> If I would be a virus writer, I would definitely open at least one
> db (virus master copy:) with exclusive mode right after reset,
> thus making it unreadable, (DmOpenDatabase will fail).

In order to do that, however, your virus has to execute first. A good virus 
protection would not allow a known virus to run on the protected system; it 
will stop it at one of the entry points.

And, if the virus has managed to run, then all bets are off anyway - it can 
delete the anti-virus program, it can do *anything* - so going through such 
hoops like protecting its own database is often not worth the effort; at that 
point the anti-virus protection has *already* lost the game.

The only reason a virus might want to do what you suggest is to avoid unknown 
scanners (if it knew them, it could simply delete them) that have been updated 
to detect the virus *after* it has already invaded the system.

But, in general, as we say in the security business, "a compromised system 
cannot be trusted". This sounds trivial when stated like this, but it is 
amazing how often people forget its implications.

Regards,
Vesselin
-- 
For information on using the Palm Developer Forums, or to unsubscribe, please 
see http://www.palmos.com/dev/support/forums/

Reply via email to