Contents | Index | < Browse | Browse >
^^^^^^^^^^^^^^^^^^^^
^ ANALYSE BOOT ^
^^^^^^^^^^^^^^^^^^^^
Probably the most interesting function of VBD.
This function tries to analyse the current bootblock using an 'Expert
System' method.
First, VBD displays the total length of boot, the length of code and
the length of data. Then it tries to analyse data and code in the boot
and display actions that it finds (if there is any) and the offset
where VBD found it.
Then, VBD calculates the different probabilities that the boot is a
virus, a virus protector, a loader, a utility bootblock, an intro, or a
harmless bootblock, and displays its results with a histogram.
This analysis function comes to the right conclusion in 901f cases.
The diagnostic can be altered or simply wrong by a miss of informations
bootblock, or simply if the virus creator has included analysis
protection in his virus (encrypted viruses, useless functions, no
direct vectors captured...).