2

I know some viruses repeat the same actions over and over again with no break, thus grinding the network to a halt. But others "take a break" from there repetitive actions.

For example Nimda performs it's mass mailing routine every 10 days. How does it know "10 days"? It can't create a file with the date it last done it, that would be a dead giveaway to AV's.

Another is the Sasser worm. It "Attempts to create a mutex named JumpallsNlsTillt and exits if the attempt fails. This ensures that no more than one instance of the worm can run on a computer at any time." Wouldn't this be a dead give away for AV's? What exactly is a mutex?

Improve this question
2
  • That's a good explanation of mutexs. So a mutex is internal to a program?
    – Celeritas
    Commented Jun 28, 2012 at 19:50
  • No, this mutex is one per OS, so you can make only one like this with the same name, so each application would have to use separate name with its version to avoid conflicts. There are also security features on these. They are used for inter-process communication as well. I called them process mutex because it's used for this purpose in this example, as well it's most popular use for it, at least for me.
    – Andrew Smith
    Commented Jun 28, 2012 at 19:53

2 Answers 2

Reset to default
2

There is no set way that a virus will behave. It is up to the creativity and skills of the creator of the virus. To check if a executable is already "infected" it may be as simple as: does file F contain X?

For example:

Propagation 

while (true)
    file = random executable
    if (file does not start with 123)
        prepend virus to file

Each new file will contain the virus (most likely morphed version of the virus) which will then enter propagation.

Triggering phase

The virus activates itself; this can be based on the clock (as described by Andrew Smith) or by the number of times the virus has copied itself. It may even be as simple as file/process somewhere else keeping track ("file with the date")- possibly MUTEX.

I guess I am trying to say there is no defined way a virus will behave or do things. It reproduces itself by A, triggers with B and performs C; that is the beauty of it.

A, B and C equal whatever you want them to equal.

If you do some googling you will come across some historical viruses that may be interesting and provide insight on how some of them worked in regards to propagation and triggering.

Mutex

I could answer or I could just direct you to this page and wiki :)

Improve this answer
3
  • I guess what I'm trying to say is there seems to be a catch 22. If a virus can check to see if a file is infected or not an AV can do that same check.
    – Celeritas
    Commented Jun 29, 2012 at 6:18
  • @Celeritas Yes, but how will the AV know which file to check in the first place? AVs currently are very reactionary, they can only detect viruses whose actions and signatures are already known. New viruses will be missed by the AVs until the virus signature database is updated.
    – user10211
    Commented Jun 29, 2012 at 8:12
  • @TerryChia true the AV won't know which file to check but at least it won't have to check the whole file (e.g. if the viurs appends 'kkk' to the end of a file then the scan only needs to check the last 3 characters). That actually makes me wonder something else.
    – Celeritas
    Commented Jun 29, 2012 at 19:12
4

Nimda is using simple function. By taking number of seconds since the start of epoch, divides it by 60 seconds, 60 minutes, 24 hours and then by 10 and if modulo = 0, then it performs attack, as long as the modulo = 0, which happens every 10 days for a period of 24h. http://www.calculatorpro.com/calculator/modulo-calculator/ 10 mod 10 = 0, so by taking number of days since start of epoch you can run attack for 24h every 10d.

Process mutex is kind of lock which helps to manage the process in a way that it doesnt start once it's already running like this. This is very useful apparently.

https://stackoverflow.com/questions/93989/prevent-multiple-instances-of-a-given-app-in-net

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .