Hi Marck,
On Tue, 26 Dec 2000 01:15:18 +0000GMT (26/12/2000, 09:15 +0800GMT),
Marck D. Pearlstone wrote:
MDP>>> It doesn't need to. You don't get *infected* by a virus until it
MDP>>> is executed. This is a fact.
TF>> It has been executed.
MDP> I disagree.
TF>> Not triggered by me double-clicking on it.
MDP> Then it has *not* been executed, merely stored.
Did too / did not / did too... ;-)
We agree this malicious code was in the file. You say my PC is not
infected, and I say the virus warning suddenly popped up while nothing
but the OS and TB (and SETI@Home and PC-Cillin and some other
background stuff probably) was running. I was not even on my PC, it
was idling away while I watched TV.
PC-Cillin does not do an automatic virus scan (I have disabled all
scheduled scans), but it will issue a warning when some malware is
active (called "realtime scan").
Something triggered the virus/trojan (does the term "virus" include
trojans these days?), and it did something which triggered PC-Cillin's
alarms.
MDP>>> As you can see, it is a javaScript virus - ergo it must be executed by
MDP>>> a Java VM to cause an infection.
Must have been. TB couldn't prevent it. I didn't run any Java-able
applciation (IE or NS) at the time.
TF>> Got it. However, PC-Cillin reported the infected file to be in a TB
TF>> subdirectory. What do you make out of this?
MDP> I think I've spelled it out about. PC-Cillin just spotted the file
MDP> being created because you received it.
No. It was spotted in the backup-directory which was as old as TB
1.48d (or so). A subsequent virus scan confirmed it was also present
in the current TB attachment directory, but that one was merely
present, not active. ;-)
--
Cheers,
Thomas.
Message reply created with The Bat! 1.48f
under Chinese Windows 98 4.10 Build 1998
on a Pentium II/350 MHz.
--
--------------------------------------------------------------
View the TBUDL archive at http://tbudl.thebat.dutaint.com
To send a message to the list moderation team double click here:
<mailto:[EMAIL PROTECTED]>
To Unsubscribe from TBUDL, double click here and send the message:
<mailto:[EMAIL PROTECTED]>
--------------------------------------------------------------
You are subscribed as : archive@jab.org
