Searching For Specific Patterns: Scanning

About Scanners

Virus scanners are products designed to help identify viruses within files, boot sectors, partition tables, memory, and other hiding places; to name them; and potentially to help remove them. Scanners cannot be your only approach to maintaining a virusfree environment, for they are destined to failure, and can be timeconsuming to run.

Nevertheless, the scanning job is an important one, and it is reasonable to wonder whether the scanner you are using is adequate for the job. It is reasonable because of the astonishing claims made by some vendors. One vendor bragged that their product "is now on its third upgrade and well into its second year on the market. The product has had a chance to mature and grow in order to satisfy enduser's needs. We are also pround (sic) to announce that [truly big and famous company] has recently signed a corporate license agreement with us to use [product name] internally. " Unfortunately for this truly big and famous company and other shoppers, the product was only able to detect viruses in four of 95 test files, each of which was infected with a different virus.

We believe that ability to detect a virus, even if the name provided is not quite in keeping with local custom, is probably the most important feature of a scanner. Assuming a choice between two scanners which detect every virus ever developed, we would then choose the most precise or fastest, providing it made a clamor or displayed a message on the screen when it found something.

Why a Scanner: Pros and Cons

Many users swear by scanners as a means of helping to detect viruses. Others seem to swear at them. Here's a quick look at their pros and cons.

Pros

A scanner is critical for providing a precise identification of a virus in your system. Without a precise identification, we cannot know the best course of action for removing it, and we cannot be sure we have removed it completely.

Unlike the "change checkers" described previously, or the TSRs to be described in the next section, the scanner is the only kind of antivirus program that can spot a virus before it has run. Thus if you use it to check new software before running it, you can prevent even one of your files from becoming infected.

Cons

Not all vendors tell the truth. I was once shown a scanner at a trade show that "defeated all known viruses. " I asked if it defeated X, Y, or Z, pulling a few names from my hat that I thought they might not have heard of. No, no, no were the replies. "What does it catch", I asked. "DataCrime" was the reply. "Which version?", I asked. The programmer wasn't sure. But I was assured that I could add scan codes, to catch other viruses. "Where do I get those scan codes?", I inquired. The programmer was not sure. The moral of the story is that a scanner might not catch quite as many viruses as the marketing folks would have you believe. Be sure that the scanner you are about to purchase catches the viruses you have some reasonable probability of getting this year.

Scanners are always out of date. Most scanners are usually somewhat incomplete when they are released. No virus researcher has access to every virus on earth. But even if your scanner was absolutely current one month ago, and caught every virus that existed on earth the day it was released, there are now 60 or more viruses that it cannot catch. While your odds of getting a brand new virus are very, very small, you must recognize that scanners will not catch everything.

Some scanners may not clean from memory the scan codes they use in searching for viruses. If you run two scanners in an uninfected machine, you have some chance of a false alarm when running the second scanner.

Hex (Binary) Strings

It is sometimes said that a program is stored in "binary". As with most assertions, this is not quite true. When you try using the TYPE command to view one of your COM or EXE files, what you are looking at is tokens, or symbols which can be translated into instructions your machine can understand. A total of 256 different symbols can be used, sometimes called "the extended character set", ASCII, or ANSI. When these characters are stored, they are not stored as you see them, of course, but rather as magnetic patterns of positive and negative pulses, according to rules followed by your hard disk or floppy controller.

By using a base of 16 rather than 10, it is possible to refer to each of these 256 values using just two characters. The 256 values can be assigned numbers, which can range from 0 to 255 in decimal (base 10) or from 00 to FF in hexadecimal.

A program that is looking for a virus can look for some unique sequence of code within each of your programs. In the case of the Jerusalem virus, we are likely to be able to find the 4 byte hexadecimal pattern 8E D0 BC 00 07 50 B8 C5 in many of our different strains.

Using a short scan code can result in some confusion, as a scanner can call each of several viruses by the same generic name. Using longer scan codes poses a different problem, however. While it ensures that we have precisely identified the virus, a virus that is slightly different might not be detected at all! So a clever scanner might look for a simple common string, and then if found, look for additional information from its database of known strings. If one is found, it can identify the virus precisely. If only the simple common string is found, then the scanner might confess as follows: "Jerusalemrelated virus detected in file. "

Many viruses encrypt parts of themselves when they infect files, in order to defeat the scanners that are looking for them. Each encrypted copy of the virus looks a bit different to a scanner, and only the decryption algorithm provides a solid clue to the scanner as to what virus is here. Because decryption algorithms can be legitimate code, this becomes a difficult problem. The Fish 6 virus is encrypted, but you can still find it by looking for 7 or 8 byte patterns.

Using a Scanner

If you plan to use a scanner, you must follow these instructions if you hope to achieve success in detecting viruses:

- Cold boot the machine to be scanned from an uninfected writeprotected floppy disk. Because a virus cannot get past the write protection mechanism of a floppy drive, you are thus assured that no virus has moved into memory, from whence it can defeat your scanner.
- Run the scanner from the disk you just booted from, and do so before running any other programs ¾ especially programs that are on a drive other than the one you just booted from. Any device driver called by your hard disk's CONFIG. SYS can contain a virus.
- Scan the disk you just booted from, to ensure that it is not infected.
- Watch your screen carefully during the scanning process, if your scanner does not pause when it detects a virus.
- Follow the instructions for your scanner carefully. Failure to issue the correct command line may result in a partial scan, and you might inadvertently skip the scanning of a directory which contains a virus.

Problems with Scanning

The scanning paradigm has problems with both virus detection and removal, and these problems are growing over time. There are other problems, as well, leading us to the conclusion that a new paradigm is necessary.

- Scanning takes time. It takes a finite amount of time to scan a machine for viruses perhaps 5 minutes or more. If the country's 70 million employees who use PCs spend 5 minutes a day scanning, and earn $15 an hour, the annual cost of scanning (260 days a year) is $22,659,000,000. The costs of scanning exceed the purchase price of anti-virus software after just a few weeks of scanning.
- Scanning is mis-timed. If a machine is scanned every day at 9 AM, and infected one day at 9:05 AM, the virus has an entire day to spread throughout the machine and the organization. A virus can spread surprisingly far in this length of time. Even if the scanner is able to detect this virus, scanning presumes that the virus has already infected some disks or files. Traditional scanning is thus a means of detecting a problem that has already occurred, rather than a way of preventing a problem.
- Scanners need constant upgrading. With 10 new viruses each day, full detection via a scanner requires daily upgrades to the product. But most organizations find upgrades a nightmare, and will not be able to upgrade this frequently. Organizations need something that does not require frequent upgrades.
- Scanners are Slowing. The more viruses a scanner must search for, the more places within a file it must search, and the more files it must search across, the slower the search must be. Since strings must be stored in memory, and memory is limited, we will soon see two-pass products, which load one set of strings, scan, then load a second set and scan. While vendors have used indexed searching techniques to speed their task, and computers are faster than they once were, their drives are also getting larger. Tomorrow's scanners will inevitably be slower than today's and yesterday's.

Scanner Maintenance is Beyond the Capability of Vendors. If there are only 10,000 viruses today, and the average virus requires only 1 hour to analyze, write detection instructions, and test those instructions, then creating just the detection instructions is a 10,000 hour job about 4 person years. To compound the problem, polymorphic viruses can each require weeks of analysis by the world's most skilled programmers to determine how to detect it. It is no wonder that during the past year, many vendors have either failed or been absorbed by bigger companies. Today, the U.S. has only a few vendors with American-made products: IBM, McAfee, Symantec/Norton, Norman Data Defense Systems and RG Software. The programming strain of the traditional scanning paradigm has been one of the causes of this shrinking in the anti-virus vendor industry.