0

Viruses used to have specific "signatures" which anti-virus software used to identify them. However, in today's world, viruses can change their code (while maintaining purpose) at specific points in time, after certain numbers of infections, and so on to avoid detection (polymorphic viruses). What are good example lines of code found in anti-virus software that can recognize polymorphic viruses?

  • 1
    Just download some floss AV (eg. ClamAV) and take a random line of code. ... Yes, I know you don't want that, you want lines that are a sure sign for the program being AV software. But such single code lines do not exist. – deviantfan Dec 1 '16 at 6:52
  • Surely you can guess that the algorithms to detect such viruses will take more than just a few lines of code to express. I appreciate that you are taking a different approach in asking your previous question, but you've now asked too narrow a question to answer. You are looking for the approaches to detect, not the code itself. – schroeder Dec 1 '16 at 7:39
1

Signatures are only created after a piece of malware has been analysed. So whenever a malware comes out with a different byte pattern, the av relies on behavioral analysis of the malware, like if the malware if dropping a certain registry key or a file with a specific name, hooking a certain api function from windows etc.

  • (+1) Good point, but I was referring to some actual program code examples found in anti-virus programs. – ComputersAreCool Dec 1 '16 at 23:34
  • @ComputersAreCool As wrriten above, such a question doesn't make sense. ... All code lines and/or large independent parts of AV software can be part of non-AV software too. Just as screws in a race car are not specific to race cars, but usable in eg. in kitchen oven too. – deviantfan Dec 2 '16 at 7:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.