2 cissp ® Official Study Guide Eighth Edition

Encrypted Viruses Encrypted viruses
use cryptographic techniques, such as those 
described in Chapter 6, to avoid detection. In their outward appearance, they are actually 
quite similar to polymorphic viruses—each infected system has a virus with a different 
signature. However, they do not generate these modified signatures by changing their code; 
instead, they alter the way they are stored on the disk. Encrypted viruses use a very short 
segment of code, known as the 
virus decryption routine
, which contains the cryptographic 
information necessary to load and decrypt the main virus code stored elsewhere on the 
disk. Each infection utilizes a different cryptographic key, causing the main code to appear 
completely different on each system. However, the virus decryption routines often contain 
telltale signatures that render them vulnerable to updated antivirus software packages.
Hoaxes
No discussion of viruses is complete without mentioning the nuisance and wasted resources 
caused by virus 
hoaxes
. Almost every email user has, at one time or another, received a 
message forwarded by a friend or relative that warns of the latest virus threat roaming the 
internet. Invariably, this purported “virus” is the most destructive virus ever unleashed, 
and no antivirus package is able to detect and/or eradicate it. One famous example of such 
a hoax is the Good Times virus warning that first surfaced on the internet in 1994 and still 
circulates today.
Changes in the social media landscape have simply changed the way these hoaxes circu-
late. In addition to email messages, malware hoaxes now circulate via Facebook, Twitter, 
WhatsApp, Snapchat, and other social media and messaging platforms.
For more information on this topic, the myth-tracking website Snopes maintains a virus 
hoax list at 
https://www.snopes.com/tag/virus-hoaxes-realities/
.