Has this method ever been used by viruses to check if system has already been infected?

Question

I know the era of the self spreading worm is over, but has this mechanism for determining if a machine has already been infected or not ever been used? When a virus runs it checks to see if the machine is already infected by searching for a string, for example a key named xyz in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft. If it's found it means the system has already been infected. If it's not found then the virus will make a new generation of itself, that searches for abc instead of xyz, create the registry entry abc, launch the new generation and delete itself.

In pseudocode

//initialize string matchMe to an arbitrary value
if(findThread(matchMe))
//machine already infected
else
 matchMe = getRandomString()
 addtoRegistery(matchMe)
 spawnNewGeneration(matchMe)
 deleteSelf();

This way it doesn't leave behind any easily tell-tail signs that an antivirus can look for.

Answer 1

So I have "Practical Malware Analysis" by Sikorski and Honig in front of me. They describe the use of threading, but I think the more popular form of what you're describing is a mutex. Malware can create mutexes at the kernel level with specific names using the KeInitializeMutex system call, and use that mutex to mark that system. If another piece of the same malware drops on the system it can then look to see if that named mutex is a) present, or b) owned by another process. If it is, then it is reasonable to assume that you've already infected the computer. Of course, it becomes a great signature for anti-virus and other pieces of competing malware.

They also describe the use of the registry. Malware can look for specific values in the registry, and achieve persistence by embedding itself as a service.

So yes, this technique is used. I believe some of the sample "malware" they ship with the book uses these techniques.