From news-service Fri Nov 11 08:39:27 1994
To: subscribers
From: kazatski <kazatski@kartaly.chel.su>
Newsgroups: relcom.comp.virus
Subject: [News] ஢ ᭮ 䨧 ( SU.VIRUS, .)
Date: Wed, 09 Nov 94 00:28:07 +0300
Distribution: su
Organization: Kartaly E-mail host
Message-ID: <AAcr-lkuh3@kartaly.chel.su>
Reply-To: kazatski@kartaly.chel.su
X-Return-Path: survax.rich.chel.su!kartaly!kartaly.chel.su!uucp
Sender: L-relcom@kiae.su

  !

       SU.VIRUS  ஬쪭㫠  ⭠      ஢
᭮ 䨧. 뫠      ७,  ,  
-    ⠫.

----------------------------------------------------------------------

     묨  ᠬ  뢠  ,  騥  ᢮  
ࠧ묨   ᯮᮡ   (筮,   ᯮ騥   ࠧ     
஢)  ६ ࠦ  䠩    ணࠬ.  筮,  ⠪
  ᮤঠ    樨  ஢騪     ஢騪.   
ࠢ, ᮧ  ஬ ஢騪    ᮮ⢥騥
  ஢騪,  ⫨      㣠    ࠧ  
६.  ஢   ᭮    易⥫쭮  
⢮ ணࠬ  ࠢ쭮  ஢  -  ஢騪
 ਯ (decryptor).

        ஢騪    ﭭ  -  
   ஢ 䠩.    ᮡ  
  ⥪஢  ஢  䠩     ࠪ୮   
  ப (᪥  ᨣ).

      । ஢ ᭮ 䨧.    뫨
। Alan  Solomon,  Mechanism  of  Stealth,  Proceedings  Fifth
International Computer Virus and Security Conference, New York,  March
1992, pp. 232-238.

                            ⪮  ஢.

     ஢ 1.    ᯮ  ﭭ  祭    ࠧ
᢮ ஢騪.        ।    
ﭭ  ⪠      ஢騪.    ,  ,
뢠 " 祭  묨"    묨  (oligomorphic).

     : Cheeba.A (2 decryptors), Cheeba.B (2), December_3rd  (2),
Slovakia.2_00 (8), Slovakia.2_02 (8), Slovakia.3_0  (8),  V-Sign  (6),
Whale (34).

     ஢ 2.  ஢騪    ﭭ      ᪮쪮
権.  Hਬ,  ᯮ   ࠧ   ॣ,   
ୠ⨢ 樨  ஢騪.     ⠪  
।  ᪥  -  ⠭  ।      ਯ.

     : ABC,  DM.330,  Flip,  Jerusalem.Moctezuma,  Ontario.1024,
PC-Flu,  Phoenix.1226,  Phoenix.2000,  Phoenix.Evil,  Phoenix.Phoenix,
Phoenix.Proud, Seat, Stasi, Suomi, Virus-101, VS.3900, VS.4000,...

     ஢ 3.  ,  ᯮ騥    ஢騪  ,  
騥  ஢ ᭮ ,   "-".  
⠪ ,  NOP, MOV AX,AX, STI,  CLD,  CLI,...    
⠪    ⥪஢         ᪨,   ᫨   ந
"ᥨ"  "" .

     :   Tequila,   StarShip,   V2Px.V2P1,     V2Px.V2P1.Casper,
V2Px.V2P2, V2Px.V2P6, DrWhite,...

     ஢  4.   ᯮ짮      ஢騪   塞
権  "६訢"  権    ᮡ    
⬠   ஢.   Hਬ,      MOV   AX,BX   
塞 樨: PUSH BX - POP AX; XCHG AX,BX;  MOV  CX,BX
- MOV AX,CX; ....  ਭ樯,  ⥪஢    ᮢ
  ன ॡࠥ ᪨.

     ஢ 5. 砥  ᥡ ᯮ짮  ᫥  
஢,  ⠪ ஢騪  ᯮ짮  ࠧ  
஢  ᭮  .      ᯮ짮,   
஢ ᭮ ᭮ , ஢    ᠬ  
ਯ  ᪮쪨 ஢騪, ।  ஢뢠
  㣠,  ,  ।⢥,    .      ࠢ,
⥪஢  ᮢ     ஢   䨧      
ᨣ .    ⥪஢  ,  ᮡ,  祭
⠪    -  祭  ᫮    ,    ,   쭮
த⥫쭠  ६ (difficult and  time-consuming  task).  ᫨
  ⥪஢  ⠪      쥧    
⮫쪮 ᠬ ஢騪,      祭  室  ந
      ஢  ⥫   ,      祭
ਣ쭮  ଠ樨    ࠦ  䠩.         
⨢ᮢ 祭 ᮢ ᫥ ஢ 䨧  ந
-V  Dr. Web. SMEG-,  ࠩ ,        
.

      4  5 ஢: MtE,  TPE,  APE,  DAME,  DSME,  DSCE,  NED,
MGEN, CLME, SMEG-based, Uruguay,...

       祭,   6 㯯  ᮢ.  
஢  ,  -    ,   騥      ணࠬ
-⥩,  "६訢"    ⥫  .  
,     "㡨"      ᢮   ணࠬ   (⠫樨,
ࠦ,  ࠡ稪  뢠,    䠩    ..).  
 뢠 騬 (permutating).

           ᠬ   ⭮:   BadBoy,     BadBoy.Worthless,
CommanderBomber, Leech, SN.1444,...

       ⮢    ᮮ饭  뫠   ᯮ짮   
Vesselin  Bontchev  'Known  Polymorphic  Viruses',  Secure   Computing
January 1994 pp. 60-63.

                    . 

--- GoldED 2.42.G1219+
 * Origin: ID, Igor Daniloff, St.Petersburg, id@sald.spb.su (2:5020/69.14)
-------------------------------------------------------------------------

---
OK


