Where can i find the source code of a ploymoprphic virus? This is part
of a research were i will be deriving signitures from it? Where can i
find the signitures for polymorphic viruses so that they could be used
for identification purposes????

Hi there,

Rohitab.com offers the source code for the (harmless) BlackBat virus
for research purposes:

"BlackBat is a Win9x Memory Resident, Polymorphic and Encrypting
Virus. It uses advanced techniques such as Anti-Debugging code and
Structured Exception Handling. This is a non-destructive virus."

rohitab.com - BlackBat Virus: Win9x Polymorphic Virus Source Code
http://www.rohitab.com/sourcecode/blackbat.html

You can find additional source codes here:

Chaotix File Archives
http://www.chaotix.net/chaotix/files/virus/index.shtml

**BE CAREFUL**.  Many of the virii archived are live.

With respect to signatures, according to A Computer Virus Primer:

"A polymorphic virus also includes a mutation engine that generates
randomized decryption routines that change each time a virus infects a
new program. In a polymorphic virus, the mutation engine and the virus
body are both encrypted. With no fixed signature or no fixed
decryption routine, polymorphic viruses pose a significant adversary
for anti-virus researchers."

A Computer Virus Primer - A Brief History
http://www.winplanet.com/winplanet/reports/1256/1/

However, you can find known signatures for many viruses if you search
on the name of the specific virus you're tracking at the Virus List:

Virus List
http://www.viruslist.com/eng/viruslist.html

Good luck!

--Missy

Search terms: [ "polymorphic virus" "source code" ], [ virus
signatures ]