The Anti-virus Times

Thursday, March 16, 2017

“O snail
Climb Mount Fuji
But slowly, slowly!”

Kobayashi Issa

Once upon a time, there existed stealth viruses . It was a long time ago, back in the DOS era. Stealth viruses and their descendants lived violent lives filled with events that often brought them to the attention of the entire world. However, eventually they were overrun by hordes of consumer malware. Let’s recall all of them!

Before going any further, let's take a look under an operating system's “hood”.

We open files by clicking on their desktop icons, but what do the files really look like? Essentially, they are sets of bits (and blank fragments—if part of a file contains no data, it may be empty) that have been recorded on some media. This definition is somewhat incomplete, but for our intents and purposes, it will do.

This set of bits—usually ones and zeros—is scattered all over the hard drive (or sometimes all over the Internet).

As one clicks on an icon, the operating system handles this event, determines the file name, translates it into the format it understands and sends a lower level query. After receiving a set of bits (sometimes it can also be converted) in response, an application usually doesn't output them on the screen but converts them into a user-friendly format. It’s very unlikely that anyone could mentally convert a set of bits into an image of a kitty cat!

This means that the programs we use don’t access the hard drive directly (except for some system utilities, but those don’t use the media often and just go several levels down). And at each stage, a filter can be set up.

That's what anti-viruses do—they intercept attempts to access files and verify them before the operations are performed. But malicious programs can do that, too.

For example, if an advanced user gets suspicious and wants to view the list of processes or contents of a folder, he or she will most likely use a system utility. The utility will request information about the contents of the folder; the operating system will send a query to the hard drive. Meanwhile, malware will purge the list of files that the user receives, so that the latter believes that the folder is free of any suspicious files.

That's why an anti-virus's driver must operate on the lowest level possible to prevent malware from altering information so that the anti-virus won't be able to detect its presence.

How can we deal with this scourge?

Polyphage anti-viruses are effective against all known viruses, i.e., those viruses whose behaviour patterns are already known to anti-virus developers and registered in the application's database. If a virus is unknown, it will remain undetected.

You do remember what polyphage anti-viruses are, right? :-)

It turns out that the well-known Dr.Web anti-virus is a polyphage AND a detector!

But let's go back in time to when there were many types of anti-viruses and few people realised the direction in which they would all evolve. Stealth viruses belonged to that era. They could be divided into three categories:

• Boot sector viruses avoided being detected by utilities that featured low-level access to media and could read data directly from disk sectors. Viruses of this kind often displayed the disk contents that existed prior to an infection.
• File viruses intercepted file operation requests in order to conceal changes in files on disks and in the memory.
• Macro viruses.

Shall we take a quick glance at the news archive?