Re: virus code is never executed - virus or not?

On Thursday 08 January 2004 8:05 pm, Rainer Link wrote:

> Hi,
>
> consider the following scenario. A file contains (part(s)) of viruscode,
> but the entry point points to the acutal host code. Therefore, the virus
> code is not being called. What should the virus scanner do?
>
> - nothing. As per definition, the virus (code) never replicates, it's
> not a virus.
> - report it as a "new/modified variant of <blah>", as the virus code is
> not complete/modified.
> - report it as <blah> damaged" (or similar) as it contains virus code
> but is not functional.
> - report it as being infected with virus <blah>. As one may change the
> entry point to the virus code and the virus (still) may work (although
> I'd say that's very unlike except probably for macro viruses).
>
> I personally would vote for do nothing. Is there some common
> sense/practice for such a case?

I would vote for "variant" or "damaged", because there is unquestionably some 
code there which does not belong, and people want to know that.

I agree that reporting is as "infected" is not quite right, because the virus 
code is not getting triggered and therefore there is no immediate risk, 
however ignoring the fact that the code from a recognisable virus has been 
found inside the file is probably not acceptable to most users.

Only files where there is no sign of a virus should be passed without comment.

Regards,

Antony.

-- 
Most people have more than the average number of legs.

                                                     Please reply to the list;
                                                           please don't CC me.



-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html