[comp.sys.amiga] Virusx 3.1 bug

jmdavis@ihlpm.ATT.COM (Davis) (01/11/89)

In article <6736@killer.DALLAS.TX.US>, davidg@killer.DALLAS.TX.US (David Guntner) writes:
> From article <4229@enea.se>, by tope@enea.se (Tommy Petersson):
> > In article <Jan.5.17.32.17.1989.16748@seagulls.rutgers.edu> lachac@seagulls.rutgers.edu (Gerard Lachac) writes:
> > -VirusX is upto version 3.00.  This came into existance around Jan 2 or
> > -so.  Included with the zoo file I received was a program call "kv"
> > -which detects and removes the new IRQ virus.
> > -
> > 
> > PLEASE POST THEM!
> 
> 
> I've mailed a copy to Bob Page, so I expect that he'll be posting it to the
> binaries/sources group in the near future.

I got my copy of VirusX3.1 from the Lattice BB, I noticed something strange.
The .zoo file contains the executable, the zoo-ed source, a .doc file and
a readme file as well as the kv stuff mentioned above.

I read the .doc file, it was all about version 3.0 I installed virusx3.1
and then read the readme file. THE README FILE SAYS VIRUSX SHOULD BE
11374 BYTES (or something close to that). I SIZED MINE AND IT WAS
11589 (or something close)!!!!!! ARRRRRRRRGH. I ran kv on it and it said there
was no virus here. Furthermore, I always write protect my system disk,
I downloaded, unzoo-ed, and executed it all from VD0: and I didn't get
any of the normal IRQ virus symptoms.

Does anybody know what gives?

-- 
----------------------------------------------------------------------------
			Mike Davis ..!att!ihlpm!jmdavis

char*p="char*p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);}

hrlaser@pnet02.cts.com (Harv Laser) (01/12/89)

jmdavis@ihlpm.ATT.COM (Davis) writes:
>The .zoo file contains the executable, the zoo-ed source, a .doc file and
>a readme file as well as the kv stuff mentioned above.
>
>I read the .doc file, it was all about version 3.0 I installed virusx3.1
>and then read the readme file. THE README FILE SAYS VIRUSX SHOULD BE
>11374 BYTES (or something close to that). I SIZED MINE AND IT WAS
>11589 (or something close)!!!!!! ARRRRRRRRGH. I ran kv on it and it said there
>was no virus here. Furthermore, I always write protect my system disk,
>I downloaded, unzoo-ed, and executed it all from VD0: and I didn't get
>any of the normal IRQ virus symptoms.
>
>Does anybody know what gives?
 
Yes. What gives is that when Steve Tibbett fixed VirusX 3.0 and turned
it into 3.1, he forgot to do the same for the readme file. 
 
VirusX 3.1, the executable program, should be 11948 bytes. 

If you upload VirusX31.ZOO to other BBSes or pay systems please fix the
readme file in the ZOOchive (well, it's not an ARChive :-) to show the
correct byte count.  The copy we have on People/Link in the AmigaZone
has been corrected.
 
Also, if you see VirusX 3.0 on any services or BBSes please inform the
sysop to remove it.  It has some real problems and should not be
propogated.  3.1 fixes those problems.

Harv Laser, Sysop, The People/Link AmigaZone.  Plink: CBM*HARV
UUCP: {ames!elroy, <backbone>}!gryphon!pnet02!hrlaser
INET: hrlaser@pnet02.cts.com
<---open            Push down while turning           close tightly--->

davidg@killer.DALLAS.TX.US (David Guntner) (01/12/89)

From article <2786@ihlpm.ATT.COM>, by jmdavis@ihlpm.ATT.COM (Davis):
> I got my copy of VirusX3.1 from the Lattice BB, I noticed something strange.
> The .zoo file contains the executable, the zoo-ed source, a .doc file and
> a readme file as well as the kv stuff mentioned above.
  
> I read the .doc file, it was all about version 3.0 I installed virusx3.1
> and then read the readme file. THE README FILE SAYS VIRUSX SHOULD BE
> 11374 BYTES (or something close to that). I SIZED MINE AND IT WAS
> 11589 (or something close)!!!!!! ARRRRRRRRGH. I ran kv on it and it said there
> was no virus here. Furthermore, I always write protect my system disk,
> I downloaded, unzoo-ed, and executed it all from VD0: and I didn't get
> any of the normal IRQ virus symptoms.
  
> Does anybody know what gives?


It was simply a mistake on Steve's part.  I had the v3.0 version, and this 
number actually DID match the byte count of VirusX.  That message was in the
v3.0 notes, as you will recall.... :-)  As long as you run kv on the file and
it doesn't report the virus being in it, you're ok.  Steve just forgot to
update that byte count in the v3.1 notes (I know how you feel, my heart skipped
a couple of beats when I saw that they didn't match, until I realized what
the problem was... -- ran kv on it just to be sure, and it came out fine).
                  --Dave

-- 
        David Guntner  UUCP: {ames, mit-eddie}!killer!davidg
                       INET: davidg@killer.DALLAS.TX.US
"...Different ship, but she's got the right name. Treat   --Admiral L. McCoy
 her like a lady, and she'll always bring you home."    "Encounter at Farpoint"

scott@attcan.UUCP (Scott MacQuarrie) (01/12/89)

There was an article from the author recently informing the net that the
byte count listed in his documentation was wrong and was actually the byte
count for version 3.0. I beleive he has since corrected the error.


-- 
     -------     Scott T. MacQuarrie 
   -====------   Senior Technical Consultant, Toronto Branch, AT&T Canada
  -======------  
   -====-------  Phone:      416-756-5124   UUCP:
    ----------   CompuServe: 73677,102      uunet!attcan!scott  or
     -------     ATTmail:    !smacquarrie   uunet!attcan!strider!scott

P.S. Opinions expressed are my own and represent neither statement nor
     policy of AT&T or AT&T Canada Inc.