Re: virus code is never executed - virus or not?]]

>>   3) If the virus code does not get executed, the ideal behaviour would
>>      be to report the program as corrupted by the "so-and-so" virus,
>>      but failing to report the virus at all, or allowing the program
>>      to execute is not really a "failure" as such... there is no active
>>      virus in the program.
>
> How do you know whether the virus code gets executed without performing an 
> exhaustive test on what the entire code does under all input conditions?

You analyse the virus code and determine how it "infects" the host program.

It is easy enough in many cases to determine that the virus will never have
a chance of being executed - example being some old .COM infectors that just
appended themselves to the host program, but dit not add a JMP to transfer 
control to the virus.  Such a virus will not get executed under any realistic
circumstances.  

There are viruses where a particular sample may not get executed under all
conditions.  For example there is a virus that searches for a JMP instruction
within the host program and replaces that instruction with a JMP to itself.
Whether any particular file infected with that virus will get executed or not
may depend on the input - however, this does not fall under case 3) but rather
case 1), as this is intentional...case 3 only deals with flawed viruses,
which do not get executed do to bugs in their own code - and in those cases,
analysis of the host program is simply not needed.

> time ago), therefore if viral code is found it should be reported as such.

It may not be practical to find the virus code if it is not executed - for
example if the virus is heavily polymorphic.

-- 
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
Author of F-PROT   E-mail: [email protected]       fax:   +354-540-7401


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html