From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: New Anti-viral ... (PC)
Date: 13 Apr 92 12:20:25 GMT

TYETISER@ssw02.ab.umd.edu (Tarkan Yetiser) writes:

> >> Sigh... It sounds pretty tempting, like an anti-virus programs
> >> everybody would like to have, but unfortunately, it seems more like
> >> and April Fool joke to me...

>    He, he, he, the joke is on you Vesselin. This thing is for real, and
> everyone is invited to try it at their convenience.

Re-sigh... It'd better be a joke... :-( I donloaded the package and
took a look at it. Gosh, I had to set up a special system just to
install it! The damn thing is not compatible with Sacker, SuperStor,
Disk Manager, any disks containing non-dos partitions, produces memory
faults with DR-DOS loaded high on a 386, etc...

In non-installed state the program mostly refuses to run. However,
when I tried it with the -Scan only option, it did start and hung the
machine. During installation it insists that I boot from a diskette
(which is good), but when I booted from a diskette, containing DR-DOS
6.0 and some of the fancy things that come with it, the program
thought that I have -not- booted from a dikette (which is not good).

When trying to recognize my CPU type it reported a 286 while in fact
it was a 386. This, combined with the warning that the driver that the
program generates may damage data if run on a different machine,
sounds pretty dangerous. How do you determine "different machine"?
What if I only change a printer controller? A disk controller? A hard
disk?

The documentation makes some blatant claims and tends to present the
answer "this is a bad practice" or "we do not intend to support such
systems" almost always when it mentiones a problem.

The "risk analisys test" presented there is just plain silly and
designed to promote the useage of anti-virus programs. To justify my
claims: the "test" divides the users into 4 groups, dependening on how
risky are viruses for them. If you are in group 3 or 4, you are
strongly warned that there is a high risk of being infected. Well, but
due to the scoring system, just answering "Yes" to the question "Have
you been infected in the past two years?" makes almost certain that
you'll get into group 3 (you need 11 points for this and the answer to
the above question gives 10 points). Now, suppose that two years ago I
was infected once by the Cascade virus and since then have been highly
disappointed in PCs and decided to work only on VAXes. Is there a
- -high- risk that I'll be infected in the near future? :-)

Furthermore, the description of the methods that some stealth viruses
use seem to show a good understanding of -some- stealth viruses (4096)
but a remarkable lack of fantasy about what a stealth virus (a really
good one) is able to achieve. If you describe me how do you detect
that a virus is present in memory, I'll show you that it is possible
to construct a virus, using only the currently known techiniques, wich
will pass undetected.

>  >    VDS uses a proprietary triple-pass verification technique to catch
>  > the most evasive "stealth" viruses even when they are active in

> >> I fail to see why a triple memory scan is needed. Any stealth virus
> >> can be caught in memory with a simple one-pass scan. They are stealth
> >> in files, not in memory you know...

>    Maybe we mean something different when we talk about "verification".
> We do not scan memory at all!  Stealth in files?  What does that mean?

I initially misunderstood you that you are checking the memory for the
signatures of the known stealth viruses. I meant that the stealth
technology consists in concealing the presence of the virus in the
files, not in memory, and therefore such viruses are easily detected
in memory by scanning for the known signatures. They can't be
encrypted there, since as Whale proved, this slows down the computer
unacceptably and leads to the discovery of the virus.

>  > optimized internal cache), VDS represents the strongest software
>  > solution currently available.

> >> Nope... When speaking about strong solutions, nothing that doesn't
> >> involve integrity checking does not sound strong to me...

>   Agreed. Its emphasis is on integrity checking as it should be.  Sounds
> like you have not had a chance to look at the package. Too busy with
> sorting out the cute virus names?

Yep, but now I got the package and didn't like it too much. It's less
secure than other integrity software that I know about (the
Untouchable, the ASP Integrity Toolkit). It's very prone to companion
viruses, since any new files are automatically checksummed and the
checksum database updated. It doesn't know about the DOS files
fragmenting attack. It's capabilities to bypass stealth viruses make
me think that it won't be compatible with local area networks... And
many other drawbacks. This certainly means that VDS DOES NOT represent
the strongest software solution currently available.

Of course, if the user succeeds to install and use the package,
relying on it is better than relying on SCAN. :-)

> >> The only problem is to convince the virus to infect the decoy... :-)

>    If a virus is so difficult to convince, it may also be slowing down
> its own infection rate. No, it won't catch them all with decoys.

Yep. Like boot and master boot infectors, but they are not a problem
to detect and remove. Like non-resident infectors, but they are not so
dangerous. Like system attacking viruses (Lehigh), but they are also
relatively easy to catch and erradicate. Or like device driver
infectors. Or like those of them that get the information form your
CONFIG.SYS file (the Involuntary virus). Or like the ones that infect
the programs listed in AUTOEXEC.BAT only. Or like the StarShip virus.
Or....

Besides, the decoys seem to be launched only in the root directory, so
it's pretty easy to program the virus to avoid them.

Speaking about root directories, why do you think that everybody's
command interpretter is the file C:\COMMAND.COM? Couldn't you follow
the COMSPEC variable? Several viruses do it better than you... :-)

> >> Jokes aside, I think that something like this can be found in Fred
> >> Cohen's manual for ASP IT or at least in his "Short Course on
> >> Computer Viruses".

>     Is it availale for anon FTP? Or should we contact Mr Cohen and beg
> for a copy? How much is it?

ASP IT is a commercial product. I don't know his exact price; you
should contact Dr. Cohen (he reads this list). The "Short course" is a
book, not a program or a file. You should check your book shop about
it or again ask Dr. Cohen directly. I suggest everybody to read this
book; it's very readable (unlike some of Dr. Cohen's scientific
papers <grin>) and contains a very good cost evaluation of the
different types of anti-virus defenses. Contains a lot of other useful
stuff too; some of it can be gathered from Cohen's papers in Computers
& Security, but it's better to have them gathered in one booklet.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54