A more advanced method is the use of simple encryption to encipher the virus. In this case, the virus consists of a small decrypting module and an encrypted copy of the virus code. If the virus is encrypted with a different key for each infected file, the only part of the virus that remains constant is the decrypting module. In this case, a virus scanner cannot directly detect the virus using signatures, but it can still detect the decrypting module, which still makes indirect detection of the virus possible.

Mostly, the decryption techniques that these viruses employ are simple and mostly done by just coring each byte with a randomized key that was saved by the parent virus. The use of XOR-operations has the additional advantage that the encryption and decryption routine are the same (a x or b = c, c x or b = a.)

feedback form

feedback form

Any feedback you provide (corrections, updates or suggestions) are sent to the owner of this FAQ
and anyone else involved in writing or editing this item.

by uid1307457
last modified: 2009-04-27 18:03:32