Re: Re: virus code is never executed - virus or not?]

On Sun, Jan 11, 2004 at 12:06:17PM +0000, Antony Stone wrote:
> I think it is not possible to say for certain "this code (does | will) not get 
> exectued" (this is the sort of thing proved by Turing and Church quite some 
> time ago), therefore if viral code is found it should be reported as such.

It is not possible to say this for every possible code, but for a given code
instance it can be possible to prove, that it's never executed. Example:
        main ()
        {
          goto exec2;
          printf ("malicious code");
        exec2:
          printf ("hello world");
        }
You don't need much testing to find out that the malicious code is 
never executed.


I think, you're talking about two different things here.
From a end user's point of view, one question for scan reports is:
"Is this file a security risk ? Can it cause further damage through
 replication, payload, etc." 
The answer is "no" because the viral code is not executed. 

The other question is: "Is this file a safety risk ? Has it been modified by
an unauthorized source, so that its functionality may have changed."
Under this point of view, the answer must be "yes, this is a corrupted file".
But for current virusscanners this is not part of their core functionality
(just some kind of addon).

-- 
Michel Messerschmidt      9messers-jNDFPZUTrfQBEfOqpokbeYV0Y/[email protected]
antiVirusTestCenter, Computer Science, University of Hamburg


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html