-1

I am a master student and I am working on a mini-project on virus recognition and how to get rid of the virus.

I had to infect my virtual machine and then clean the virus or Trojan using various ways.

My question is about the following cases:

  1. a pdf file that was infected with a simple virus was left undetected by windows defender, and I am quite sure the database definition was up to date.
  2. Kaspersky could not recognize "Trojan Simulator", but malware bytes could detect and remove it.

the question is: why these known antiviruses could not detect such a rudimentary malicious pieces of software?

your soonest answers are more than welcome.

thanks in advance.

Improve this question
2
  • In the case of the "simple virus", there is no way to know why detection fails given the very limited information provided about it. Can you at the very least provide md5sums of the files you are asking about? It would be ideal if you could share the source code and the binary as well so that others can replicate your results
    – julian
    Jun 25, 2017 at 14:36
  • There isn't a piece of software that can detect malicious behaviour. Every behaviour can be malicious or not. Maybe you want to encrypt your harddrive and maybe you want to download from some russian ftp server. It's not like AV is able to read minds.
    – BlueWizard
    Jun 25, 2017 at 21:44

2 Answers 2

Reset to default
2

Traditional anti-virus only identifies viruses that match a signature file, so any modification or obfuscation of code will mean it won't be recognised. This is exactly expected behaviour.

Some antivirus will delve deeper and try to remove obfuscation.

Latest ones look at behaviour of code, not just try to match signatures.

But in general, if a particular AV has a signature that matches the infected file, it will identify it, otherwise it probably won't. And all of the vendors update their files based on what they see.

Improve this answer
2

How does antivirus work?

Most antivirus solutions start by comparing potentially dangerous code to a set of patterns and rules that make up the antivirus definitions, which match known malicious code. Antivirus definitions are updated regularly as new malware is identified by each vendor. This sort of identification is called static analysis. In addition to static analysis against a set of signatures, more advanced antivirus solutions also test for malicious activity, called dynamic analysis.

SOURCE

Static analysis is performed in a non-runtime environment. Typically a static analysis tool will inspect program code for all possible run-time behaviors and seek out coding flaws, back doors, and potentially malicious code.

Dynamic analysis adopts the opposite approach and is executed while a program is in operation. A dynamic test will monitor system memory, functional behavior, response time, and overall performance of the system.

This was just a brief overview of how they make up their definitions. Whenever they receive new sample, they analyze it and update their definitions. So how fast definitions are updated by vendors may differ and if a particular malware gets popular all of a sudden you will find that it will be detected by maximum antivirus. So It all depends on the vendor and their consistency.
So there is no saying which antivrus do their job best. You can also upload your files at NoDistribute and check how many AV were able to detect it.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.