Re: virus code is never executed - virus or not?

On Thu, Jan 08, 2004 at 11:13:50PM +0100, Nagy Ferenc László wrote:
> On Thu, Jan 08, 2004 at 09:05:07PM +0100, Rainer Link wrote:
> > I personally would vote for do nothing. Is there some common 
> > sense/practice for such a case?

Hm, although we've got mostly infected samples here, according to the
products' logfiles there is not much common sense. but it is certainly good to
have an option to include such cases in the report.


> I don't think this question raises in real life, except for disparage
> competitors. This condition is rare and not dangerous.

I don't think so. Viruses have bugs as any other software too and may produce
unpredictable results as such damaged files.
Besides other causes like file system corruption and damaged mail attachments
you should also consider multiple infections. Cleaning such files often leaves
virus fragments in the cleaned files.

If you decide to report nothing, you shoud at least take care that the
file really can't replicate (no entry point obfuscation, ...).
I would prefer to report something like:
        <classification>
          <unknown>
            <property>
              may be a corrupted file
            </property>
            <property>
              contains inactive virus code
            </property>
          </unknown>
        </classification>
(actually just a copy/paste from my current work :-)
It may be some overhead but I've seen much more useless scanner reports :-)
And on the other hand the verbosity of a report should be adjustable to your
security policy. 

As long as you're sure that the file can't replicate it makes no sense to
report a "new variant". 

But if you're not sure, I would report it at least as suspicious file (or as
possible infection).


-- 
Michel Messerschmidt      9messers-jNDFPZUTrfQBEfOqpokbeYV0Y/[email protected]
antiVirusTestCenter, Computer Science, University of Hamburg


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html