ClamWin Free Antivirus Forum Index
ClamWin Free Antivirus
Support and Discussion Forums
Reply to topic
CRC Check for ClamWin
GuitarBob


Joined: 09 Jul 2006
Posts: 4292
Location: USA
Reply with quote
There is an increased tendance for "smart" viruses that target antivirus/security software if it can get on a system. ClamWin probably isn't on too many radar screens yet, but is there going to be anything done to protect ClamWin or at least let the user know if something has targeted it--like a cyclic redundancy check?

Regards,
View user's profileSend private message
Re: CRC Check for ClamWin
b0ne


Joined: 26 Oct 2006
Posts: 174
Reply with quote
GuitarBob wrote:
There is an increased tendance for "smart" viruses that target antivirus/security software if it can get on a system. ClamWin probably isn't on too many radar screens yet, but is there going to be anything done to protect ClamWin or at least let the user know if something has targeted it--like a cyclic redundancy check?


A CRC check on the executable of clamwin would give you a rough idea if the file has been modified, but current malware doesn't bother modifying executables. It takes too much effort to patch; it is alot easier to search for window titles, application names, and simply send shutdown/quit messages to those applications that have those window titles.

Randomizing window, registry, and file/path names are the logical way to avoid the current "av-killer" code out there, but it proses usability problems. Another solution is using kernel mode hooks to intercept requests to terminate applications and having logic/security in place to prevent the termination requests from actually being processed.
View user's profileSend private message
CRC Check for ClamWin
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT  
Page 1 of 1  

  
  
 Reply to topic