Re: virus code is never executed - virus or not?

Hi,

On Thu, Jan 08, 2004 at 09:05:07PM +0100, Rainer Link wrote:

> consider the following scenario. A file contains (part(s)) of viruscode, 
> but the entry point points to the acutal host code. Therefore, the virus
> code is not being called. What should the virus scanner do?
> 
> - nothing. As per definition, the virus (code) never replicates, it's 
> not a virus.
> - report it as a "new/modified variant of <blah>", as the virus code is 
> not complete/modified.
> - report it as <blah> damaged" (or similar) as it contains virus code
> but is not functional.
> - report it as being infected with virus <blah>. As one may change the 
> entry point to the virus code and the virus (still) may work (although
> I'd say that's very unlike except probably for macro viruses).
> 
> I personally would vote for do nothing. Is there some common 
> sense/practice for such a case?

I don't think this question raises in real life, except for disparage
competitors. This condition is rare and not dangerous.

I would say it's ok if a virus scanner prints nothing or any of these
messages. The specific message depends not on the author's opinion in
this question but on the scanner's technical realization. A simple
signature matcher will signal a virus, a sophisticated analyser may
consider it harmless. I don't think the scanner should regard this
special case. The most important reason is that it's close to
impossible to detect this condition, especially to be sure about the
host won't run the virus in some way.

The important point is how a file can be "infected" such a way?
If there is a bug in a virus so it often produces files like this,
then the scanner should indicate it. If this file was produced by
an unpredictable computer error or human assistance, then the
scanner can treat it like a file with added garbage, modified virus
or unknown virus (and any virus scanner can miss unknown viruses).

Nagy Ferenc LĂĄszlĂł



-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html