Kaspersky (AVP) memory resident Virus Detection Method

Kaspersky Antivirus, formerly called AntiViral Toolkit Pro (AVP), is usually called AVP or KAV for its habits and simplicity.
The significance of the AVP detection method is that AVP detection method is a scientific and reasonable method that has passed theoretical verification and practical tests. In addition, friends of the DOS era have such experience in anti-virus: "Is the machine infected with viruses? Okay, please start it with a clean, non-toxic system disk and then scan and kill it all .", I remember when CIH went viral, a friend asked me to help him clean up the virus, saying that the virus was reported by a well-known AV in China. I started the AV and killed it again, in addition, the AV's own monitoring reports also infected CIH. After hearing this, I told him to use a clean boot disk to start the system and scan and kill the entire system. Although this is a solution, in fact, the anti-virus software does not directly detect and clear viruses in the memory. This is exactly what can be done. As far as I know, AVP was used to detect/clear resident viruses in memory.
I. detection method:
In the AVP virus database, there are several feature records, one of which is the memory feature. This is the feature set that AVP is used to detect and kill the memory resident virus, AVP uses some independent detection methods for memory resident infections.
AVP scans the infected viruses resident in the memory by the scan method and address offset recorded in the virus database. The AVP performs byte-by-byte matching starting from the address offset. When it matches byte, that is: Segm: Offset + byte offset = record: Byte. Then, AVP starts to calculate the pattern of the specified length of the database record. If it exactly matches the records in the database, the corresponding virus message is displayed, at the same time, the memory is repaired Based on the repair length specified by the database repair record and the content in the repair byte to ensure that the original virus is no longer active after the repair.
Caifan Ansoft Exchange Center
The record structure contains the following fields:
Virus name
Search Method: absolute address scan, dedicated module...
Address offset: Segment + offset
Match byte
Feature length
Features
Dedicated process: Obj_Link
Handle offset addresses
Processing Byte Length: generally less than 10
Fixed byte
Ii. search methods:
We can see from the above that AVP can ensure fast processing. A key factor is AVP's search method. In fact, AVP has many built-in search methods, these methods are applicable to systems such as MSDOS, WIN9X, WINNT/2000/XP. AVP can use a variety of Memory search methods to process a virus. The difference is that the method is more efficient.
1. Absolute address:
AVP uses an absolute address scan method to scan for viruses. The scanner reads the corresponding address records from the database records to the memory for matching. After matching, the scanner performs repair.
2. segment scan:
AVP increases cyclically from a memory segment to a single byte, starting from scanning to the end of the segment.

3. All scans:
AVP starts from the memory address 0x00000000h and continues to scan for full-memory matching.

4. Dedicated modules:
This is a method for some specific "cunning" viruses. When the normal scan and detection methods defined by AVP cannot be correctly identified, a dedicated processing module is used to detect and clear the virus. After this module is compiled, files compiled in obj format are stored in AVP library records.
Caifan Ansoft Exchange Center
5. Interrupt tracking:
This is mainly the AVP For DOS scan method. By interrupting the system INT21 and INT13, it locates the virus code residing in the memory and modifies the code near these commands, the virus becomes inactive.

Iii. instances:
For example, this virus (a code snippet found on the internet that is infected with a COM file ):
Cmp ah, 3dh
Jz short @ Infect_File; intercepts the 3d Dos Function
@ JmpOldInt21:
Cli
JmpFar db 0eah
@ Infect_File:
....
It should look like this after compilation:
13B6: 0100 80FC 3D cmp ah, 3Dh
13B6: 0104 74 xx JE Infect_File
13B6: 0107 FA CLI
13B6: 0108 xx XXX
For the detection and removal of this virus, we generate a record, which is recorded in the AVP database record. It can be in this form and completely detect and release the activity of this virus:
Search Method: interrupt tracking
Address offset: 1000: 0000
Matching byte: 80FC
Feature length: 6
Feature: xxxxxxxx
Dedicated processing: NULL
Processing Offset address: 3
Processing Byte Length: 2
Fixed byte: 90
With such a detection and repair database record, AVP can detect and repair active Viruses Residing in the memory, then, the virus in the disk files will be completely cleared through a separate file virus detection/repair process.
Caifan Ansoft Exchange Center
This article is a series of Avp Reverse Learning (AVP Reverse Engineering). The analysis methods are slightly different in different versions, and the AVP-based architecture is good, these changes mainly reflect the addition, deletion, and structure Length changes.