1

I was wondering... if antiviruses store virus definition files that contain virus signatures then why wouldn't they get detected as malware by themselves or Windows Defender or any other AV out there?

2
  • 1
    Have you considered that the definition could be stored as a hash or in an encrypted way?
    – LvB
    Oct 6, 2020 at 4:28
  • 2
    That's a little like asking why someone's handwritten signature would not get confused with the real person. It's a signature...
    – schroeder
    Oct 6, 2020 at 7:00

2 Answers 2

2

That's a good question, and the answer is they do, or at least they did.

It used to be a common problem and was one of the reasons it was recommended not to install multiple virus scanners, because they would trigger on the other vendors signatures.

Currently nearly all signature files are encoded or packaged in some way that alleviates cross scans of signature files. For example the open source virus scanner ClamScan provides signatures as zip files although their extension is not ".zip". Uncompressing one of these signature files shows content like the following:

e6fec7dc14a74ded93fb9bc50f408e1c:101888:Win.Trojan.Mybot-3069
2fdfa9f7b22e209b4e4aee51109767c1:56320:Win.Trojan.SdBot-599
005d1d1c578316d70c1e0e4f56b61f5f:65341:Win.Trojan.SdBot-600
4ca8616bdd7a9e1d6c60b1d6793dee8a:182272:Win.Trojan.Startpage-295
e83beca0b22cb86b40e77230a41cb827:86493:Win.Trojan.Wootbot-88
8074bd1c4b28bf4296a7a5b85074769f:92672:Win.Trojan.Wootbot-89
90b59c2621ffa8c966f4209073808db9:151552:Win.Trojan.Wootbot-90
dc09af7adcb2f9d1acda2ab9dce0bcc5:104960:Win.Trojan.C-198

The scanner is looking for the binary patterns represented by each of these entries, however these entries are ASCII HEX representations of the binary string, not the actual binary string.

In order for the virus scanners to look for a match, the signature and the scanned files must be in a matching format before comparison. This could be ascii hex or a hash, or anything else but doing so to all of the files is a much higher overhead than simply converting the signatures to raw binary for comparison.

Converted to native binary signatures, they are now in a state that could easily trigger another virus scanner but generally this is now done in-memory only, and not written back out to a file.

For another virus scanner to key on the now native binary signature, it would have to be scanning simultaneously and scanning other in-memory processes. While less common now, this does happen!

-1

Well, I would assume that the antivirus is just using a virus signature, and as such couldn't mistake it for a virus. It's like Schroeder said, the antivirus is just using a signature, it's not actually a virus, merely a way to identify the virus and remove it quickly.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .