Question. What CRCs shall I choose to check my files? What are "fast CRCs" calculated by ADinf? I changed several bytes at the end of a file that is checked with fast CRCs. Why does ADinf fail to report the changes made to the file?  
Answer. ADinf allows you to choose several methods to monitor your files:
  • don't check CRC, check file size only;
  • check fast CRC;
  • check CRC16 or CRC32;
  • check CRC48. This method combines the file check algorithms used in CRC16 and CRC32;
  • check LAN64. This method employs a special 64-bit hash function and is available in ADinf Pro only;
  • check changes in macros of Microsoft Word documents (.DOC, .DOT files) and Excel spreadsheets (.XLS, .XLT and other files).

Fast CRCs are calculated for executable files with a well-known internal structure, such as COM, MZ (MS-DOS), NE (Windows 3.xx), PE (Windows 95/98/NT) and LE (VxD). Thus, fast CRCs are only recommended for files with the following extensions: COM, EXE, DLL, DRV, VXD, and 386. Fast CRCs are calculated over certain portions of a file, which provides a faster (but still reliable) check. Naturally, changes to certain segments of the file (that wouldn't be normally made by a virus) may remain unnoticed.

CRC16, CRC32 and CRC48 provide reliable detection of both virus infection and accidental modification of a file (that, for instance, may result from a disk write error). The longer CRC is, the higher reliability it provides.

LAN64, a specialized hash function, is intended for particularly valuable files whose safety is your top priority. Naturally, this CRC ensures a highly reliable detection of accidental errors. Furthermore, it makes impossible to covertly modify your data. Click here to read more about LAN64 hash function.

And the last CRC, "Macro", is specifically intended to detect macro-viruses. If .DOC, .DOT, .XLT and .XLS files are controlled by this CRC, ADinf ignores any changes made to the text of a document. However, modification of macros (an infecting technique used by macro-viruses) is immediately detected.

 

 
  Return to FAQ list   Go back  
 
Copyright © 1999-2006 ADinf Development Team, E-mail: support@ADinf.com