From: TYETISER@ssw02.ab.umd.edu (Tarkan Yetiser)
Newsgroups: comp.virus
Subject: Clarification on VDS 2.0 decoys (PC)
Date: 8 Apr 92 18:37:38 GMT


   Hello everyone,
   I hope the following will answer a few questions about VDS 2.0 decoys:
- -------------------------------------------------------------------------
            CLARIFICATION ON VDS DECOYS & A WORD TO THE WISE

     The registered versions of VDS 2.0 have an enhanced decoy launching
mechanism to analyze the infection method used by an active virus in
memory, and to provide the user with various pieces of information.
This information includes the number of bytes added to (or removed from)
the decoy, the virus entry point, whether the original stack is
relocated (EXE only), and whether the virus attached to the end of the
file (as most do), and so on.
     We would like to point out that the results reported should be
taken as an automated attempt to provide the curious user with general
information about the observed behavior of a memory-resident virus, but
not as an accurate analysis of the viral code.  The best way to obtain
an accurate analysis is by careful examination of the viral code both
statically and by running it under a debugger.  The POV.CCC
(corresponding to COM attacker), and POV.XXX (corresponding to EXE
attacker) files can be analyzed for this purpose.  Of course, the person
attempting such analysis should be familiar with the evasive tactics
some viruses use to complicate reverse-engineering by removing single-
step or traces set, or encrypting a portion of their code.
     Some viruses are encrypted and defy static analysis attempts.  In
such cases, it is necessary to determine the decryption routine, write
a little program to decrypt the concealed areas of the virus, and then
examine the viral code.  All this involves a human expert with enough
patience, a sharp eye, and good assembler skills.  No automated tool
that we are aware of can be an adeqaute substitute. This is one of the
reasons why so-called "heuristic" analyzers should be used with caution.
     The purpose of the VDS decoy launching mechanism is quite
different: it provides the user with general information about the
observed behavior of a memory-resident virus as far as the modifications
it makes to its victims are concerned.  To attach other meanings or
purposes to the decoy launching mechanism of VDS is unwarranted.  Of
course, it also serves to indicate whether there is an active virus in
memory regardless of its name!  Even then, some viruses cannot be
captured in this way.
     Today, there are some products that attempt to do a similar
analysis and even remove such infections without establishing exact
identification.  We prefer to avoid adding such a capability to VDS at
this point, since we believe that the primary purpose of any anti-viral
program is to contain the spread of viruses by providing early detection
(not identification).  Recovery is a matter of restoring the affected
areas using good copies.  In other words, we do not foresee much
usefulness to a generic disinfection capability in practice, and caution
the user that some companies have marketing departments with full-time
hype-generating individuals.
     If someone tells you they can disinfect any virus without (even
with) specific identification of a virus, they are engaged in other
endeavors besides science dedicated to serving people's needs.

Tarkan Yetiser
VDS Advanced Research Group               P.O. Box 9393
(410) 247-7117                            Baltimore, MD 21228
e-mail:  tyetiser@ssw02.ab.umd.edu