The Anti-virus Times

Thursday, June 1, 2017

Do you know how malware programs are able to lull anti-viruses and users into a false sense of security? They have many ways to do this, but they usually rely on just two:

1. By launching a virus so it gains control over the operating system and the user's actions. The malware intercepts on the fly user and program requests to access certain resources, and returns the data in an edited form.

   Frodo (also known as RCE-04096) is considered to be the first stealth virus; it was created in Israel in 1989. At the moment of infection, this virus stores the boot sector and when the user requests it, it shows a clean boot sector instead of an infected one.

   http://stfw.ru/page.php?id=9250

2. By concealing a malicious file and its data in a separate area of the hard disk, service areas or specially created files. For example, at the moment of infection, the Trojan creates a file and marks it in a special way, creating a database or even a special file system in it (yes, a file system can be created in a file: broadly speaking, with regards to utilities, file marking does not differ from disk marking and is a sequence of areas for writing data). A password, encryption, or specific operating systems are used to prevent the anti-virus from accessing the file, disk partition or special areas. Bolik—a self-propagating, polymorphic banking virus—is an example of one such Trojan.

   But hiding the malware is only half the mission: attackers need to run it. They can do that with the help of completely legitimate programs—for example, by writing a task in the registry (of course, with a login and a password) to have a file retrieved from the storage.

   The virus transfers the data of the clean file instead of the real information. It follows that the anti-virus program is not able to detect any changes in the file.

   Virologist guide. Author
   http://voleyko.ru/spravochnik-virusologa-stels-virusy

Of course, this is not exactly the case. If an anti-virus was a standard program, it certainly could not detect the substitution.

To avoid being deceived, anti-viruses embed themselves into the operating system and install their own driver so that no malicious programs can filter data before it hits the driver.

But everything comes at a price — driver updates require a system reboot. This is the price you pay so that your anti-virus can acquire new knowledge. Our users often criticise us for this and even send us emails threatening to stop using Dr.Web because of this☹

Theoretically, a well-crafted stealth virus cannot be detected, and to neutralise it (if, of course, it’s been detected by way of indirect identifiers), the user must at a minimum reinstall the operating system, and more often than not, must change the memory.

But relax—you don't need to change anything.

An anti-virus is able to clear the memory from malicious files—this is exactly what the anti-rootkit API in the anti-virus is designed to do.