-=> Mocking Alain Gohier to Kurt Wismer <=-
   
 KW> AG> Comment dois-je te faire comprendre que le fichier .exe contient un
 KW> AG> VRAI virus ? Dois-je le crier, ou bien m'en remettre a ma puissance
 KW> AG> superieure et te laisser precher dans le desert... J'opte pour la
 KW> AG> deuxieme possibilit‚.
 
 KW>i almost got that - the meaning of dois-je escapes me though.... at
 AG> How can I do  is a good translation. :)
 
ah, ok thanks...
what can you do to see if an exe file contains a real virus - execute it
on a test system and see if it infects other files... then reboot that
system from a clean boot disk and execute one of those supposedly newly
infected files and see if that infects any more files...
if the sample replicates and it's offspring replicate then it's a
virus...
if the offspring or the original sample don't replicate then it's not a
virus...
of course this is probably not something you or most people would want
to try... therefore just use a scanner and hope you don't run into any
false alarms... using multiple scanners can cut the false alarm rate,
and using scanners that perform exact identification can also cut the
false alarm rate...
test files are good for checking to make sure that the product is
installed properly and is capable of detecting 'something' in it's
current environment...
(as for knowing how good a product is or how much protection is can
offer there are independant comparative reviews like those performed by
the virus test centre at the university of hamburg which test the
detection abilities of scanners on large numbers of known viruses - more
than 10,000 different viruses are used these days... if you have world
wide web access you can get their latest test results at
ftp://agn-www.informatik.uni-hamburg.de/pub/texts/tests/pc-av/1998-02/)
 KW> AG> Because V2P6 wipped MY HD. f this one is a simulated one, it is a
 KW> AG> good simulation... :-<
 KW>that's not viral behaviour, that's trojan behaviour...
 KW>if it doesn't replicate, it's not a virus...
 AG> How about the famous Cascade, the first one ? It doesn't
 AG> replicate, but is recognized as a "virus" by any anti-virus
 AG> software...
time to check your facts... cascade replicates... by definition all
viruses must replicate...
some anti-virus products detect non-viral security threats (like
trojans) aswell though...
 AG> BTW, for my personal consciensiouness (???) tell me the
 AG> differences about viruses, Trojan's, macro viruses, and nothing to
 AG> do about viruses ?
a virus is a type of program that self replicates and requires a host
(the requirement is such that the virus gets executed automatically when
the host is executed)..
a trojan is a program that claims to do something good, but has a
hidden function designed to do something bad...
a macro virus is a virus written in a macro programming language like
visual basic for word (wordbasic) or visual basic for applications...
that last one "nothing to do about viruses" doesn't parse well in
english... what were you trying to ask with that?
... video games, ha! yoyos have more of a danger element to them...
--- Platinum Xpress/Win/Wildcat5! v2.0
---------------