Viruses used to have specific "signatures" which anti-virus software used to identify them. However, in today's world, viruses can change their code (while maintaining purpose) at specific points in time, after certain numbers of infections, and so on to avoid detection (polymorphic viruses). What are good example lines of code found in anti-virus software that can recognize polymorphic viruses?
2
-
1Just download some floss AV (eg. ClamAV) and take a random line of code. ... Yes, I know you don't want that, you want lines that are a sure sign for the program being AV software. But such single code lines do not exist.– deviantfanCommented Dec 1, 2016 at 6:52
-
Surely you can guess that the algorithms to detect such viruses will take more than just a few lines of code to express. I appreciate that you are taking a different approach in asking your previous question, but you've now asked too narrow a question to answer. You are looking for the approaches to detect, not the code itself.– schroeder ♦Commented Dec 1, 2016 at 7:39
Add a comment
|
1 Answer
Signatures are only created after a piece of malware has been analysed. So whenever a malware comes out with a different byte pattern, the av relies on behavioral analysis of the malware, like if the malware if dropping a certain registry key or a file with a specific name, hooking a certain api function from windows etc.
-
(+1) Good point, but I was referring to some actual program code examples found in anti-virus programs. Commented Dec 1, 2016 at 23:34
-
@ComputersAreCool As wrriten above, such a question doesn't make sense. ... All code lines and/or large independent parts of AV software can be part of non-AV software too. Just as screws in a race car are not specific to race cars, but usable in eg. in kitchen oven too. Commented Dec 2, 2016 at 7:26