2013/06/19 by Umakant Mishra, Mishra, Umakant
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Network Security and Intrusion Detection #cs.CR
paper · pdf · doi:10.48550/arxiv.1306.4666
18 pages, 20 references. (May 15, 2013). Available at SSRN: http://ssrn.com/abstract=2265576
arxiv created 2013/06/19 · openalex publication_date 2013/06/19 · arxiv updated 2013/06/20 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Most viruses are capable of fixing up the first few bytes and repair the original program because they have to return the control back to the infected program. This fact is used by a heuristic cleaner to clean the infected file. As the virus knows how to repair the it uses the same virus to repair the infected file. There are some infections where parts of the files are damaged by the virus. These types of infections are caused by 'file modifying viruses'. In these cases, the chance of recovery is less, but the anti-virus has to apply various methods with hope. The virus cleaner must know the characteristics of a virus in order to remove that virus. It cannot remove an unknown virus whose methods of infection are not known. If a virus is wrongly detected to be a different virus, then the cleaner will do wrong operations and build a garbage file.