[comp.virus] Word Perfect and change checkers

p1@arkham.wimsey.bc.ca (Rob Slade) (01/30/91)

csw76@seq1.keele.ac.uk (J.C. Kohler) writes:

> I'm using a Dutch version of WP 5.1, does anybody has an ideay why
> F-XLOCK can't lock them, it displays an error message, which contains
> something about a illegal header.

All versions of Word Perfect (at least since 4.2) have had a self
testing module on them.  Neither F-XLOCK nor SCAN /AV nor any other
slef checker that adds code to the program can be used on it, since
the added code invalidates the internal self test.

hampster@wyatt.ksu.ksu.edu (Kip J Mussatt) (01/31/91)

p1@arkham.wimsey.bc.ca (Rob Slade) writes:
>csw76@seq1.keele.ac.uk (J.C. Kohler) writes:
>
>> I'm using a Dutch version of WP 5.1, does anybody has an ideay why
>> F-XLOCK can't lock them, it displays an error message, which contains
>> something about a illegal header.
>
>All versions of Word Perfect (at least since 4.2) have had a self
>testing module on them.  Neither F-XLOCK nor SCAN /AV nor any other
>slef checker that adds code to the program can be used on it, since
>the added code invalidates the internal self test.

If I am understanding you correctly, WP 4.2 and later versions should
be virus proof?  If this is your assumption then why did we have an
epidemic of the Jeru II virus that infected almost every wp 4.2, 5.0,
and 5.1 at work?  Again, if I am misunderstanding what you are saying
about WP product, then please clarify.  If not, then could you please
shed some light on my question. Thanx

						-KJM

ballerup@diku.dk (Per Goetterup) (02/05/91)

hampster@wyatt.ksu.ksu.edu (Kip J Mussatt) writes:

=>If I am understanding you correctly, WP 4.2 and later versions should
=>be virus proof?

Not true! - We've had an Invader infection here on DIKU (Dept. of
Computer Science, University of Copenhagen) and it infected both
WP.EXE and PTR.EXE of version 5.1 without problems, and both programs
did run after infection!

It did ask if another copy of WP was running, but otherwise nothing.

	Happy (virus)hunting!

		Per.
- --
| Per Gotterup                        | "The most merciful thing in the    |
| Student, DIKU (Dept. of Comp. Sci.) | world, I think, is the inability   |
| University of Copenhagen, Denmark   | of the human mind to correlate all |
| Internet: ballerup@freja.diku.dk    | its contents."  - H.P. Lovecraft - |

71435.1777@CompuServe.COM (Bob Bosen) (02/28/91)

Rob slade writes:

>All versions of Word Perfect (at least since 4.2) have had a self
>testing module in them. Neither F-XLock nor SCAN /AV nor any
>other self checker that adds code to the program can be used on
>it, since the added code invalidates the internal self test.

Please note that not all "change checkers" add code to the program.
SafeWord Virus-Safe, for example, does not. There are probably others.
The term "change checkers" is very descriptive, but I prefer the more
positive-sounding terms such as "integrity checkers" or "signature
verifiers". Whatever you call them, in my view these represent the
only defense capable of detecting TODAY's and TOMORROW's viruses in
addition to YESTERDAY's! Viral infection is a subset of the larger
problem of verification of integrity.

- -Bob Bosen-
Enigma Logic Inc. (Producers of SafeWord VIRUS-Safe [Now Shareware])
2151 Salvio Street #301
Concord, CA   94520
USA
Tel:  415 827-5707
FAX:  415 827-2593
Internet: 71435.1777@COMPUSERVE.COM