I used to work in the Anti-Virus industry (for about six years) and when Microsoft brought out the VBScript and Scripting Host concepts I could see both the good and bad sides...

'ILuvYou', and other VBScript 'viruses' that are currently circulating, are only the tip of the iceberg. The threat of VBScript-based viruses/worms is that introduction of polymorphism to the virus code will render (dare I say ALL?) current concepts in "anti-virus" software redundant.

As the virus/worm is in text form, and interpreted by the Scripting Host so as to become active, the use of conventional virus-scanning techniques will NOT work as they rely on "tried-and-true" methods such as search strings...

For example, Consider the following VBScript code snippet which is contained in a current virus:

dim octa

dim octb

dim octc

dim octd

Now consider this snippet - in which one variable name has been changed throught the virus text file:

dim octa

dim octb

dim octc

dim octe

According to my tests on a number of current AV products (and their latest virus-signature files) the first file is detected but the second one is not...

Would the AV indusytry therefore identify the second file as a variant? or a new virus?

But what if the virus included a simple polymorphism routine that changes the names of all the "variables" within the virus/worm script during the replication procedure... The above code snippet could become

dim V09GH

dim AAB09

dim HD3ED

dim QJ832

And each time the virus spreads its text will be different even though its functionality will be exactly the same. How will the anti-virus software fair? It will fail on all counts!!!

Anti-Virus companies have been warned - they were warned last year with Melissa, They were warned this year with "ILuvYou" and its variants.

The AV companies need to re-develop their technology to cater for this style of virus/worm OR Microsoft will need to re-engineer all their software to be less virus/worm friendly and possibly remove the presence of all forms of "scripting hosts" from all versions of Windows.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/32/1938#1938