Everything2
Near Matches
Ignore Exact
Full Text
Everything2

polymorphic virus

created by FelonyMPulse

(thing) by Jetifi (1.3 wk) (print)   ?   (I like it!) 1 C! Sat Oct 06 2001 at 17:29:13

A polymorphic virus is a particular type of computer virus that changes or 'mutates' as it spreads.

Many years ago, most anti-virus (AV) software worked simply by scanning through files, the boot sector, memory, etcetera, for the 'signature' of the virus - the sequence of bytes that made up it's instructions. Polymorphic viruses1 hoped to defeat this by changing their signature regularly, normally on infection of a new host.

There are two main methods used in making a virus polymorphic. The first (and simplest) was simply to encrypt the body of the virus using (very) weak encryption, using a different key each time. Variations on the theme include using randomly chosen mechanisms with randomly chosen keys. These are more accurately known as 'encrypting' viruses.

These are defeated by the latest AV programs because the decryption code must necessarily be outside of the encrypted contents of the virus itself. The virus' decryption routines became the signatures which the AV software scans for.

The other type of polymorphic virus is far trickier to write. They are written using self-modifying code and perform such tricks as moving various blocks of code around - which affects the execution order for various operations (scan, infect, activate, etc.), but does not change the overall effect of the code.

Other tricks include things like inserting No OPeration codes, or scattering the code over several address blocks and randomly jumping around memory. These tricks have made virus detection a lot more difficult and complicated than it once was, and increases the risk of finding false positives.

Today, most cutting-edge virus design is done for AV companies in R&D labs. Polymorphism is usually utilised in conjunction with other techniques such as stealth, armouring, and multipartite vectors of infection.

1: virii = 30,100 hits, viruses = 818,000 on google.

Sources:
http://www.pakcert.com.pk/pages/Polymorphic_Virus.htm
http://vil.nai.com/vil/virusSummary.asp?virus_k=458
http://www.ladysharrow.ndirect.co.uk/Virus%20Information/polymorphics_1993.htm
http://www.research.ibm.com/antivirus/timeline.htm


printable version
chaos

self-modifying code stealth virus VX Heavens Polymorphic generators
Multipartite How to exchange two variables without using a third stealth Sounds cool and means nothing
Detecting an attacker's IP address hidden by backscatter parametric polymorphism NOP trypanosome
Anti-Virus programs and strategies computer virus virii The Great American Dollar Bill Blessing Virus
Polymorphism The first computer virus The Honour System Virus I love you virus
detection times of drugs in urine distributed computing W32/SirCam@MM Navidad Virus
Y'know, if you log in, you can write something here, or contact authors directly on the site. Create a New User if you don't already have an account.
  Epicenter
Login
Password

password reminder
register

Everything2 Help

Cool Staff Picks
Just another sprinkling of indeterminacy
In his autumn before the winter comes man's last mad surge of youth
Sunset Boulevard
The threat of freedom
I signed up for the carpool for all the wrong reasons and now I'm bitter as Hell
The Truth Behind Doritos Flavors
Japanese education
learning to juggle
Gone in Sixty Seconds 2006 - Theatre Quest Entries
If we could build things out of concepts, I'd have pants made of lust
Les Fleurs du Mal
Stormy Weather
Active Denial System
Pioneer 10
New Writeups
SubSane
Making Love to a 9-Foot Woman(person)
Ouzo
Thoughts(idea)
antigravpussy
I fall silent, listening. The breadcrumbs are talking about us(person)
calgon
Buffalo Bill by the pool(poetry)
gate
Anarchy is Order(idea)
ushdfgakjasgh
Scribeling(thing)
XWiz
Trism(review)
artman2003
Briefcase Full of Souls - Part I(fiction)
Dreamvirus
Alan Ladd(person)
waverider37
Harold Holt(person)
The Debutante
Until death do us part(fiction)
Ysardo
a brother to a sister(personal)
antigravpussy
your warm whispers(personal)
Clarke
Multiculturalism(idea)
aneurin
Earl of Landaff(person)
E2 is a by-product of the existence of The Everything Development Company