| GuitarBob wrote: |
| There is an increased tendance for "smart" viruses that target antivirus/security software if it can get on a system. ClamWin probably isn't on too many radar screens yet, but is there going to be anything done to protect ClamWin or at least let the user know if something has targeted it--like a cyclic redundancy check? |
A CRC check on the executable of clamwin would give you a rough idea if the file has been modified, but current malware doesn't bother modifying executables. It takes too much effort to patch; it is alot easier to search for window titles, application names, and simply send shutdown/quit messages to those applications that have those window titles.
Randomizing window, registry, and file/path names are the logical way to avoid the current "av-killer" code out there, but it proses usability problems. Another solution is using kernel mode hooks to intercept requests to terminate applications and having logic/security in place to prevent the termination requests from actually being processed.
