From: 0004886415@mcimail.com (Joe Wells)
Newsgroups: comp.virus
Subject: RE: Mutation Detection (PC)
Date: 10 Apr 92 15:49:00 GMT

kiae!rtech!vl!ALS@vl.ts.kiev.ua (Alexander Shehovtsov) writes:

> Just now there is no any idea to increase scanners capability of
> checking polymorphic viruses.

Indeed, the purpose of this virus technology is beat scanning systems.

However, there are already scanners that will detect Pogue, as well as
the Mutation Engine. McAfee's scan claims 100 accuracy, Alan Soloman
(at my last discussion with him) was at 99% on the MTE, Fridrik I know
is working on it and undoubtedly will be detecting it very soon, and
our product, Novi 1.1 is currently at about 99.7% on the MTE (current
misses being failures of the Engine to work properly, detection for
which I have yet to add).

Moreover, all four of these scanners work well on all of the current
polymorphic viruses. And a few others may also. Generally though,
scanners that lack algorithmic detection schemes and anti-stealth
capabilities are doomed to fare poorer and poorer.

>   It looks like virus scanners would be removed from
>   front line of battle against viruses.

This also true to an extent. Dependence on scanners alone should be
removed.

But polymorphics are not the biggest problem scanner developers face.
The biggest problem is glut. The constant influx of new viruses to
scan for.  Straight string scanners will grow larger and slower as new
virus strings are added. When, for example, I plugged the downloaded
update for CPAV 1.1 strings in, the TSR grew by about 4k.

Alternate technologies are needed to compliment scanning. One
discussed much here of late is CRC or Checksum integrity checking.
This system is reliable, but only as far as the user impliments it
and, at best only reports infections "after the fact". Relying on
users to run software doesn't have the defensive level of a TSR
though. i.e. Users scan on a human timescale (based on human decision
and action (and convienence)), viruses and TSRs work with binary
certainity on a computer's timescale.

One aspect of a some products (including ours) is incorporating
unknown detection in the TSR. e.g. When I first received Pogue I ran
it against the unknown-virus systems in our TSR. We detected it going
memory resident but didn't interfere since it wasn't a known virus.
However, when I ran another program and Pogue infected it, the TSR
announced the infection, restored the victem program, and blew the
virus out of memory. I don't know how other products handle this
particular virus, but I know that a few are claiming unknown detection
in their TSRs (CPAV, Virusafe, PC-Cillin, etc).

I do not however think scanners should be scrapped yet. Even the best
unknown-virus TSR system needs a good scanner for installation time if
nothing else. It's also good to be able to name a virus so you know
what you're dealing with.

Actually, since virus-writers have aimed viruses at specific products,
there is no reason not to use more than one. Provided of course the
two are compatible. At the last CARO meeting in NY we discussed having
a CARO compatibility list where included products would not
false-positive or otherwise interfere with one another. Products not
on the list would not be recommended. In the meantime I have been
doing compatibility testing on my machine for AVPD members and others,
at lease to the extent of scanning each other. I generally have the
latest versions of CPAV, NAV, ViruSafe, McAfee, Virex-PC, Virx, Virus
Buster, Untouchable, AV Toolkit, F-Prot, PCRX, PC-Cillin, and Novi on
one of my test machines for just such testing.

Depending on a string scanner alone can be dangerous, since it detects
and filters out the common stuff, creates a breeding ground ripe for
advanced virus-types, and gives you a nice (false) sense of security
while doing so.

Joe

======================================================================
Joseph Wells - Virus Specialist	- Certus International - (216)546-1500
Novi Development Team Leader - 0004886415@mcimail.com - CIS 70750,3457
======================================================================
I speak English but asm is my native tongue. (Who killed Fred Waller?)
======================================================================