Next: Selecting Anti-Virus Techniques Up: Other Tools Previous: System Utilities

Inoculation

In some cases, an executable can be protected against a small number of viruses by ``inoculation.'' This technique involves attaching the self-recognition code for the virus to the executable at the appropriate location.

Since viruses may place their self-recognition codes in overlapping locations, the number of viruses that can be inoculated against simultaneously will be small. To make matters worse, a common way to create a new variant is to change the self-recognition code. Thus, this technique will often fail when tested by minor variants of the viruses inoculated against.

Inoculation is no substitute for more robust anti-virus tools and procedures. It might be useful, though, if an organization has had recurring infections from a single virus. For example, after cleaning three or four outbreaks of a particular virus from a network of PCs, inoculation might be considered as a desperation measure.


konczal@csrc.ncsl.nist.gov
Fri Mar 11 21:26:02 EST 1994