Re: virus code is never executed - virus or not?

Nagy Ferenc László wrote:

>>consider the following scenario. A file contains (part(s)) of viruscode, 
>>but the entry point points to the acutal host code. Therefore, the virus
>>code is not being called. What should the virus scanner do?
[..]
> I don't think this question raises in real life, except for disparage
> competitors. This condition is rare and not dangerous.

Well, it may not rise often. Best example is (was?) CIH, as it is (was?)
difficult to clean and therefore some parts may not be cleaned. But, OK,
that's more a "local" problem, as the "virus" can not longer spread.

> 
> I would say it's ok if a virus scanner prints nothing or any of these
> messages. The specific message depends not on the author's opinion in
> this question but on the scanner's technical realization. A simple
> signature matcher will signal a virus, a sophisticated analyser may
> consider it harmless. I don't think the scanner should regard this
> special case. The most important reason is that it's close to
> impossible to detect this condition, especially to be sure about the
> host won't run the virus in some way.

Hum, from my own experience, it seems every vendor handles such a case
differently.


Thanks for your input.

best regards,
Rainer Link



-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html