As such, you can clearly see in this case for example, that what is a legal system call in one case, is illegal in another, depending on the specific context of whether the file is a valid extension or not. The previous example is rather naive. There are many calls that viruses use, and determining whether such a call is legitimate or not, is a rather difficult task, if not impossible, because the context of execution cannot be known in advance, externally, unless the viral code executes in real-time. Emulation heuristics are severely complicated and time consuming to the point of prohibition most times. Although partial emulation heuristics have been implemented on PCs, on the macintosh the level of virus sophistication is not yet so high as to require emulation in order for Anti-Virus programs to identify viruses reliably.
Scanner does precisely such a heuristic analysis.
It looks for suspicious system calls in 68k code, and then performs an analysis around those places, by either backtracking through the supposedly offending code, or simply picking up certain parameters which are likely to indicate trouble. If, after reading the entire help section and this readme file it all sounds like Greek to you, then Scanner will most likely confuse you. Do not use it. Scanner is NOT meant to be a replacement for such software. On the other hand, as the heuristic analyses that Scanner performs on 68k code are quite general, it will likely identify as suspicious new and unknown viruses, which you can later send for examination to a commercial Anti-Virus company, particularly if you experience suspicious behaviour from my other companion INITs, Tracker and DelProtect.