NetNews Usenet Archive 1992 #20/NN_1992_20.iso/spool/comp/virus/3753

Internet Message Format | 1992-09-09 | 3.4 KB

Path: sparky!uunet!decwrl!spool.mu.edu!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: [e-mail] (Otto Stolz)
Newsgroups: comp.virus
Subject: Re: Auto-detecting virus (PC)
Message-ID: <[e-mail]>
Date: 8 Sep 92 18:12:44 GMT
Sender: [e-mail]
Lines: 71
Approved: [e-mail]

On Wed, 02 Sep 92 17:52:27 +0000 Denis Beauregard
 <[e-mail]> said:
> I would like to write a program that will check if it is per se
> holder of a virus.

Fine! Everybody should do so.

> The method I have in view :
> [1] Compile the program.
> [2] Compute the checksum of the program.
> [3] Put the checksum in the program.
> [4] When starting the program : Stop the program if the checksum has
>     been altered.

Problem:  Step 3, above, will change the program, hence invalidate the
          checksum.
Solution: You will have to anticipate this in step 2, above.

Pitfall:  Almost any virus will have restored the core image of the
          program before the latter gains control.
Solution: As you have implicitely assumed (quote suppressed for
          conciseness), the program will have to check its disk file
          rather than its core image.

Problem:  When a stealth virus is active in memory, it will hide its
          presence from any other program (including your self-checking
          routine): the program file will appear unaltered, hence the
          checksum will compute correct.
Solution: You could try to tunnel under the virus (i.e. find the ROM
          address where your system invocation eventually is executed),
          then jump directly there to get hold of an unaltered disk
          file. However, this is not feasable in all circumstances.

> Also, I never saw a self-protected program.

So you never saw Word Perfect Vers 4.2, nor Dr. Solomon's Anti-Virus
Toolkit, F-Prot, or any other professionally designed anti-virus
program? :-)

> Even an anti-virus program
> has as instructions : use the included diskette if infection is known.

. write-protected, of course! This will preclude infection of the
anti-virus program (which would refuse to work after an infection, on
account of the very scheme you proposed).

An anti-virus program should be used only after a clean boot, to avoid
the following problems with particular types of (possibly unknown)
viruses:
- - when a Fast File Infector is active in memory, it will infect every
  program scanned for viruses (raising the cost for the eventual
  cleaning);
- - when a Stealth Virus is active in memory, its infections are
  effectively invisible (hence scanning the disk is futile).

> Would it be safer to use a 32 bit checksum? [...]

>From the technical details I suppressed in the quote I infer that you are
planning to use a simple XOR type checksum. Imho, this would be too
obvious, too easy to guess and forge for a virus. You should invent a
more sophisticated scheme, involving a particular key for each program
(e.g. a XOR-ROL loop with the amount of rotating varying in the loop).

Even a self-checking program is not immune from specific attacks. Yet,
carefully designed self-checking will help to catch most viruses; and
those evading your self-checking routine will eventually be catched by
some other self-checking program.

Best wishes,
                    Otto Stolz <[e-mail]>
                               <[e-mail]>