| Question. | What CRCs shall I choose to check my files? What are "fast CRCs" calculated by ADinf? I changed several bytes at the end of a file that is checked with fast CRCs. Why does ADinf fail to report the changes made to the file? | |
| Answer. |
ADinf allows you to choose several methods to monitor your files:
Fast CRCs are calculated for executable files with a well-known internal structure, such as COM, MZ (MS-DOS), NE (Windows 3.xx), PE (Windows 95/98/NT) and LE (VxD). Thus, fast CRCs are only recommended for files with the following extensions: COM, EXE, DLL, DRV, VXD, and 386. Fast CRCs are calculated over certain portions of a file, which provides a faster (but still reliable) check. Naturally, changes to certain segments of the file (that wouldn't be normally made by a virus) may remain unnoticed. CRC16, CRC32 and CRC48 provide reliable detection of both virus infection and accidental modification of a file (that, for instance, may result from a disk write error). The longer CRC is, the higher reliability it provides. LAN64, a specialized hash function, is intended for particularly valuable files whose safety is your top priority. Naturally, this CRC ensures a highly reliable detection of accidental errors. Furthermore, it makes impossible to covertly modify your data. Click here to read more about LAN64 hash function. And the last CRC, "Macro", is specifically intended to detect macro-viruses. If .DOC, .DOT, .XLT and .XLS files are controlled by this CRC, ADinf ignores any changes made to the text of a document. However, modification of macros (an infecting technique used by macro-viruses) is immediately detected. |
| Copyright © 1999-2006 ADinf Development Team, E-mail: support@ADinf.com |