Re: virus code is never executed - virus or not?

 From Rainer Link
> consider the following scenario. A file contains (part(s)) of viruscode, 
> but the entry point points to the acutal host code. Therefore, the virus
> code is not being called. What should the virus scanner do?
> 
> - nothing. As per definition, the virus (code) never replicates, it's 
> not a virus.
> - report it as a "new/modified variant of <blah>", as the virus code is 
> not complete/modified.
> - report it as <blah> damaged" (or similar) as it contains virus code
> but is not functional.
> - report it as being infected with virus <blah>. As one may change the 
> entry point to the virus code and the virus (still) may work (although
> I'd say that's very unlike except probably for macro viruses).
> 
> I personally would vote for do nothing. Is there some common 
> sense/practice for such a case?

what if the virus code doesn't change the entry point, but modifies
something else to make sure that it gets called?

I'd tend to prefer a false positive than a false negative.

   - Kevin


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html