Re: From Hadi (A little urgent question)

Kurt Huwig <[email protected]> wrote:

> ...  Someone told me that infecting a file leaves
> some traces, ...

Of course, because the file must, by definition, be different.  Change-
detection, per se though, is not virus detection...

> ... as you have to start the original file, so that people
> don't notice the infection.  ...

Actually, no.

There is no requirement in what we consider viral for the viral code to 
execute the original code or even to try to do so.  The requirement is 
simply that it must modify its "target" (or the target's environment) 
in such a way that some (normal) calls to execute the target result in 
the virus' code being executed.  The definition does not say wheter 
that execution need be "as well as" rather than "instead of", though 
obviously, the latter will tend to be more noticeable.  Of course, if 
the virus can replicate the functionality of the target sufficiently 
well, being an overwriter does not necessarily increase your chances of 
detection, as we saw with many boot viruses "back in the old days...".

> ...  But I am the wrong person to answer such
> questions.

Apparently...


Regards,

Nick FitzGerald



-------------------------------------------------------
This SF.Net email is sponsored by The 2004 JavaOne(SM) Conference
Learn from the experts at JavaOne(SM), Sun's Worldwide Java Developer
Conference, June 28 - July 1 at the Moscone Center in San Francisco, CA
REGISTER AND SAVE! http://java.sun.com/javaone/sf Priority Code NWMGYKND