[Question] Anti Virus signatures?

[ayu]

I see myself as a pretty organized human, thus making me want to keep my computers pretty organized as well.

This includes a very organized and secure box.

And this has since long ago have me bound to the interest of the making of malicious apps and the destruction of them.

I have read a lot about anti virus and some may know that i have tested a lot of them as well ^^

Now there is something i would like to know, that i can't seem to find anywhere.

1: The signatures that the anti viruses use to identify the malware, if i am not mistaken it should be the first 20 bytes of the file or so, but i am not sure. Could someone help em clarify how this works?

2: Secondly i would like to know where some anti viruses store their signatures. For example when you update your anti virus, it downloads a number of definition files. Where does norton for example, store these? and how would i be able to see the signatures in clear text?

Answer these questions and me love you long time.

[n3rd]

1: The signatures that the anti viruses use to identify the malware, if i am not mistaken it should be the first 20 bytes of the file or so, but i am not sure. Could someone help em clarify how this works?

I think the way of searching is different for each scanner, for all you know their ways of being searched is allready patented.

[bad_brain]

well, how the virus signatures really work is like asking Coke for their recipe....they keep it secret. you can find the signatures for Kaspersky for example somewhere in C:\documents and settings/all users/application data/Kapsersky, but don't expect clear text, it's most likely all MD5 hashes...

[ayu]

hmm, i always thought there was a special amount of bytes that was used to identify the files, i mean so that they could be sure that the signatures really were unique =/

[DNR]

av signatures are more propriety than anything else. Each AV app has its own tricks and features, each also has to be different and 'smarter' than the other - otherwise they all be the same. They have to be different as not to be predictable to malware coders, they have to offer extra features to assure the customer they have a good product.

Some AV work on detecting behavior, as a means of _not_ relying on a 'file signature', since file sizes and patterns can now be morphing between victims.

Remember it is a combination of appz, OS knowledge, some code, and plain old common sense.

DNR