Advanced Checking Tools
120
•
RemoteTemplate
– the document contains a link to a template which is
automatically loaded when the file is opened;
•
HTML
.
SecurityBreach.2
– the HTML file or the HTML message is linked
to a suspicious object;
•
IRC-Worm.generic
– the file seems to be infected by an unknown worm
transmitting itself via the IRC channels;
•
BAT
– the file seems to be infected with an unknown virus infecting BAT
files;
•
VBS.I-Worm
– the file seems to be infected by an unknown worm
transmitting itself via e-mail.
Of course, as with any other heuristic algorithm you may occasionally receive
false alarms. However, Code Analyzer has been tested many times and has
checked a large number of files, and so far has not been deceived. If you do
encounter a false alarm while checking files using Code Analyzer, please let us
know and send us copies of the virus-free files that were identified as infected so
that we may study them at Kaspersky Labs.
When scanning code the heuristic detecting tool examines the structure of a
program down to several sub-levels. This device detects 92 % of the viruses
(including many encrypted ones) in the Kaspersky Lab’s database, and we
believe that newfound viruses that aren’t yet in the database will be detected with
the same degree of probability.
A.2.
The Redundant Scanning Tool
In most cases a virus registers itself in the entry point of a file with a reference to
its body, which is usually appended to the file contents. To delete such viruses
you only need to run an ordinary scanning operation that will remove the virus
code located in the file entry point and the virus body pointed to by the initial
address.
However, sometimes the virus divides its body into several parts and places
them into clean areas of the file. In this case an ordinary scanning operation will
neutralize the virus (i.e. the virus code in the entry point and main part of the
virus body will be deleted) but some of its parts will remain in the file.
In this case you need to run a
redundant scan operation
that will check not only
the file entry points but also the entire contents of your file.
The redundant scanning tool is recommended if no virus was detected in a
normal scan but the system is still behaving strangely (for example, there are
frequent instances when the computer restarts by itself, unnaturally slow
performance from applications, etc.) Otherwise, we do not recommend enabling
