Why run ondemand scanners in failsafe mode when the virus could have encrypted itself?

Question

The internet is full of guides of how to remove malware on already infected computers. Normally, step 1 is to enter failsafe mode, so that the virus can't interfere with the anti-virus program that easy. But if you got infected, you shutdown your computer, then the virus could have time to encrypt itself. And when you later on scan your computer in failsafe mode, the antivirus program can't find the data that the virus encrypted.

My question is the following: If a virus did all the things above, would that make it undetectable, or would the AV find the decryption-module, and therefore detect the virus?

Thanks in advance!

Answer 1

This is a very broad question. As you have not really talked about the type of encryption whether it be file based or memory based and so on.

Short answer: No, Just because it uses encryption doesn't mean it will be undetectable.

Long answer: It will however be likely to be undetectable until the AV vendor manually reverse engineers and generate some form of signature to detect (Byte signatures, checksums and so on)

Let's talk about your self encryption. This can be done in many ways. I am going to guess that you're talking about file encrypting.

So, Virus.exe encrypts itself which is highly complexed as you'll have to encrypt all sections (.text, .data and so on) and change OEP (Original Entry Point) to a self decrypt routine. The whole file has changed checksum but it won't change any more.

You could even go more advanced and encrypt itself each execute (Polymorphic code) which encrypt itself but self decrypt routine which will now be at the EP (Entry Point) can be used as byte signature to detect the malware as this has to be static regardless of the key you use to decrypt it. Otherwise, how would it know how to decrypt itself?

You could even go more in-depth into different forms of polymorphic code, metamorphic code, obfuscated code and so on but I don't know what exactly you're asking for. Either way regardless of what method you use to encrypt any form of itself will leave signatures for AVs vendors to manually reverse engineer and eventually to detect. The question is how long the wild malware will remain undetected for before it get send to a AV vendor to get reverse engineered and how long it will take the reverse engineer team to find static signatures they can use to identify the malware.

If this doesn't answer your question, leave a comment or update your question with the actual type of encryption you're talking about and I'll update my answer.