stel@tank.uchicago.edu (stelios valavanis) (06/22/89)
With all this talk about this virus and that virus eliminator, and with this resource that some curing progs put into the sys to prevent virus, I got to thinking (dangerous). Couldn't a virus call itself by the name of this friendly anti-virus resource replacing the good one if it is there? For that metter, couldn't a virus replace any good resource anywhere with itself (naming itself with the benign name of course)? Do I understand what's going on? Has anybody thought of this? I hope so. I don't want to open Pandora's box! stel -- Bitnet: stel%tank.uchicago.edu@uchimvs1.bitnet | i don't know Internet: stel@tank.uchicago.edu | YOU don't know? uucp: ...!uunet!mimsy!oddjob!tank!stel | ok, so i don't know
lipa@polya.Stanford.EDU (William J. Lipa) (06/23/89)
In article <4018@tank.uchicago.edu> stel@tank.uchicago.edu (stelios valavanis) writes: >With all this talk about this virus and that virus eliminator, and >with this resource that some curing progs put into the sys to prevent >virus, I got to thinking (dangerous). Couldn't a virus call itself by >the name of this friendly anti-virus resource replacing the good one >if it is there? Probably not. The "friendly" nVIR resource installed by KillVirus has size 0, so anti-virus programs can specifically check whether the resource is friendly or hostile by examining the size. Bill