How could an AV detect a virus that has a chance of not decrypting itself?

Question

If I understand this correctly there is a chance the virus may not decrypt itself at all. How could an AV catch this?

In some cases, the decryptor may start with a header whose intent is not immediately obvious upon reading it. Further study reveals that its purpose is to generate anti-emulation code on the fly: the virus constructs a small oligomorphic code snippet containing the instruction “ReaD Time Stamp Counter” (RDTSC). This retrieves the current value of an internal processor ticks counter. Then, based on one random bit of this value, the decryptor either decodes and executes the virus body or bypasses the decryption logic altogether and simply exits. 4

-Symantec's writeup on Simile

Answer 1

What the article says is that the virus contains a lot of specific code aimed at defeating anti-virus -- both the AV software itself, and the analysis techniques used by AV developers to figure out what the virus does. In the specific paragraph you quote, that's the latter which is discussed: the virus code alters its behaviour when it detects that it is running in an emulator.

Theoretically, a virus can always be defeated by a human being following the code "by hand". However, it is tiresome and takes quite some time. In practice, AV companies have nowhere near the time and resources to do manual analysis of every new brand of virus, which is why they need to rely on some semi-automatic techniques such as emulators. This is a losing battle in the long run...

Obligatory rant: a computer virus can exist and strive only because of flaws in the structure or implementation of computer systems -- in particular indulging in execution of code of dubious provenance. An example of a system which is well designed in that matter is a Linux distribution: executable files may come only as packages from official repositories, and the provenance is controlled with signatures. It is not "perfect" but the rarity of virus in the Linux ecosystem is suggestive that they do something right at some point. The best defence against virus is to fix the flaws. AV are like a new layer of paint to hide the crevices.

Answer 2

Some background:

They used to say some viruses were 'multi-part' or 'composite' in nature. That is now the general rule, rather than the exception. All attack code needs some method of attaching itself or being collected (mistakenly). This is the 'transport stage'. Then the code needs the chance to live, the 'attack stage'. Once active, the code seeks to 'phone home' and (hopefully) download more code or updates. Then there are additional elements that may remove logging evidence, disable AV utilities, or damage (or delete) data and applications on the target ('the host').

My Answer:

The AV task is to detect any foreign code or data as it arrives or when in place. This requires a 'signature' or unique characteristic that suggests an attack (or just malicious behavior). However, the fact that the payload (or other elements) are still encrypted should not effect this method of detection.

Encryption will likely prevent (or hinder) any attempts to fully understand all the capabilities of any attack, its true origins, or unique family of the attack.