Take the 2-minute tour ×

Would this be plausible for a metamorphic virus? When a new generation (for lack of better word) is created it would hard code a random file name, that would be checked to see if the system was infected, that the old generation would create. Example


  1. absolute path to file named aabb.txt is hard coded into first generation
  2. checks to see if file exists
  3. if exists that means current system has been infected, goto END
  4. if does not exist this means it's on a new system
  5. uses metamorphic engine to rewrite itself and hard codes a randomly named file that will be used to tell if system is infected e.g. tk12.txt
  6. creates the file e.g. tk12.txt
  7. runs new generation
  8. deletes itself (old generation)


So it's incorrect to call this random file a mutex because it's not a system object?

share|improve this question
What is your question here? –  Rory Alsop Jul 30 '12 at 20:34
Has any virus done this? Does what I say work? It seems kind of obvious so I'm surprised I haven't heard of this. –  Celeritas Jul 30 '12 at 21:13

1 Answer 1

up vote 1 down vote accepted

Why not use a hashing algorithm against a dictionary? Your dictionary is a list of one hundred words that are eight to ten letters long. You pull a salt that is constant on the system you are hashing. You then use the constant salt and hash a random dictionary word and use it as an identifier on the system.

Later the same virus hits a system. It hashes all one hundred words at that time using whatever the constant salt would be for that system (this can be determined by some list of variables, with an applied percentage scale). Once all the words are hashed, the virus looks for the previous attack. If it finds it, it kills itself. If the previous attack is not found, the system is infected.

This would be especially brutal if done as a binary virus, i.e. a worm has to find a virus that hasn't done anything to the system yet, and together they do something. If only one is present, nothing happens (the virus is dormant, the worm only triggers if the virus is present).

share|improve this answer
reminds me of how Klez drops Elkern symantec.com/security_response/… –  Celeritas Jul 30 '12 at 20:21
let us continue this discussion in chat –  Everett Jul 30 '12 at 21:38

Your Answer


