False positive caused by immunization of files

There are some antivirus means offering and working with the function which we call the "immunization of files" or with a function which offers the adding of the checksum to the file tested. During the next testing the above mentioned utilities will simply test the added information comparing to the current conditions, and on the basis of the result they can announced a suspicion of the file being infected by a virus. This process is very fast and quite simple for the implementation.

But this relatively simple and fast process is followed by a few crucial problems. Imagine that there are two products working this way and used for the testing of one file. Through their alternating use they will mutually interfere each other, and both the products will report that the file has been changed.

Another problem is represented by the fact that the testing itself of a file will physically change it. If we do not speak about the copyright problems of the original files, we will face the question, whether you can be sure that the program changed continues working in the same way as its original. Probably it will, but there are programs which check themselves before the start-up, and such programs will not work in case of any change. Furthermore, the above lines only apply in the executable files. Any change in the data files is followed by a high risk of a failure of the program that is using these files.

AVAST32 does not modify any tested file in any way. For the reasons of higher safety it even opens the tested file only for reading in order that they should not be spoiled even accidentally. If some of the AVAST32 parts save information about files, they do it into an independent file.

Only in a special case, that is at the removal of the viruses found, the writing into the files occurs, but even in this case this process is performed with a file copy and only after the successful completion the file corrected is written with its original name.