Re: virus code is never executed - virus or not?

On 08.01-21:05, Rainer Link wrote:
[ snip ]
> consider the following scenario. A file contains (part(s)) of viruscode, 
> but the entry point points to the acutal host code. Therefore, the virus
> code is not being called. What should the virus scanner do?
[ snip ]

i would suggest that any unknown code should be
reported - this could include non-viral code in
many cases.

in this specific example i would tend mark it as a
virus, operational or otherwise; because as you
stated the possibility of multi-part viruses
exists.

> I personally would vote for do nothing. Is there some common 
> sense/practice for such a case?

i can think of no reason for that viral code should
be propogated through a virus scanner.

-- 
: fergus cameron                :   [ .]        cobbled    :
: ^^^^^^@cobbled.net            : [ ~][ ]             .net :


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html