On the 28th day of December 2005, Tibbar encrypted the public version of Hacker Defender, the world-famous Windows rootkit. At the same time, the anonymous author unleashed codeCrypter on the web.

Then Tibbar waited.

On the first of March 2006, Tibbar (”Rabbit” spelled backwards) submitted the codeCrypter’d Hacker Defender to VirusTotal, an online virus testing service used by white and black hats alike.

The results were dispiriting. Despite two months’ warning, just four of 24 anti-virus engines recognized Tibbar’s creation: BitDefender, Ikarus, NOD32 and VBA32. Three a/v engines, CAT-QuickHeal, Fortinet and Panda, spotted something they considered suspicious.

AntiVirus Ability To Spot Encrypted Rootkit 3 Months After Release

Intercepts Encrypted Hacker Defender
Date of Scan 1-Mar-061 23-Mar-062 5-Apr-061
AntiVir — X —
ArcaVir n/a — n/a
Avast — — —
AVG — X3 —
Avira — n/a —
BitDefender X X X
CAT-QuickHeal X4 n/a X4
ClamAV — — —
DrWeb — X —
eTrust-InoculateIT — n/a —
eTrust-Vet — n/a —
Ewido — n/a —
Fortinet X4 X X4
F-Prot — — —
Ikarus X n/a X
Kaspersky — X X
McAfee — n/a —
NOD32v2 X X X
Norman — — —
Panda X4 n/a X4
Sophos — n/a —
Symantec — n/a —
TheHacker — n/a —
UNA — — —
VirusBuster n/a — n/a
VBA32 X X X
1 VirusTotal Virus Scan
2 Jotti Malware Scan
3 Generic signature identified.
4 Identified through heuristics.
— Failed to detect the rootkit.
n/a Not Applicable. A/V engine not tested.


Tibbar waited three weeks, then tried again at a different malware scanner: Jotti. The results were slightly more encouraging. This time, AntiVir, BitDefender, Dr. Web, Fortinet, Kaspersky Anti-Virus, NOD32 and VBA32 caught him. AVG AntiVirus caught a generic backdoor. That’s eight of 15 vendors. Better.On the fifth of April, Jack Koziol took up the gauntlet at Ethical Hacking and Computer Forensics. He packaged and resubmitted the codeCrypter’d Hacker Defender rootkit to VirusTotal. Sadly, his list of worthies expanded by only one. Kaspersky found the rootkit.

So three months after release of both the virus and codeCrypter source code, only AntiVir, AVG, BitDefender, CAT-QuickHeal, DrWeb, Fortinet, Ikarus, Kaspersky, NOD32v2, Panda and VBA32 were able to detect anything out of the ordinary when cloaked by codeCrypter.

That’s just eleven of 26 anti-virus engines, most of whom have been happily cashing our checks all along. Surprised? You shouldn’t be. It took most of these yahoos over a year to detect the publicly downloadable version of Hacker Defender.

Meanwhile, Tibbar, a self-proclaimed white hat, appears to be starting to think like holy father, the developer of Hacker Defender, who wrote in Email Battles:

Antivirus companies sell a fake sense of security, but they do not bring real security to your computer. Antivirus just fights programs that are visible to common users. They don’t care about the cause …This attitude brings money to security companies because their users download upgrades and buy new versions of their products. This is why these security companies don’t want to change the situation.

Tibbar’s hard at work on a mutating version of codeCrypter that may finally get security firms’ attention… or not.

While you’re waiting, you may want to reconsider your choice of anti-virus vendor.

Email Battles Backgrounder: