>  KP> We receive a lot of virus suspects and this was intended to be a real
 >  KP> virus but contains some errors that will not let it replicate and
 >  KP> work. So we call these "Intended" viruses and still ad detection for
 >  KP> them. Payload has nothing to do with "Intended" viruses. If we
 >  KP> (Eugene Kaspersky) feel its worth adding we don't question his
 >  KP> judgement.
 > well, i've seen him post in here (once), maybe i should ask him why he
 > bothers to add detection for a peice of malware that doesn't work...
 > i just thought maybe you'd have some insight into the reason..
Antivirus authors have no other choice but to include detection of some
common "broken" viruses in their scanners ... it's known in the trade as
"keeping the computer press honest".  Without such "detection", scanners
"A", "B", "C", and "D" would appear less efficient (in magazine tests of
dubious quality, performed by "virus experts" of dubious intelligence)
than the vastly inferior scanner "Z" which tags several "broken" viruses
as "live" viruses.
eg: some versions of Boza don't replicate and have no chance of survival
ITW ... strictly speaking they can't even be considered viruses ... but
any scanner which doesn't "detect" them all will rate poorly in magazine
comparisons because most of the self-appointed "virus experts" who write
for magazines downloaded "The Boza Collection" from the internet and use
the non-virus versions in their "tests".
---
---------------