus will receive control first. It will then go stealth
and intercept all read requests to the file and modify their results
in such a way that the fill will look as if it is not infected.
Therefore, the checking code (which will receive control after the
virus) will not detect the change.

The method that you are describing will work only against the simple
(non-stealth) viruses and against viruses which do not know about
your program.

> Inconvenients :
> 1- This won't work on older DOS versions (since the file name is not availabl
e

True, but relatively few people are still using DOS version below 3.0.

> 2- This will slow down the program loading, but by a small amount

It will be almost unnoticeable. The slowdown will be more significant
when the program is run from a floppy.

> I would like to get feedback (I will keep subscription for that group
> for one month as I usually subscribe only to a group when I have a 
> specific interest).

Had you been subscribed to this group for longer, you would without
any doubt have heard about the stealth viruses.

> Also, I never saw a self-protected program.  Even an anti-virus program

Most anti-virus programs nowadays are using this method. Not that it
works in all cases, but a protection against the simple viruses only
is better than no protection at all, right?

> Would it be safer to use a 32 bit checksum (I understand a 16 bit
> checksum would mean if something if wrong, odd are 1 to 65536 not to
> find it).  A 32 bit machine will just count faster a 32 bit sum.

As far as I understand, you intend to use CRC-32 for your checksum. In
this case, please have in mind that it relatively trivial to break it,
if the generator is known. CRC checksums have been designed for
detection of random errors (caused by line noise), not for detection
of malicious attack. If you want to be more secure, use CRC-32 with a
randomly generated polynomial or even better, use MD4 or MD5. However,
even this will not help you to detect an infection by a stealth virus.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany