ccemdd@rivm.UUCP (Marco Dedecker) (06/06/89)
I don't know if Steve Tibbett is on the net, but I have a suggestion about a new version of virusX. (If Steve isn't on the net, could anyone please send him this suggestion by normal mail or whatever). A few days ago I got the latest version (I think) of virusX (version 3.2). It's a nice program and it will probably work fine. However I tried something out. I run the program called 'guardian' (a resident viruskiller). Then I reboot my computer, knowing the guardian was still in it. Then I inserted the disk with virusX and called the program. Then NOTHING happened. VirusX did NOT SEE the guardian, although it was resident. CAN YOU REALLY TAKE THAT CHANGE ?? I myself haven't found a virus yet that stays resident the way the guardian does, but how long before one will. I strongly suggest you test the "KickTagPtr" too, the same way you test the "*Capture" (KickTagPtr should be 0). You musn't wait with testing that place after a new virus has found it's way to the software, test it now so that a new virus won't have a change. Marco Dedecker
sirius@recondo.UUCP (Mike Stilson) (06/09/89)
In article <1359@rivm05.UUCP> ccemdd@rivm.UUCP (Marco Dedecker) writes: >I strongly suggest you test the "KickTagPtr" too, the same way you >test the "*Capture" (KickTagPtr should be 0). You musn't wait with >testing that place after a new virus has found it's way to the >software, test it now so that a new virus won't have a change. Commodore's recoverable RAMdisk also sticks around by the KickTagPtr, so there's a fair chance that it won't be 0 in many instances. That usually isn't a nice place to stick a virus, if you have a rrd mounted and it just disappears, then there's a good chance something changed it, and you'd also notice it yourself. >Marco Dedecker -- Mike 'Sirius' Stilson - Sirius Software UUCP: sirius@recondo.UUCP BITNET: sirius%recondo@uunet.UU.NET MA-BELL: (412) 793-1242 or (412) 793-5765 USNail: 1312 Universal Rd. Penn Hills, PA 15235-3936