Path: utzoo!attcan!uunet!snorkelwacker!mit-eddie!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: frisk@rhi.hi.is (Fridrik Skulason) Newsgroups: comp.virus Subject: Identification strings Message-ID: <0013.9002071642.AA05334@ge.sei.cmu.edu> Date: 6 Feb 90 10:47:37 GMT Sender: Virus Discussion List Lines: 26 Approved: krvw@sei.cmu.edu I have been comparing a few little-known virus-detection programs recently. There is a problem with some of the less well known programs, namely that they may appear as infected to some of the other anti-virus programs. The reason is that they sometimes store a virus identification string in unmodified form, and in the case of the shorter viruses, two programs may have picked the same identification string, which may cause them to appear as infected to one another. So - you anti-virus writers out there: Please store identification strings encrypted, reversed or somehow modified. Another subject - there is some confusion regarding the terms "identification string" vs. "signature strings". How about: Identification string: A sequence of bytes, used by anti-virus programs to check if a program is infected. Signature string: A sequence of bytes, used by the virus to check if a program is infected. Comments ? Fridrik Skulason - University of Iceland, Computing Services. frisk@rhi.hi.is Technical Editor, Virus Bulletin.