Re: virus code is never executed - virus or not?]]]]]

> I agree with all you have said, however you have overlooked the final point I 
> made in my last posting, that the original question asked "assuming we do 
> detect this, how should we report it?".

If the fact that the entry point is not at the beginning of the virus code is 
intentional, and the virus works, it should be reported just as any other virus.

If the virus sometimes works and sometimes not, it makes sense to try to report
the working replicants normally, and the non-working ones as "intended".

If the replicants just do not work at all, they should be reported as 
"intended" or "corrupted" if they are reported at all.  After all, according
to the formal definition of "virus" those samples are not viruses.

-- 
Fridrik Skulason   Frisk Software International   phone: +354-540-7400
Author of F-PROT   E-mail: [email protected]       fax:   +354-540-7401


-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html