Re: virus code is never executed - virus or not?]

> consider the following scenario. A file contains (part(s)) of viruscode, 
> but the entry point points to the acutal host code. 

Whether the entry point points to the virus code or not is utterly 
irrelevant.  What matters is whether the virus code has a chance of
being executed or not.

There are many viruses where the entry point(s) do not point directly
to the virus code anyhow.

I consider the "correct" behaviour of viruus scanners to be as follows:

  1) If the fact that the entry point(s) do not point to the virus code
     is intentional, but the virus gets executed anyhow, it should be
     reported just like any other virus.

  2) If the failure to point to the entry point is due to a bug in the
     virus, but it gets nevertheless executed, it should be reported,
     possibly as a "corrupted or intended" sample.

  3) If the virus code does not get executed, the ideal behaviour would
     be to report the program as corrupted by the "so-and-so" virus,
     but failing to report the virus at all, or allowing the program 
     to execute is not really a "failure" as such... there is no active
     virus in the program.

-- 
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
Author of F-PROT   E-mail: [email protected]       fax:   +354-540-7401


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html