polymorphic malware

Although the appearance of the code in polymorphic malware varies with each "mutation," the essential function usually remains the same. For example, a spyware program intended to act as a keylogger will continue to perform that function even though its signature changes. If the malicious program is discovered by an anti-malware vendor and its signature is added to a downloadable database, the anti-malware program will fail to detect the rogue code after the signature has changed, just as if a new virus, worm, Trojan or spyware program has emerged. In this way, malware creators gain an advantage over countermeasure developers.

The best method of dealing with polymorphic malware is to employ multiple and diverse blocking, filtering, detection and removal programs. These programs should be kept current and should be run as often as possible. Auto-protect features, if available, should be enabled.

Read more about polymorphic malware: - A. E. Stepan describes techniques for defeating polymorphic malware. - Y. H. Cho and W. H. Mangione-Smith describe a parser for polymorphic malware detection. - SearchSMB.com answers frequently asked questions about malware.

Do you have something to add to this definition? Let us know. Send your comments to techterms@whatis.com

BROWSE BY TAG Information Security Threats,   Emerging Information Security Threats,   Malware, Viruses, Trojans and Spyware,   VIEW ALL TAGS

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Antispyware buying guide for Indian enterprises This guide designed specifically for Indian businesses explores the key considerations in choosing an antispyware solution and offers an overview of... ATM malware lets attackers take over machines Trustwave investigators say sophisticated malware used in Eastern Europe allows attackers to steal track data, PINs and cash from infected ATMs. FTC shutters rogue ISP for hosting malicious content, botnets Executives at Triple Fiber Network are suspected of recruiting bot herders and hosting botnet command and control servers.

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary DNS rebinding attack  (SearchSecurity.com) DNS rebinding is an exploit in which the attacker uses JavaScript in a malicious Web page to gain control of the victim's router. The attack works... drive-by pharming  (SearchSecurity.com) Drive-by pharming is a vulnerability exploitation method in which the attacker takes advantage of an inadequately unprotected broadband router to gain...