💾 Archived View for spam.works › mirrors › textfiles › virus › virus4.txt captured on 2023-06-16 at 21:05:47.

View Raw

More Information

-=-=-=-=-=-=-

 
  ?????????????????????????????????
  ?  THE VIRUS INFORMER           ?      FACT:  Each day of the year a
  ?  your weekly virus newsletter ?             new virus is introduced into
  ?  by Mark E. Bishop edited by  ?             the computer industry.
  ?  Alan Bechtold                ?
  ?????????????????????????????????



     CHAPTER 4:  'The Engine that Kills!  A Mutating Menance!'
                 Dark Avenger Mutation Engine No Threat to Protected PCs


   Santa Clara, CA -- May 11,1992 -- McAfee Associates confirmed today that
 users of its suite of VIRUSCAN anti-virus products have nothing to fear from
 the new generation of mutating or polymorphic viruses.

   McAfee Associates, the nation's leading anti-virus software company, has
 been swamped with calls from concerned corporate PC users worried about the
 threat of the so-called Dark Avenger Mutation Engine.

   "Actually, we cracked this engine some months ago and have been shipping
 product capable of detecting the Mutation Engine since March," said William
 S. McKiernan, vice president, McAfee Associates.

   The Dark Avenger Mutation Engine, which first appeared on European bulletin
 boards a few months ago, is a new kind of virus threat. In the past, viruses
 such as the Jerusalem or the recent Michelangelo strain had distinct, single
 identities that made them relatively easy to detect and control.

   "The Mutation Engine, however, can be used by virtually anyone to create a
 mutating virus which is very difficult to detect," said McKiernan. "The fact
 that it is widely available on bulletin boards makes it that much more
 frightening."

   The Mutation Engine uses encryption techniques to avoid detection.  Before
 a virus can become active it needs to decrypt itself.  Ordinarily the code
 used for this decryption remains constant, allowing the use of standard byte
 matching techniques for detection.

   The Mutation Engine, however, uses a special algorithm to generate a
 completely variable decryption routine each time.  "The result is that no
 three bytes remain constant from one sample to the next," said Igor Grebert,
 senior programmer at McAfee Associates.  "This makes detection using
 conventional string matching techniques impossible."

   VIRUSCAN, however, has no such problem.  According to McKiernan, the
 downloadable shareware contains a new generation of virus detection algorithm
 capable of statistical and numerical analysis.

   It detects the Mutation Engine by "sensing" its presence rather than by
 attempting to actually spot it in a byte-for-byte string comparison.
 VIRUSCAN consistently detected all iterations of the Mutation Engine in tests
 done at McAfee, McKiernan said.

   Santa Clara-based McAfee Associates first received reports of the Mutation
 Engine early this year.  It is believed that the Engine is a product of the
 Bulgarian virus creator responsible for the original conventional Dark
 Avenger virus.

   Though some viruses using the Mutation Engine have already appeared in the
 U.S., the engine is not expected to present a widespread problem for some
 time, McKiernan said.  Typically the McAfee "early warning" network
 identifies new viruses months before they are a threat to the U.S. market.

   Nevertheless, the PC world has reacted emotionally to the presence of the
 Mutation Engine.  "It is clear that the game is forever changed," said
 columnist Steve Gibson in a recent issue of the computer journal InfoWorld.
 "The sophistication of the Mutation Engine is amazing and staggering."

   The presence of the Mutation Engine on bulletin boards may be more of a
 threat than the virus itself.  "You no longer have to be particularly clever
 or experienced to use it," said McKiernan. "Now if you have a modem you can
 be in the virus business overnight and the potential for proliferation is a
 sobering thought."

   McKiernan said that conventional viruses are turning up at a rate of 10 to
 20 per week.  "We expect that the Mutation Engine will increase this problem
 exponentially for those with unprotected systems," he said.


 - end -
Downloaded From P-80 International Information Systems 304-744-2253