<p>What techniques can be applied to detect <a href="http://en.wikipedia.org/wiki/Computer_virus#Polymorphic_code" rel="nofollow noreferrer">Polymorphic</a> and <a href="http://en.wikipedia.org/wiki/Computer_virus#Metamorphic_code" rel="nofollow noreferrer">Metamorphic</a> viruses?</p>

<p>How difficult is to implement these techniques? </p>

<p>Are these techniques being applied in modern day anti-virus softwares?</p>

[{'answer_id': 35803, 'author': 'sven', 'author_id': 46, 'author_profile': 'https://Stackoverflow.com/users/46', 'pm_score': 3, 'selected': True, 'text': '<p>I thought most of the virus scanners nowadays use <a href="http://www.norman.com/Virus/Sandbox/20374/en" rel="nofollow noreferrer"><em>sandbox techniques</em></a> to check for "bad" behavior. Therefore the polymorphic virusses will also be detected.<br>\nof course these detection techniques are also known to virus creators, and can easily be bypassed using a bunch of random, unharmfull, code executions before the actual payload.</p>\n'}, {'answer_id': 5828900, 'author': 'RandomNickName42', 'author_id': 67819, 'author_profile': 'https://Stackoverflow.com/users/67819', 'pm_score': 0, 'selected': False, 'text': "<p>It's impossiable to detect all known poly/metamorphic bad-code.  White lists verification is the only provable technique.  It's not always possiable, especially if your infrastructure/computer has not been maintainedd very well.  Which is a good reason why signature, heuristic, emulation based detection is still valuable.</p>\n"}]
['https://Stackoverflow.com/questions/35798', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/184/']