From: TYETISER@ssw02.ab.umd.edu (Tarkan Yetiser)
Newsgroups: comp.virus
Subject: Viruses, humor, and then some (PC)
Date: 11 Apr 92 20:20:35 GMT


  Hello netters,

 Joe Wells <0004886415@mcimail.com>  writes:

> Subject: RE: Mutation Detection (PC)
> kiae!rtech!vl!ALS@vl.ts.kiev.ua (Alexander Shehovtsov) writes:

 >> Just now there is no any idea to increase scanners capability of
 >> checking polymorphic viruses.

> Indeed, the purpose of this virus technology is beat scanning systems.
> However, there are already scanners that will detect Pogue, as well as
> the Mutation Engine. McAfee's scan claims 100 accuracy, Alan Soloman
> (at my last discussion with him) was at 99% on the MTE, Fridrik I know
> is working on it and undoubtedly will be detecting it very soon, and
> our product, Novi 1.1 is currently at about 99.7% on the MTE (current
> misses being failures of the Engine to work properly, detection for
> which I have yet to add).

  I don't have my calculator handy, but how do these people come up with
these numbers? Science, magic or marketing? I mean, 99.7% is pretty close.
Such accuracy!

> Moreover, all four of these scanners work well on all of the current
> polymorphic viruses. And a few others may also. Generally though,
> scanners that lack algorithmic detection schemes and anti-stealth
> capabilities are doomed to fare poorer and poorer.

  Scanners are doomed, period. Wait until another mutation hack comes
out. Hey, the market is alive!

> This also true to an extent. Dependence on scanners alone should be
> removed.

   Much truth in that. But if the end-user is only exposed to hype and
misinformation, how can he expect to see the light? Almost all major
anti-viral developers boast about their capability to identify four-digit
virus variants.

> But polymorphics are not the biggest problem scanner developers face.
> The biggest problem is glut. The constant influx of new viruses to
> scan for.  Straight string scanners will grow larger and slower as new
> virus strings are added. When, for example, I plugged the downloaded
> update for CPAV 1.1 strings in, the TSR grew by about 4k.

   Gluttony is a major sin, my son :-))

> Alternate technologies are needed to compliment scanning. One
> discussed much here of late is CRC or Checksum integrity checking.
> This system is reliable, but only as far as the user impliments it
> and, at best only reports infections "after the fact". Relying on

  Yes, they are much needed to contain the spread without draining
financial resources of MIS departments.

> users to run software doesn't have the defensive level of a TSR

  Nor the conflicts and other ramifications of juggling a dozen TSRs
in memory under good-ol' DOS.

> though. i.e. Users scan on a human timescale (based on human decision
> and action (and convienence)), viruses and TSRs work with binary
> certainity on a computer's timescale.

  Please, get out of the lab, and take a look at the reality. "Stoned"
is still around even in places where such TSRs are used.

> One aspect of a some products (including ours) is incorporating
> unknown detection in the TSR. e.g. When I first received Pogue I ran

  Such magical qualities do sell.

> it against the unknown-virus systems in our TSR. We detected it going
> memory resident but didn't interfere since it wasn't a known virus.
> However, when I ran another program and Pogue infected it, the TSR
> announced the infection, restored the victem program, and blew the
> virus out of memory. I don't know how other products handle this

   Hot damn! Do you take a snapshot of each program on disk during
installation to be able restore like that?

> I do not however think scanners should be scrapped yet. Even the best
> unknown-virus TSR system needs a good scanner for installation time if
> nothing else. It's also good to be able to name a virus so you know
> what you're dealing with.

   They should never be scrapped, but used in conjunction with stronger and
more viable solutions. We need scanners, just don't buy one for each
computer in your company if you have an option to license a few and use
when needed. Many anti-viral product sellers do not offer such options.

> Actually, since virus-writers have aimed viruses at specific products,
> there is no reason not to use more than one.

   Oh, yeah? The pie is big enough, and the end-user is supposed to pay
the bill for defeating their knight's foes.

> Provided of course the two are compatible. At the last CARO meeting
> in NY we discussed having a CARO compatibility list where included
> products would not false-positive or otherwise interfere with one
> another.
> Products not on the list would not be recommended. In the meantime I have

   Boyz 'n the hood! Don't step on my foot, I won't step on yours; or was
it "you scratch my back, and I will yours" :-)).

> been doing compatibility testing on my machine for AVPD members and
> others, at lease to the extent of scanning each other. I generally have
> the latest versions of CPAV, NAV, ViruSafe, McAfee, Virex-PC, Virx, Virus
> Buster, Untouchable, AV Toolkit, F-Prot, PCRX, PC-Cillin, and Novi on
> one of my test machines for just such testing.

   Petty cash, donation, hobby, or complimentary versions of each one?
Maybe, it's just know thy competition.

> Depending on a string scanner alone can be dangerous, since it detects
> and filters out the common stuff, creates a breeding ground ripe for
> advanced virus-types, and gives you a nice (false) sense of security
> while doing so.

   You are right. Isn't it about time the end-user is made aware of better
solutions? Many people out there do not have the expertise/time/interest to
perform a sound evaluation and then choose something that better suits
their personal as well as organizational needs? Of course, IBM sells a new
service now :-). So, maybe there is still hope.

> Joseph Wells - Virus Specialist|- Certus International - (216)546-1500
> Novi Development Team Leader - 0004886415@mcimail.com - CIS 70750,3457

  Aha, so you do this for a living. Keep up the good work. I hear NOVI
is well-designed and has convenient features for networked environments.

Regards,

Tarkan Yetiser
VDS Advanced Research Group               P.O. Box 9393
(410) 247-7117                            Baltimore, MD 21228
e-mail:  tyetiser@ssw02.ab.umd.edu