Re: Re: virus code is never executed - virus or not?

Hi,

> Date: Sat, 10 Jan 2004 20:55:39 +0100
> From: Michel Messerschmidt <9messers-jNDFPZUTrfQBEfOqpokbeYV0Y/[email protected]>
> To: openantivirus-discuss-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org
> Subject: Re: [Openantivirus-discuss]virus code is never executed - virus
> or not?
> 
> On Fri, Jan 09, 2004 at 10:30:06PM +0000, fergus wrote:
> > i would suggest that any unknown code should be
> > reported - this could include non-viral code in
> > many cases.
> 
> "Unknown code" may include nearly every software out there :-)
> You need at least a definition what kind of behaviour should be 
> reported and what can be ignored, or nobody will be able to handle such
> reports properly.
> 
> Although thinking about future use, it might be required to report every
> software that can't be verified by some appropriate measure (integrity
> check, certification, ...).

ACK. Perhaps it should be considered a good idea -esp. for corporate
environments/desktops- to develop a learning scanner/filter that 
behaves similar to (e.g.) ZoneAlarm in Learning Mode but not limited
to internet access. I.e. a scanner that asks user for permission to
execute with any program being called for the first time. If the
user permits execution it will store a checksum of that file and never
ask again as long as the file's integrity is verified successfully.

This could elevate desktop 'firewalls' to a new level of protection.

This will certainly downgrade performance but that may be a price
to be paid...

Anyway: If malicious code is detected a scanner should alert the 
user and prevent execution of the file. Think of multi-part malware.
Whether the suspicious file should be renamed, cleaned, quarantined, 
or deleted is another question. The answer may depend on admin/user
preferences.
 
Regards
Frank Ziemann
hoax-info.de




-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html