-| Source of Kaos |-
                      -| Of Dumb and Dumber |-


F-PROT and Dr. Solly

This article is more aimed at those lame AV companies.  Once upon a time F-Prot
found a virus called Butterfly.302.?????  (????=a,b,c,d).  This wasn't a
special virus or anything, just a simple com infector, but I could never seem
to find all the variants of it.  Well, persistence paid off and I managed to
procure all of the variants.  Having the source to one of the variants, I
wanted to see what was so different about them.  After all, F-Prot said that
there where 4 variants, so they must be something different in how they work.
Right!  Wrong, turns out that F-Prot was pulling some suck ass trick that I
would have expected out of McAwfull.  Frisk and Dr. Solomon are just trying to
pump up their numbers. For the only difference between a, b, c, d and any
302.unknown variant is the text inside of the virus.

CONCLUSION: FPROT/Dr. Solomon are a bunch of lying greedy bastards.
            For that fact, all of them actually are.

AVP

Well, at one point in time I thought AVP was a good product for scanning
viruses, after all no one else at the time had any luck with the Uruguay strain
of viruses.  These days however, my faith in this product has been rapidly
diminishing.  After installing the latest update I went to scan my collection
of new viruses..  Low and behold AVP seemed to identify almost 20 of them.
I was impressed until I looked and AVP had identified them all as the same
virus.  Problem being is that I knew these weren't the same virus or even the 
same strain.  Hmmm maybe AVP is keying on a small scan string and once it sees
it, it doesn't look any further ..

CONCLUSION:  AVP is using a scan string that is either 2 small or 2 generic and
             they deserves to be screwed when someone exploits this problem.

TBAV

You say 3 companies doing something stupid would be to much of a coincidence??
NOT!  Thunderbyte isn't  exempt from doing something stupid with their scan
strings.  I happened to be playing around with a simple com infector and I do
mean simple, when I decided to add encryption to it.  I pulled the encryption
routine straight out of a 40Hex issue that had an article on encryption 
with the Leprosy virus as the virus.  TBAV promptly claimed that my virus was 
a type of Leprosy virus.  Hello - McFly - anybody home ??

CONCLUSION:  TBAV is ripe for using something like this to screw over TBCLEAN.

Dr. Solomon

Here's a real nifty one for the fans of this slow moving product..  Take a look
at the demo virus that comes with VICE03 and 04.  Notice the int 3h at the top
of the code (see sok-2.009/one-13.asm for the full source code)

;            int     3                      ; Original Line of code
            xor ax,ax                       ; Replaced with this line of code
                                            ; and poof this virus looses it's
                                            ; identity
            call    nx                      ; get relative offset
nx:         mov     si,sp                   ; no-heuristic
            sub     word ptr ss: [si],offset nx
            mov     bp,word ptr ss: [si]
            add     sp,2

After altering the 1/13th virus in the above manner all virus scanners used in
testing couldn't identify it as the 1/13th .  Dr. Solomon actually lost the 
virus completely.  Seems Dr. Solly uses crc for identifying allot of his 
viruses.  Guess this isn't such a good idea hey Doc ..