I think I have detected a new virus; what do I do? Whenever there is doubt over a virus, you should obtain the latest versions of several (not just one) major virus scanners. Some scanning programs now use "heuristic" methods (F-PROT and TBSCAN are examples), and "activity monitoring" programs can report a program as being possibly infected when it is in fact perfectly safe (odd, perhaps, but not infected). If no scanner finds a virus, but a heuristic program raises some alarms (or there are other reasons to suspect a virus--e.g. change in size of files, change in memory allocation) then it is possible that you have found a new virus, although the chances are probably greater that it is an "odd but okay" disk or file. Start by looking in recent Virus-L/comp.virus postings for "known" false positives, then contact the author of the antivirus software that reports the virus-like features; the documentation for the software may have a section explaining what to do if you think you have found a new virus.
|
|
|
|
|
|
|
|