Where do these viruses keep coming from?

[Highdy high]

I once used "Teleport" to download about 15Gbytes of "freeware" programs,
you know the ones - Webcam ControlCenter (WCC), Winscope, etc. That was
about 1 year ago.

Every time I scan the computer I find that one of the 66,000 ZIP files
contains a program containing a virus. I delete, re-scan - no virus to be
found.

A week later I update the virus scan program (NAV) and sure enough, there's
yet another one in there, even though I never added to the collection. The
whole lot have been scanned week, after week, after week, and today I am
STILL deleting the odd infected file.

There's never a virus active, just stored in some ZIP or LHA file. If I
exclude that directory root then the computer is always clean.

So, are old viruses being newly discovered and entered into the virus update
signature files? Is it possible that some bit of ASCII art or HTML has some
sort of virus number-code sequence?

H

 

[jafar]

So, are old viruses being newly discovered and entered into the virus update
signature files? Is it possible that some bit of ASCII art or HTML has some
sort of virus number-code sequence?

It's more likely that there are so many new virii coming out that your
anti-virus program can't keep up. By the time they update their database,
you are infected. A new virus can spread to 50,000 machines in a matter of
minutes depending on the way it spreads itself. Can you imagine how many
machines would become infected if it took even just 1 hour for the
anti-virus people to do a fix?

 

[null]

I once used "Teleport" to download about 15Gbytes of "freeware" programs,
you know the ones - Webcam ControlCenter (WCC), Winscope, etc. That was
about 1 year ago.

Every time I scan the computer I find that one of the 66,000 ZIP files
contains a program containing a virus. I delete, re-scan - no virus to be
found.

A week later I update the virus scan program (NAV) and sure enough, there's
yet another one in there, even though I never added to the collection. The
whole lot have been scanned week, after week, after week, and today I am
STILL deleting the odd infected file.

There's never a virus active, just stored in some ZIP or LHA file. If I
exclude that directory root then the computer is always clean.

So, are old viruses being newly discovered and entered into the virus update
signature files? Is it possible that some bit of ASCII art or HTML has some
sort of virus number-code sequence?

Newer defs can add to the false alarm problems. I'd not be inclined to
delete files until I've scanned them with several good av scanners and
built up some confidence that some infection is probably present.


Art
http://www.epix.net/~artnpeg