[comp.windows.ms] Viruses

jmorriso@fs0.ee.ubc.ca (John Paul Morrison) (08/07/90)

Don't panic, I haven't discovered any Windows viruses yet, but I have a word
of caution, even if you do use a virus scanner.

My virus scanner, scan by Macafee by default only seems to look at .exe and
.com files. Fine for DOS but a lot of shareware/pd programs also use .dll
libraries. .drv files also have executable code and if I'm not mistaken,
.fon font files can have code too (I'm just guessing, since they have the
message "This program requires Microsoft WIndows" in them)

IF your virus checker looks at all files, then I guess there is no problem.
BUt should any Windows specific viruses show up, they won't find them
anyway.

If anyone disagrees, I'd like to know; it seems that if anything that has executable
code in it, it is a source of dangera.

John Paul Morrison

stevens@shiva.trl.oz (Tony Stevens) (08/08/90)

jmorriso@fs0.ee.ubc.ca (John Paul Morrison) writes:


>My virus scanner, scan by Macafee by default only seems to look at .exe and
>.com files. Fine for DOS but a lot of shareware/pd programs also use .dll
>libraries. .drv files also have executable code and if I'm not mistaken,
>.fon font files can have code too (I'm just guessing, since they have the
>message "This program requires Microsoft WIndows" in them)

The MacAfee Document file specifies the following:

   "Use the /E option to scan specified overlay files.  Scan will
    default to OVL, OVG, OV1, OV2, OVR, SYS, BIN and PIF.  Scan will
    search these overlay files for any viruses capable of infecting
    overlays.  If you are using an application with overlay extensions
    other than the defaults, then specify the extension names (up to
    three) using the /E option.  Example:

          SCAN C: /E .ABC .XYZ .123
   "
So you can therefore test any overlay file associated with Windows or
any other programme.

Tony Stevens
Manager Plans & Programmes
Telecom Australia Research Labs.
Melbourne, Australia.

brianf@umd5.umd.edu (Brian Farmer) (08/09/90)

In article <2043@trlluna.trl.oz> stevens@shiva.trl.oz (Tony Stevens) writes:
>jmorriso@fs0.ee.ubc.ca (John Paul Morrison) writes:
>
>
>The MacAfee Document file specifies the following:
>
>   "Use the /E option to scan specified overlay files.  Scan will
>    default to OVL, OVG, OV1, OV2, OVR, SYS, BIN and PIF.  Scan will
>    search these overlay files for any viruses capable of infecting
>    overlays.  If you are using an application with overlay extensions
>    other than the defaults, then specify the extension names (up to
>    three) using the /E option.  Example:
>
>          SCAN C: /E .ABC .XYZ .123
>   "
>So you can therefore test any overlay file associated with Windows or
>any other programme.
>

One big problem here windows does not use overlays, windows uses segmented
executables.  In a windows .exe file first there is a standard dos exe which
windows reads past when loading the .exe.  These .exe's are very similar
to OS2 .exe's.  If this scanner just looks for a certain string of bytes it
might work but if it reads the .exe structure it may not know the format of a
windows .exe.  I don't know whether or not it will work but I would not 
consider my windows .exe's vacinated until the virus checker says it can check
window's .exe's. 


Brian Farmer
brianf@umd5.umd.edu