I know the era of the self spreading worm is over, but has this mechanism for determining if a machine has already been infected or not ever been used? When a virus runs it checks to see if the machine is already infected by searching for a string, for example a key named
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft. If it's found it means the system has already been infected. If it's not found then the virus will make a new generation of itself, that searches for
abc instead of
xyz, create the registry entry
abc, launch the new generation and delete itself.
//initialize string matchMe to an arbitrary value if(findThread(matchMe)) //machine already infected else matchMe = getRandomString() addtoRegistery(matchMe) spawnNewGeneration(matchMe) deleteSelf();
This way it doesn't leave behind any easily tell-tail signs that an antivirus can look for.