APPENDIX A.
ADVANCED CHECKING
TOOLS
A.1.
The Heuristic Checking Tool
(Code Analyzer)
Code Analyzer, a heuristic checking tool, checks file and sector codes down the
various Kaspersky Anti-Virus algorithmic legs as it searches for virus-similar
instructions. If the heuristic tool detects certain instructions (such as open a file,
write to it, intercept the interrupt vectors, etc.), the file is
suspicious
and the
program generates the appropriate message:
Suspicion: <TYPE>,
where
<TYPE>
is replaced by one of the following strings:
•
Com
– the file seems to be infected by a virus that infects .COM files;
•
Exe
– the file seems to be infected by a virus that infects .EXE files;
•
ComExe
– the file seems to be infected by a virus that infects both .COM
and .EXE files;
•
ComTSR
,
ExeTSR
,
SysTSR
,
ComExeTSR
– the file seems to be
infected by a virus that infects .COM, .EXE and .SYS files;
•
Boot
– the file/sector seems to be infected by a boot virus or a boot virus
installer;
•
Trojan
– the file looks like a Trojan;
•
Trivial
– the file seems to be infected by an unknown virus replacing
executable files in a current directory by its own codes (usually the virus
size doesn’t exceed 300 bytes);
•
HLL
– the file seems to be infected by an unknown virus infecting
executable files. The virus is written in a high-level language (C, Pascal);
•
Win32
– the file seems to be infected by an unknown Windows virus;
•
Formula
– an Excel file contains suspicious instructions.
