1

Anti-malware software has to keep track of all bad software there is. To ease this load, it seems like a good idea to stop looking for threats that's been dead for years.

Is there any example of some malware that was "big", cleaned enough to be removed from anti-malware software and then re-released by someone or left on some offline infected computer for some time or similar, that actually got a noticable second spread?

2

"Re-releases" happen by accident all the time, when an infected, mothballed system gets re-activated, or old, infected media gets pulled out of archive. Case in point, my webserver has a log entry for a Code Red infection attempt in 2013, twelve years after the worm was originally released.

Because of this, antivirus software does not normally remove things from their virus lists. I would not be surprised to find signatures for the Morris worm or Elk Cloner in modern antivirus software.

  • True, Code Red is a pretty good indicator for somebody bringing an old NT4 server back online. Nimda is also another infection trace from this happening. – Fiasco Labs Nov 29 '14 at 21:59
0

If you peruse the various vendors catalogs of malware detected, successfully cleaned malware is re-released continuously with tweaks or is polymorphic in a manner that requires updates in detection to take care of software updates their creators apply.

Viruses and malware are just like OS systems now. All those security updates that you see released for Linux, Windows, Mac OS? The more sophisticated malware gets for a better want of term, "virility patches". They don't get cleaned, they just get new features so they can reinfect lax computer owners computers who think that one "Cleaning" is sufficient to make the problem go away.

Also like OS systems, they can be very modular in nature and have their own "Programs and Features" reconfigurability as well.

One trick pony malware like Code Red or Love Bug likely will never be re-released as they were simple hacks for specific vulnerabilities. What's out there now is persistent and always available.

  • no, I was thinking of an "unaltered" malware, or at least not altered by a human – Filip Haglund Nov 29 '14 at 21:24
  • In that case, you would need insane operating system and software developers that introduced regression errors into their products. That has occasionally happened, but not so much anymore. You're not depending on the Antivirus software to prevent it, but the OS and software itself to have been battle hardened. So unaltered malware isn't likely to survive. – Fiasco Labs Nov 29 '14 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.