If a virus rewrites itself for each infection how would it know if it has infected a file or not? If it keeps infecting the same file soon the whole file structure will be corrupt. For example how does Simile or Sality know if it has infected a file or not?

EDIT: they can't check something simple like "if they append 'kkk' to the end of the file" otherwise AV's would check that and the whole purpose of being polymorphic/metamorphic etc. would be defeated.

  • It's signed with the same root key, so it appends, e.g. md5 checksum at the end, which is a random string. Once the signature of the virus is known, it can be defeated, but until then, when you dont extract the private key or salt from the work, you wont be able to detect it. Jun 29, 2012 at 19:47
  • 1
    Malware writers usually bypass this problem by not caring that the file gets re-infected. They design it in such a way that it either continues to work regardless of infection count, or overwrites the existing infection.
    – Polynomial
    Jul 3, 2012 at 15:18
  • An interesting idea is the virus could create a text file storing a list of infected files and if this text file isn't found it would assume it's on a new system and infect everything.
    – Celeritas
    Jul 16, 2012 at 19:42

3 Answers 3


Eric Filiol's paper Metamorphism, Formal Grammars and Undecidable Code Mutation pretty much shows that it can be made impossible for a virus to know if a metamorphosed copy of itself has infected a file. Sic transit gloria anti-virus.

  • The PDF link talks about ALUMINUM PANEL
    – Tal
    Aug 13, 2012 at 11:23
  • 1
    Theoretically you are correct, but in practice a virus don't need 100% detection of itself.
    – Tal
    Aug 14, 2012 at 7:16
  • Changed the link, thanks for letting me know. Yes, maybe less-than-perfect detection works in practice. But the theoretical result shows that sort of thing turns into an "arms race". Aug 14, 2012 at 13:25

'kkk' would be encrypted.

An encrypted virus hides the virus signature (body) by encrypting the virus with a different key from infection to infection thus making it unrecognisable. A problem with encrypting viruses was that the decryption algorithm remains constant. The evil polymorphic virus counters this with a mutation engine that generates randomised decryption routines. The mutation engine and virus body are then both encrypted. (A metamorphic virus rewrites itself completely.)

So if they wanted to mark an infected executable with a string like 'kkk' they could (although there are much better ways).


Malwares do use simple marks.
I’ve seen one modifying file creation time, zeroing out the seconds part as the infection mark.

"...EDIT: they can't check something simple like ... otherwise AV's would check that and the whole purpose of being polymorphic/metamorphic etc. would be defeated."

Antimalware detection algorithm cannot depend on simple malware marks. The false positive implications can cause worldwide havoc.

  • but it could be easier to inoculate a system, in your example all files could have their creation times seconds set to 0s (admittedly in this case your loosing usage of the files created time)
    – Celeritas
    Aug 14, 2012 at 7:05
  • I do remember such an approach was used against the first Ping Pong virus. But it only helps to avoid new infections. already infected files are left infected.
    – Tal
    Aug 14, 2012 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.