Some months ago, Sherpya and bOne did some work on PE headers. I was wondering if anything ever came of this--did they come up with anything that could be used in ClamWin to enhance malware identification using PE file headers?

Regards,

It was to enable self-decrypted processes to be dumped from memory to disk, then scanned by clamscan. It's in there, unfortunately, most signatures created by the clamav team do not target unpacked data since clamav has limited unpacking capabilities.

Thanks for the info. Clam adds a new unpacker every once in a while. Have you contacted them to see if they are interested in enabling this functionality? They might at least keep it on the back burner.

Regards,

Unfortunately, it is platform dependent functionality. It is designed to target malware that has already "run" on the Windows platform and has unpacked itself with no 3rd party intervention.

In order to scan that with the clamav engine, all that is basically needed is to dump that process snapshot out of memory to a temp file on disk and toss it at clamscan.

It seems like some good functionality that should be considered, but I guess Clam isn't concerned with Windows per se. By "already run" do you mean that if this functionality could be implemented, the associated malware will have already done its thing or just unpacked itself? If it has done its thing, what would it take to insert a Windows hook to prevent it from running if it is malware? Finally, is there any way to toss it at Clamscan from ClamWin?

Regards,

I mean that the malware is already alive on the system and currently still has a process loaded in memory. Allowing it to decrypt itself while not performing malicious things on the live OS is a near impossible thing to do in a generic fashion without an emulator and a "fake" windows environment inside of that emulator.

I see. Some security people have been talking about virtual sandboxes lately. Would that be feasable?

Regards,

Essentially the same thing. It takes a massive amount of effort and time to create such things.