From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Scanners and polymorphic viruses (PC)
Date: 9 Sep 92 19:31:01 GMT

Hello, everybody!

With the advent of the sophisticated polymorphic viruses like Dark
Avenger's Mutating Engine, it is becoming more and more obvious that
the scanners have really hard time to detect all infections. I have
already posted several times articles about how well (or, more
exactly, how bad) the different scanners detect the MtE-based viruses.
Several people have asked me why I am testing only MtE detection
capabilities, since none of the currently existing MtE-based viruses
is intelligent enough to spread widely and to be a significant danger.

I am doing this because the MtE is one of the most sophisticated tool
for building polymorphic viruses and presents a lot of trouble to the
producers of scanning software. Therefore, the inability to detect the
MtE-based viruses shows very well how limited the scanners are - the
MtE has been available since almost a year, yet only about a dozen
scanners achieve at least some success in detecting it. Of them about
the half are unable to detect it reliably.

However, the MtE-based viruses are not the only polymorphic viruses
which present problems to the scanners... I have tested several
scanners on a lot of examples of some of the most polymorphic viruses.
There is clear need to use a lot of examples, since some scanners are
able to detect only one or two instances of some polymorphic viruses -
the examples that the producer of the scanner has...

I used the following viruses during the tests:

Standard CARO name:	Number of different mutants generated:
- -------------------	--------------------------------------
Andryushka.A			46
Emmie				16
Haifa.Haifa			105
Haifa.Motzkin			101
Involuntary.A			8
Involuntary.B			89
Maltese_Amoeba			39
MtE_0_90.Dedicated		96
MtE_0_90.Pogue			98
MtE_0_90.Questo			101
MVF				96
Necros				115
PC-Flu_2			35
Silly_Willy			93
Simulate			29
Slovakia.2_02			81
Slovakia.3_00			57
StarShip			148
Tequila				68
Todor				101
V2Px.V2P1			35
V2Px.V2P2			8
V2Px.V2P6			27
V2Px.V2P6Z			61
WordSwap.1391			3
WordSwap.1495			10
Whale				164 (covering mutants #00 to #33)

The following scanners were used during the tests:

Scanner:	Version:	Producer:
- --------	--------	---------
FindVirus	4.34		S & S International
F-Prot		2.05		FRISK Software
VIRUSCAN	95		McAfee Associates
HTScan		1.8		Harry Thijssen
VirX		2.4		Microcom
AntiVir IV	4.04		H+BEDV
Anti-Virus+	4.20.01		IRIS
CPAV		1.0		Central Point Software

Some comments. You all know the first three products; I used the
latest versions available. 

HTScan is a user-programmable scanner. It depends on a text file, 
containing wildcard scan strings. Since most polymorphic viruses 
cannot be detected this way (they need algorithmic approach), I 
tested another feature of the scanner - the so-called AVR modules. 
They are loadable at runtime small programs, which are executed by 
the scanner and are supposed to perform algorithmic detection of 
those polymorphic viruses, which cannot be detected with simple or 
even with wildcard scan strings. In this particular version, there 
are AVR modules for Maltese_Amoeba, MtE-based viruses, and the V2Px.* 
series.

VirX I couldn't test. It does something incredibly stupid - tries to
keep the whole report file in memory. Of course, it soon runs out of
memory, so not record is kept about what viruses are detected and
which are not. I did only a partial test - on the MtE-based viruses
only.

We have only a very ancient version of CPAV, so the test results for
it are not up-to-date. That version tried to detect only V2Px.* and
Whale. Unsuccessfully, on the top of that...

Here are the results of the tests. Note that when I say that a scanner
reliably detects a virus, this holds only for these tests. It does not
mean that it will be able to detect all possible instances of the
virus; it just means that I have been unable to find an instance that
it does not detect. However, when I say that a scanner does not detect
a virus reliably, this means that it misses at least one example and I
have proven this.

FindVirus detected all infected files. However, this result is not
very fair towards the other scanners, since Dr. Solomon had access to
the infected samples, before submitting that version of the scanner.
This was not so with the other anti-virus producers.

F-Prot failed to detect at all Necros, Silly_Willy and Todor. It
failed to detect reliably Andryushka.A, Whale (mutant #32), and
V2Px.V2P6Z (only one example missed). It detected reliably all other
viruses.

VIRUSCAN does not detect at all Andryushka.A and StarShip. The latter
is rather strange, since I have submitted examples of this virus to
McAfee Associates months ago. The scanner does not detect reliably
MtE_0_90.Questo, MVF, Slovakia.2_02, Slovakia.3_00, V2Px.V2P6Z (only
one example missed) and Whale (mutant #33 missed). It also sometimes
misidentifies MtE_0_90.Pogue as 7thSon (when the virus is not
encrypted), but SCAN is proverbial with its lack of exact
identification. It succeeded to detect the other viruses reliably.

VirX tested on the MtE-based viruses only still does not recognize
those viruses reliably. It missed 12 of the total 292 examples.

AntiVir IV (a German anti-virus product) does not detect at all
Andryushka.A, Emmie, Haifa.Haifa, Haifa.Motzkin, Involuntary.A,
Involuntary.B, MVF, Necros, PC-Flu_2, StarShip and Todor. It failed to
identify correctly V2Px.V2P2 (one missed example) and Whale (several
mutants). The other viruses were detected reliably - even the
MtE-based one, with the exception that the non-encrypted files
infected with an MtE-based virus were reported to contain two viruses.

HTScan's AVR module for Maltese_Amoeba (IRISH.AVR) doesn't detect the
virus reliably. Surprisingly, the collection of wildcard scan strings
for the same virus, which is present in the text database, -does-
detect this virus reliably. So, my advice to the users of HTScan is to
delete the file IRISH.AVR and to rely on the database of signatures.
The module for Haifa.Haifa detected reliably all instances of the
virus, but didn't detect even one instance of the related virus
Haifa.Motzkin. The module which is supposed to detect MtE-based
viruses (its version is 2.3) failed to detect the non-encrypted
examples, infected with MtE_0_90.Pogue and MtE_0_90.Questo. The module
for the V2Px viruses (called "Washburn") detects reliably V2Px.V2P1,
but missed one instance of V2Px.V2P2, three instances of V2Px.V2P6 and
lots of instances of V2Px.V2P6Z. The Whale virus was detected reliably
by the collection of scan strings in the database.

Anti-Virus+ does not detect at all Andryushka.A, Emmie, MVF, Necros,
Silly_Willy, Necros, Slovakia.2_02, Slovakia.3_00, StarShip, Tequila,
Todor, WordSwap.1391 and WordSwap.1485. It did not detect reliably 
Involuntary.A (in SYS files), MtE_0_90.Dedicated, MtE_0_90.Questo,
V2Px.V2P6, V2Px.V2P6Z and Whale (several mutants). The other viruses
were detected reliably.

The above tests clearly show that most of the current scanners are
still unable to cope with the existing polymorphic viruses. Even with
such well known viruses like V2P6 and MtE. At least one scanner was
unable to detect even Tequila! This virus is quite widespread and can
be detected with a few wildcard scan strings (3-4, I believe). And in
the near future we'll see more and more polymorphic viruses...

If some producer of scanning software thinks that his product is able
to show better results but I have missed to test it, s/he is welcome
to contact me and provide me a copy of their product (or tell me where
to get it, if it is available through anonymous ftp). I am ready to
test it and to publish the results, provided that:

1) The scanner is able to run without user intervention. I don't want
to be prompted to "press any key" each time a virus is found.

2) The scanner is able to produce a report file.

3) The scanner is able to output in the report file the names of all
files being scanned, not only those that it considers to be infected.

4) The scanner is requires a reasonable amount of memory. For
instance, Norton Anti-Virus 2.1 refused to run in about 400 Kb free
memory.

A description how to instruct the scanner to conform to the above
requirements (i.e., secret options, etc.) is welcome.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany