Hello Melissa,

Wednesday, October 30, 2002, 2:52:23 AM, you wrote:

> If you're generally careful, and use a good anti-virus as a backup to
> your safe hex practices, there's really no need for an "outgoing"
> scanner.

I disagree :)

> After all...if the program didn't catch something on its way
> in, why would you expect it to catch it on the way out?  :-)

1) Because we've already seen that message fragments get around virus
detection both of an external scanner and of the scanner plugins. The
Bat! will reassemble the already checked parts into a virus infected
payload. In other words, it *wasn't* a detectable virus when the
scanner first checked it but it *is* a detectable virus if I were to
forward the message to someone else.

2) Because no matter how good the scanner, virus definitions lag
behind initial propagation. It's possible that when the message was
received the identification was not in the database but when I try and
send/forward the message the updated database will catch it.

-- 
Best regards,
 Lourdes                            



________________________________________________
Current version is 1.61 | "Using TBUDL" information:
http://www.silverstones.com/thebat/TBUDLInfo.html

Reply via email to