How To Guarantee Malware Detection

itwbennett writes "Dr. Markus Jakobsson, Principal Scientist at PARC, explains how it is possible to guarantee the detection of malware, including zero-day attacks and rootkits and even malware that infected a device before the detection program was installed. The solution comes down to this, says Jakobsson: 'Any program — good or bad — that wants to be active in RAM has no choice but to take up some space in RAM. At least one byte.'"

Comments

Easy

[camperdave]

If $OS=="Windows" Then print "Malware Detected";

Re:Refuting the imaginary article in your head

[palegray.net]

If the malware gets swapped out it won't be detected in the scan.

Wrong again. Please go read the article.

Re:Refuting the imaginary article in your head

[spun]

Okay, THAT I don't get. As far as I can tell, this technique is not guaranteed to find 0-day malware that has infected the machine before the scanner is in place, unless that malware tries to resist detection.