[comp.virus] Memory scans vs. file scans

RMAP222@EUCLID.UCL.AC.UK (on GEC 4190 Rim-E at UCL) (03/02/90)

Since my earlier posting to this list (about a problem with SCAN
reporting a virus in the memory, and not in the file) a number of
things happened.  First, we did some hacking of cleaned programs, and
found out that the problem was indeed in cluster boundary when DOS
writes a file to disk, which was subsequently confirmed by John
McAfee, and when the file is scanned, SCAN can't find anything in the
file. Now, I have a further question for the list. Correct me if I am
wrong, but I belive that it shouldn't be to hard to calculate the
cluster boundary, and write zeroes to the end of the last cluster
which is occupied by the file, or, alternatively, write zeroes over
the full length of the file, and then update the directory entry. That
I belive, should cure such problems and confusion.

Nino Margetic

*******************************************************************************
*JANET:       N.Margetic@uk.ac.ucl.euclid             | Mr. Nino Margetic     *
*EARN/BITNET: N.Margetic%euclid.ucl.ac.uk@ukacrl      | University College    *
*INTERNET: N.Margetic%euclid.ucl.ac.uk@cunyvm.cuny.edu| Dept. of Med. Physics *
*Phone:       [+ 044-1  | 01] 380-9846                | 11-20 Capper Street   *
*FAX:         [+ 044-1  | 01] 380-9577                | London WC1E 6AJ       *
*******************************************************************************