Next: Research Efforts Up: Knowledge-Based Virus Removal Tools Previous: Selection Factors

Summary

Accurate removal may not be possible. Even if it is theoretically possible, precise identification of the virus is necessary to ensure that the correct removal algorithm is used.

Certain viruses (e.g., overwriting viruses) always cause irreparable damage to an executable. Some extraordinarily well-behaved viruses can be disinfected every time. Most viruses fall somewhere in between. Disinfection will often work, but the results are unpredictable.

Some executables cannot be recovered to the exact pre-infection state. In such a case, the file length or checksum of the disinfected executable may differ from the pre-infection state. In such a case, it is impossible to predict the behavior of the disinfected program. This is the reason virus researchers generally dislike removal programs and discourage their use.


konczal@csrc.ncsl.nist.gov
Fri Mar 11 21:26:02 EST 1994