# How do antivirus detect self-modifying viruses?

**URL:** <https://boards.straightdope.com/t/how-do-antivirus-detect-self-modifying-viruses/736758>\
**Category:** Factual Questions\
**Created:** [November 5, 2015, 9:05pm UTC](https://boards.straightdope.com/t/how-do-antivirus-detect-self-modifying-viruses/736758 "2015-11-05T21:05:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Habeed](https://avatars.discourse-cdn.com/v4/letter/h/a587f6/32.png) [@Habeed](https://boards.straightdope.com/u/Habeed)\
**Post date:** [November 5, 2015, 9:05pm UTC](https://boards.straightdope.com/t/how-do-antivirus-detect-self-modifying-viruses/736758/1 "2015-11-05T21:05:48Z")

</div>

It seems to me like it would be extremely simple to take a working computer virus and add code that generates pseudorandom dummy instructions.

The virus would make a copy of it’s own opcode file, then insert dummy instructions that have no net effect.

Add 0 to a register. Add a random number, then subtract the same number (add a branch statement to check if the number will overflow first). Perform any operation on a register unused by your virus.

As I understand it, antivirus software go by signatures - they compute some type of hash of the files they analyze, and changing even 1 bit of the virus would change the signature. I would assume the antivirus software divides a possible virus into smaller sub-blocks and checks the signature for each one separately, which is why you would need to insert dummy instructions all through the virus.

How can you even detect viruses like this on a practical level? I have read about sophisticated code analysis methods but those sound unfeasible if hackers are creating new viruses every single day.

---

<div class="post-metadata">

**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\
**Post date:** [November 6, 2015, 1:26am UTC](https://boards.straightdope.com/t/how-do-antivirus-detect-self-modifying-viruses/736758/2 "2015-11-06T01:26:30Z")

</div>

What happens when your virus mutates its replication code?

---

<div class="post-metadata">

**Author:** ![Habeed](https://avatars.discourse-cdn.com/v4/letter/h/a587f6/32.png) [@Habeed](https://boards.straightdope.com/u/Habeed)\
**Post date:** [November 6, 2015, 1:28am UTC](https://boards.straightdope.com/t/how-do-antivirus-detect-self-modifying-viruses/736758/3 "2015-11-06T01:28:02Z")

</div>

> [@Chronos](#):
>
> What happens when your virus mutates its replication code?

The mutations are no net change. That is, they have no net function when the code executes. Try re-reading my OP, you’ll see what I mean. So the code that causes the mutations gets these extra nonfunctional statements inserted into it, but the code executes the same as it did before (just slower). The virus mutates a second copy of itself, it doesn’t edit itself in realtime, although that is possible.

---

<div class="post-metadata">

**Author:** ![JerrySTL](https://avatars.discourse-cdn.com/v4/letter/j/e274bd/32.png) [@JerrySTL](https://boards.straightdope.com/u/JerrySTL)\
**Post date:** [November 6, 2015, 1:44am UTC](https://boards.straightdope.com/t/how-do-antivirus-detect-self-modifying-viruses/736758/4 "2015-11-06T01:44:30Z")

</div>

Many antivirus programs use heuristic analysis along with virus signatures. Heuristic analysis watches how a programs acts.

> **[Heuristic analysis](https://en.wikipedia.org/wiki/Heuristic_analysis)**
>
> Heuristic analysis is a method employed by many computer antivirus programs designed to detect previously unknown computer viruses, as well as new variants of viruses already in the "wild".
> Heuristic analysis is an expert based analysis that determines the susceptibility of a system towards particular threat/risk using various decision rules or weighing methods. MultiCriteria analysis (MCA) is one of the means of weighing. This method differs from statistical analysis, which bases itself on the ...