Re: [Openantivirus-discuss]virus code is never executed - virus or not?

[Rainer L. <ra...@op...>]

Nagy Ferenc L=E1szl=F3 wrote:

>>consider the following scenario. A file contains (part(s)) of viruscode=
,=20
>>but the entry point points to the acutal host code. Therefore, the viru=
s
>>code is not being called. What should the virus scanner do?
[..]
> I don't think this question raises in real life, except for disparage
> competitors. This condition is rare and not dangerous.

Well, it may not rise often. Best example is (was?) CIH, as it is (was?)
difficult to clean and therefore some parts may not be cleaned. But, OK,
that's more a "local" problem, as the "virus" can not longer spread.

>=20
> I would say it's ok if a virus scanner prints nothing or any of these
> messages. The specific message depends not on the author's opinion in
> this question but on the scanner's technical realization. A simple
> signature matcher will signal a virus, a sophisticated analyser may
> consider it harmless. I don't think the scanner should regard this
> special case. The most important reason is that it's close to
> impossible to detect this condition, especially to be sure about the
> host won't run the virus in some way.

Hum, from my own experience, it seems every vendor handles such a case
differently.


Thanks for your input.

best regards,
Rainer Link