🚀 go-pugleaf

tgee@alfred.ccs.carleton.ca (Travis Gee) writes:

> In the analyse.doc that comes with f-prot v. 2.06a, it says that

> >Currently the following programs are known to cause a false positive:

You should read the documentation more carefully. The programs listed
by you do not cause a false positive; they are known to trigger the
heuristic warnings.

> file), and capture.com (a Word5 file). The qdcolor.com warning says
> that it contains code to search for other executable files: no
> kidding! It's an installation device for the qdos user interface.
> capture.com, however, 'modifies itself in a highly suspicious way...'

Have you actually looked at the program with a debugger? I bet that it
indeed does what F-Prot warns you about.

> hunches about it.  Two more Type I's for the record, though!

One more user who either has not read the documentation carefully, or
does not understand the abilities and the limitations of the heuristic
scanning.

The heuristics cannot tell you whether the program contains a virus or
not. They can only tell you whether the program does some strange
things that are usually used by viruses. Even this cannot be always
discovered! If the heuristics do not report a file as suspicious, this
means NOTHING, except that they have been unable to find anything
suspicious in it... It might contain a virus, nevertheless...

Conversely, if they tell you that a program does suspicious things,
this means ONLY that the program indeed does so - it doesn't mean that
it is infected. Of course, the infected programs cause such warnings
with a greater probability.

If you don't understand the above deeply, you should not use the
heuristic scanning.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany