Download Virus Bulletin, January 1992

January 1992
VIRUS BULLETIN
Page 21
Interestingly, UNVIRUS reported that it had detected 431
viruses in those 324 files. Since the test set contains files
infected with a single virus, I was alarmed by this because this
means that UNVIRUS cannot distinguish between two or more
similar viruses: the efficacy of its file repair capabilities must
therefore be called into question. For example, it said that one
of the Jerusalem variant-infected files contained Cascade as
well as two Jerusalem variants. I don’t subscribe to the
‘repair’ philosophy myself: it’s much safer to delete any
offending programs and restore from known clean backups.
[In unofficial testing, I used a larger, more up-to-date collection of 746 COM and EXE infections, UNVIRUS detected
viruses in 572 files. As a comparison, S&S’s Findvirus and
Sophos’ Sweep both detected 740 infections. Note that these
results are not shown in the accompanying results tables.]
The first 16 bytes of unknown virus code to be executed
by the CPU are selected as a pattern and displayed to the
user for approval.
Execution speed is not too bad when checking just program
files (COM, EXE, OVL and XTP - Xtree overlay files) but
when checking all files, it was decidedly sluggish. I had to run
this particular test three times because the first time I ran it,
UNVIRUS crashed and failed to complete the check.
Virus Information
If you know that a particular file is infected (or if
VIRUS.PGM has been created), then you can instruct
VSMENU to ‘learn’ about that infection and the resulting
search pattern is displayed in a dialog box. The pattern chosen
by VSMENU is invariably the first 16 bytes that the CPU
would process when the program is executed. That’s fine and
dandy for most older and less-sophisticated viruses but as
already explained it’s useless against the newer viruses that
use variable encryption techniques where the chance of the
same 16 bytes of static code appearing at all is minimal.
Moreover, the likelihood of the first 16 bytes of the code
executed being ‘virus-specific’ enough to eliminate the danger
of false-positives is much reduced in comparison to good oldfashioned selection by disassembly.
VSMENU can also display information about the viruses
known to the package. Except in one or two cases, where it
did display specific information on a particular virus,
UNVIRUS displays information of such a general nature as to
be misleading. For example, exactly the same text is displayed
for Micro 128 (which merely replicates) and LoveChild which
overwrites part of the hard disk when it triggers.
Virus signatures such as those published in VB can be added.
Many anti-virus programs identify encrypting viruses using
identities which are hard-coded into the software. It’s a pity
that ViruSafe’s authors haven’t taken the same approach.
Scanner Accuracy
Of the 364 files in the standard Test Set (see VB, September
1991, page 18), UNVIRUS found viruses within 324 files, the
remaining 40 infected files were passed as clean.
Xtree states that it gives priority to detecting those viruses
known to be at large. This approach is fraught with problems
particularly when marketing products of this type worldwide.
What is at large in Europe may never have been heard of in
the US or Asia etc. If a virus is known to exist it should surely
be incumbent upon vendors of anti-virus products to enable
users at least to identify it. Xtree’s performance in tests
restricted to viruses at large is documented on pages 18-19.
A database is provided containing information for each
virus known to AllSafe. The information is extremely
vague, the above description for the sophisticated INT13
virus applies to any number of other specimens.
VIRUS BULLETIN ©1992 Virus Bulletin Ltd, 21 The Quadrant, Abingdon Science Park, Oxon, OX14 3YS, England. Tel (+44) 235 555139.
/92/$0.00+2.50 This bulletin is available only to qualified subscribers. No part of this publication may be reproduced, stored in a retrieval system, or transmitted
by any form or by any means, electronic, magnetic, optical or photocopying, without the prior written permission of the publishers.