Hi Evan,
you wrote in /FIDO/VIRUS_INFO at 22 Jul 97:
ET> FPROT from dos. Remember to use a clean boot disk incase it's
ET> polymorphic.
You a have shuffled names a bit around?
So first the names for differrent types (note that one virus can fit to
multiply of them):
polymorphic - the virus does look diferrent with different infections
resident - the virus stays in memory monitoring system calls or
hardware interrupts
stealth - the virus tries to hide the modifations he did on his victim
(these ones have to be resident)
retro - the virus does attack active or passiv one or more AV-
-programs
and more...
So polymorphic viruses are not the main reason why to boot from a clean
disk. Beside it is recommended for all kind of virus - one normally do not
know the type before scanning -. Major problems that may appear when not
booting from a clean disk:
- a resident virus might infect all 'objects' that are scanned
- a stealth virus might be able to hide its presence
- a retro virus could be aimed on the special anti-virus program you are
using
Last but not least I don't let unmentioned that it sometimes could be
needed to boot from a not clean disks. This could be when using a overlay
for bigger IDE-drives or when a stealth virus infecting the boot areas
have encrypted them.
Michael
--- CrossPoint v3.11
---------------
* Origin: VIRNET 9:493/3160.3 (2:2452/249.3)
|