[comp.sys.mac] Viruses

marge@vu-vlsi.Villanova.EDU (Marge Luecke) (07/22/88)

THIS IS A PLEA FOR HELP!!!!!

If anybody has ANY infromation on Computer Viruses, Immunizations, etc.,
please forward the infromation.  

I am working on a senior project on computer viruses.  I would like to try
to write an immunization program, however, I cannot obtain enough information
from published literature to do so. 

How do viruses work inside the computer.  What are some present methods of 
detection?  Are there any public domain immunization programs available?
Where?  Somebody wrote in one article that one could write a virus using the
pc-dos appendices as reference...I looked this up and was not too successful...
how do I do this?...What was meant by this?  What are some infected programs
which were available?  What is the SCORES virus?  How about VirusX?, etc...

				Thank you,
				Marge Luecke
				Senior EE, Villanova University

P.S. I can be reached several ways:

	1.  This computer system.

	2.  FAX:
			(609) 723-8461

			(USA)

	3.  Mail:
			Marge Luecke
			980 Wakeling Street     or Dept. of EE
			Philadelphia, PA  19124    Tolentine Hall
			USA			   Villanova University
						   Villanova, PA  19085
						   USA

	4.  PHONE:
			(215) 645-4970   Day
			(215) 537-9633   Evening

avenger@runx.ips.oz (Troy Rollo ) (07/24/88)

I was recently asked to consider this problem. The easiest  solu-
tion  I  came  up  with was to write a Virus Immunisation Program
(VIP) which calculated cyclic redundancy check numbers  for  each
file  on a given device and stored these numbers on a safe medium
prior to backup.  Regular checks
 could be made using the VIP, and if the CRC on any program (exe-
cutable, source, object or script) does not match (and should not
have been modified) the suspect file should be restored from  the
backup medium.

Precautions:

1) The machine should never  automatically  boot  from  the  hard
disk.  The  operating system on that disk may be infected, and if
you subsequently run your backup program or VIP, they may  become
infected.

2) The machine should be turned off  before  running  either  the
backup program or the VIP for much the same reasons as (1).

3) Along the same lines as (1) and (2), the  backup  program  and
VIP  should  be contained on separate floppy disks, each with its
own operating system.












































	----------------------------------------------------------------
Internet: avenger@runx.ips.oz.au
UUCP: uunet!runx.ips.oz.au!avenger

"Watch out for Gobbledocks - they'll steal all your silicon chippies"

ll12+@andrew.cmu.edu (Laura Ann Lemay) (11/05/88)

I am in the process of compiling and writing a "complete guide to viruses"
to be printed and distributed here at CMU, and posted here (since I think
the mac world NEEDS it).  This will be a complete and ACCURATE guide to
recognizing and dealing with viruses.  It will be easy to understand for
those new and scared and go into heavy technical detail for those who want
it.  In writing this I have been compiling the most accurate information
I can find on viruses.  But I'm looking for more.

I you have information I can use, please send it to me here at
ll12+@andrew.cmu.edu.  Before you send me anything, however, keep in mind:


I have all the posts by John Norstadd, Chris Borton and Mike Scanlin. This
is EXACTLY the sort of accurate information I'm looking for.  PLEASE don't
send me any wild rumors, hearsay information, or speculation.  I test
everything I hear, and 90% of what I've heard is wrong.  You will waste
both of our CPU times by sending me information you can't back up.  If
you've done extensive analasys of Scores or nVIR (any strain), lets hear
from you.
And on a related note -- is it possible to copywright anything posted to
a bboard, or doe it automatically become public domain?  I have no qualms
about posting what I've learned here, but I don't want to see it published
under someone else's name a month later.


thanx for your help--


Laura Lemay
ll12+@andrew.cmu.edu

kurtzman@pollux.usc.edu (Stephen Kurtzman) (02/10/89)

I am taking part in a graduate seminar on computer viruses at USC. Since
little of an academic nature is known about viruses, the goal of the class
is to take a look at what is happening in the real world and try to think of
some interesting things to say. I have been collecting information about
Macintosh viruses and Anti-virus programs. However, I would also like to get
my hands on the nVir and/or SCORES virus so that I can study their propagation.
If you have an infected program, I would appreciate getting a copy. You have
my word that I will not try to propagate it or use it to cause damage. I will
keep it on a closed and isolated system.

Thanks in advance for any help.