Re: virus code is never executed - virus or not?]]]

>> You analyse the virus code and determine how it "infects" the host program.
>
>This seems like something of an undefinable problem to me - very much like the 
>Church - Turing proof I referred to earlier.

No.  That deals with any arbitrary program, but is utterly irrelevant when you
are talking about manual analysis of a one particular piece of code.  

This is similar to the situation that it is impossible to determine for any
arbitrary piece of code on a turing machine whether it is a virus or not (see
Fred Cohen's thesis), but for any given program it is possible to create a Turing
machine that says whether it is a virus or not.

It is perfectly possible to analyse any particular piece of code and determine
whether it is non-working intended semi-viral crap or not.

> Much easier in practice to detect the viral code and not bother about what 
> it's doing there - just report it anyway.

I guess you have never written a virus scanner, and you are just wrong here.

>> It may not be practical to find the virus code if it is not executed - for
>> example if the virus is heavily polymorphic.
>
>If that is the case then you don't have yourself a very good virus scanner?

I said "practical", not "possible".  Detecting non-working garbage like that,
which would practically never be found "in the wild", just in badly-maintained
collections is certainly possible for current virus scanners.  However, the
speed penalty would be significant, which is one reason why this is just not 
done.

>What's to stop the virus writer creating such heavily polymorphic code and 
>making sure that it *does* get executed? 

Then it does not fall under case 3), but case 1).  For the last time...I am
talking about non-working crap here.  If the virus does not infect the program
properly, and if no second-generation samples have a realistic chance of
working, then this is not evan a virus by definition.  It will not become
a problem in the wild, and there is simply no serious need to detect it.

Yes, it would be "nice" if virus scanners detectedf it as "crap", but it
is just not critical.

-- 
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
Author of F-PROT   E-mail: [email protected]       fax:   +354-540-7401


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html