Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Antivirus software receives constant updates in the form of virus definition files, containing the patterns used to identify viruses. It is a feature present on most (if not all) major AV for at least the last decade and half.

The frequency and size of updates has only grown over the years, and I wonder if in order to limit the size of the updates the AV companies remove older viruses from their databases.

If so, how likely is it that a virus old enough to have been removed from definition files, but not old enough to be obsolete would easily spread, uncontrolled and undetected.

share|improve this question
    
+1 An interesting question. I would hope that AV definitions for fileservers etc never lose signatures, however old they are. For home user/desktop AV, you could probably drop signatures of all malware that won't run on any OS older than the oldest one supported by the AV software. –  us2012 Jan 2 '13 at 4:07
    
I suspect that the answer is "no, they're never removed", as there's no incentive for A-V companies to remove signatures of old viruses. The old viruses never change, so the signatures can just rest in peace. On the other hand, if you take out a signature too early, well, "Virus Bulletin" might ding you when you can't detect EICAR.COM or something really ancient, Lehigh, maybe. –  Bruce Ediger Jan 2 '13 at 4:39
    
From time tools like rsync exists, we know that updating a growing database don't need to transfer more datas than differences! –  F. Hauri Jan 9 '13 at 7:16
    
Obsolescence is a commercial concept linked to objects that people would buy. Normal person would not buy an upgrade to a virus! In fact: old viruses won't become useless ;-) –  F. Hauri Jan 9 '13 at 7:23
1  
@ruda.almeida You're right, my last comment was more a joke, viruses could die! But, knowing that most of security failure are more worked around than whipped out, if a very old virus (forgotten) stay alive on a very old host (maybe forgotten too) and a new feature break a previous workaround, the old virus could resurect! –  F. Hauri Jan 9 '13 at 13:05

3 Answers 3

up vote 13 down vote accepted

Detection for a piece of malware is never removed from a mainstream AV.

Detection for old or rare malware is not removed mainly because AV benchmarks and clients seeing one AV missing detection while the others have it.

Let's say a signature is added for "Malw" malware but then the persistent malware writer makes subtle changes to avoid that specific detection. So variants start trickling in: Malw.1, Malw.B, Malw.X.32768, ... . The AV company then starts seeing a pattern and produces a smarter signature that finds a common factor and detects all of the variants.

This smarter signature might be:

  • the same classical byte pattern but on something that doesn't change between variants
  • a regular-expression-like pattern
  • a combination of byte patterns and metadata about the executable
  • features extracted from emulating the malware, like packers, loading patterns and behavior

This smarter signature is slower than the simple byte pattern but when there are a lot of variant signatures, the overall performance will favor the smart signature. When the performance is better with the smart signature, the simple signatures will receive a lower priority or will be deleted. That means Some malware will lose specific detection although some AV engines will output the detection with multiple signatures, not just stop at the first detection.

Periodical re-scanning of the entire collection of malware is performed to check if some changes in the AV have lead to malware not being detected or false positives have been introduced by smart signatures.

share|improve this answer
1  
+1. To say it the way I was going to say it, AV definitions files never lose the ability to detect any known virus, but as derivative implementations and a general pattern or "signature" to the virus becomes evident, specific definitions may be "merged" into a more general heuristic signature. –  KeithS Jan 2 '13 at 17:27

It depends on the malware as well as the vendor, but the primary incentive for reducing the number of signatures is performance.

A few reasons why a malware detection rule might be removed:

  • It only works on a platform that is no longer supported by the AV engine, e.g. old DOS / 16-bit PE malware.
  • The malware is so old that it no longer poses any threat (e.g. it just crashes on first run), due to threat mitigations introduced in OS patches that 99.99% of machines will now have installed.
  • The malware is no longer in distribution, and no instances of it have been detected for years.
  • The malware is very rare and has a minimal impact, but the signature required to detect it is quite CPU / disk intensive.
  • The specific signature has been superseded by a generic signature which still catches that malware.

Keep in mind that these are only possible reasons. The vendor may choose not to delete something, or may have development / testing reasons for keeping an old definition. Often old malware is used to test for basic protection when AV systems are reviewed.

So, whilst there's no concrete answer to your question (different companies have different ideas) it's not difficult to see when / why an AV suite might have a few old definitions pruned from its database now and then.

share|improve this answer
    
What if I write my 16-bit PE malware to your MBR? :P –  lynks Nov 6 '13 at 12:34
    
Considering I don't have an MBR, you might struggle ;] even so, a PE file being written to the MBR would just corrupt it entirely. –  Polynomial Nov 7 '13 at 22:06
    
You know I know that :P entry point of 0x00 and 0xaa55 at bytes 510 and 511. The rest is easy :) –  lynks Nov 8 '13 at 11:32

I wonder if in order to limit the size of the updates the AV companies remove older viruses from their databases.

They are not.

Virus definition stay over time and as such take space. Antivirus structure their signature database for management purpose and and permit us, technical people, to be able to manage, repair, change and backup them since many years.

If so, how likely is it that a virus old enough to have been removed from definition files, but not old enough to be obsolete would easily spread, uncontrolled and undetected.

Being able to protect the integrity of the virus database is part of the security itself and a necessary monitoring activity (imho) 1. I think it could explain a bit why antivirus program are sometime so deeply rooted to machines they 'protect' and why it also happen that antivirus screw the operating system.

As IT sec, it could be part of your duty to manage risk upon factor such as compatibility and abandonware, etc. Since antivirus can screw-up just like any other software, they must be managed and so their virus definition either.

Excluding those signatures could reduce disk usage, reduce antivirus engine corruption occurrence, fragmentation, etc, and the risk would be managed, etc, just like distributing operating system/software/firmware update/installation, etc, over the network. Not all updates are useful for all computer park, etc.

Examples Norton Nod32

share|improve this answer
    
Every word after the first sentence isn't really relevant to the question being asked. –  Terry Chia Jan 2 '13 at 5:14
    
I updated my answer several time to ensure if fit the faq, I'm confident it will be better now. –  happy Jan 2 '13 at 5:22
2  
Could you please provide references that back up the main argument, preferably in the anti-link-rot format (i.e., verbatim)? Your link to NOD32 says: "Symantec Endpoint Protection 12.1 will keep 1 definition set. Symantec Endpoint Protection 11.x will keep 3 definition sets at any time: the current set and the last 2. Symantec Antivirus 8.x/9.x/10.x will keep 2 definition sets: the current set and the last used. These older sets are used for virus definition rollback purposes." This does not say old sigs are deleted, nor does it say they are left in the DB. –  Deer Hunter Jan 2 '13 at 6:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.