ninersfan
join:2001-02-09
Hayward, CA
| reply to Xstealth
Re: New Kazaa Magic Eightball Virus deletes MP3s
said by Xstealth  :
Niner, I use Ontrack SystemSuite. When I do a full scan,(uh....yes...I update regularly), I get the same thing about zipped files, they can't be scanned, but the program says that they are likely low risk. So, what do I do about all these zipped files that are considered low risk by the program, yet are of atleast some considerable risk in my opinion.
Interesting, as I have Ontrack SystemSuite v4.0 myself (and use that antivirus as my backup for an alternate system scan), just I don't keep it memory resident as it's never recommended to have two memory resident antivirus scanners.
Anyway, to answer your question...Personally, I think Ontrack (Trend Micro is providing the antivirus engine here) is in the same class/category of Symantec and McAfee in regards to releasing protection against whatever the threat dujour is so to speak, but to be extra safe...the best way to scan a recently downloaded (questionable) file is both before and after un-compressing.
The act of uncompressing a file in itself is low-risk as they are not able to "self-execute", but that normally must be done by the user too.
Personally, I try to take the added precaution if I'm ever downloading the theoretically more risky type files of at least waiting a few or more days (especially over long holiday weekend periods) before accessing the recently downloaded file. This gives the added benefit of allowing whichever antivirus flavor you choose to use the opportunity of becoming aware of the latest threat and including the protection in their most recently issued definitions.
Note that in System Suite 4.0 there are configuration options to scan in archives (meaning compressed files), so you may want to check that box for default scanning anyway.
I believe though that this is a variation in the "on demand" type scanning as opposed to a full system scan which may not be scanning compressed files, which for all practical purposes are low risk until uncompressed.
For testing purposes myself, I have some zipped klez samples on my machine which are of no worry to me whatsoever...just wouldn't want to unzip them accidentally and leave them sitting around that way if you know what I mean. 
[text was edited by author 2002-11-29 18:43:05] |
