Emulating virus-like behaviour?

Question

I'm looking for a way to emulate virus-like behaviour for testing exclusions in anti-virus software. Can anyone recommend some behaviour that I can put together in a quick script which would trigger a typical realtime anti-virus scanner?

Answer 1

Most antivirus programs work on a signature database, not heuristic detection, so most of them won't notice anything at all unless you write a program with the same signature as one that they're looking for.

If you do have a heuristic-based detection program, just try some obvious virus behavior like modifying settings that control which programs launch at startup, checking processes for common antivirus program names, etc. You may be able to look up documentation for your specific program and find out exactly which heuristics it uses to try and detect viruses based on behavior. It'll be pretty hard to find much of use by just firing off "a virus might do something like this" behaviors blindly.

Answer 2

Back in 2000 there was the ILOVEYOU virus (love bug) which was just a VBScript that overwrote files on the infected machine with copies of itself and emailed itself out through Outlook. The Outlook hole has been fixed but the part about copying itself over all files of a specific extension is a good heuristic to try and copy.

Answer 3

Are you looking for something like the Eicar test file?

If you want to hand-code virus-like behaviour, I can tell you that I've had trouble with anti-virus applications and the LowLevelKeyboardProc() and SetWindowsHookEx() functions. If the anti-virus application uses heuristics, it usually warns about keylogger-like actions.

Answer 4

Here's an interesting article on behavior based detection, it's old but it sounds like that might be what you are looking to do.

http://www.securityfocus.com/infocus/1557

Also you may want to take a look at SARC (Symantec Antivirus Research Center). If you look into some of the latest threats, the technical details and removal instructions clue you in on what they do when infecting the system.

Here's an example:

http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-050707-0639-99