How i can write test virus

We are currently investigating SOPHOS speed issues and I have come up with the following suggestions which in our winxp sp3 environment has made a fair bit of difference:

1. Exclude these files at within the On-Access section:

   • c:\windows\system32\authz.dll
   • c:\windows\system32\drivers\srv.sys
   • c:\windows\system32\es.dll
   • c:\windows\system32\netman.dll
   • c:\windows\system32\oakley.dll
   • c:\windows\system32\pstorsvc.dll
   • c:\windows\system32\rasadhlp.dll
   • c:\windows\system32\regsvc.dll
   • c:\windows\system32\winipsec.dll They are startup files and aslong as you have full system scans running at some point, you shuold be fine.

2. The second thing to do is turn off checking for updates at startup. This is a tiny bit risky as thats a key point for new viruses can attack, but you can combat this by have regular 30 min checks for updates meaning you are never more than half an hour out. To turn of checking for updates do this:

alt text http://www.sophos.com/images/common/misc/27646.gif

After implementing these changes there was a noteable speed increase from power on to desktop.

I hope this helps.

Kip

I've noticed the trouble might come from apparmor. I was trying to setup clamfs for my home dir and it just kept complaining. Then I created an apparmor config file for it worked :)

$ cat /etc/apparmor.d/usr.bin.clamfs 

In simplicity I copied clamav armor and modified to clamfs - guesswork:

#include <tunables/global>

/usr/bin/clamfs {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  # LP: #433764:
  capability dac_override,

  @{PROC}/filesystems r,
  owner @{PROC}/[0-9]*/status r,

  /etc/clamfs/* r,
  /etc/fuse.conf r,

  /usr/bin/clamfs mr,

  /tmp/ rw,
  /tmp/** krw,

  /var/run/clamav/clamd.ctl rw,

  # Allow home dir to be scanned
  /media/disk/* rw,
  /media/disk/** rw,

  # Site-specific additions and overrides. See local/README for details.
  #include <local/usr.bin.clamfs>
}

I also copied the /etc/init.d/skeleton to /etc/init.d/clamfs-home and edited to my intuition's best liking, made it executable and called update-rc.d clamfs-home defaults. Then executed with /etc/init.d/clamfs-home start and yay! Let's see if it comes back after reboot. What I'm wondering about is how to run clamfs with a non-root user...