frisk@rhi.hi.is (Fridrik Skulason) (12/27/89)
I received a note in the mail recently asking about viruses infecting network file servers. Since the reply might be of general interest, I am also posting it here. Boot sector viruses will not spread via the network, but most program viruses are able to do so, under certain circumstances. Assume we have two users, A and B connected to the network. 'A' runs by accident an infected program. The virus (assuming it is not of the Direct Action type) will stay resident and monitor the execution of other programs. Now, if 'A' runs a (non-infected) program located on the network server, the virus will try to infect it as it is executed. If the network software is able to make the files read-only or execute-only and the user can not change that with an ATTRIB -R command, the virus will not be able to infect the programs on the server. However, if 'A' is the supervisor or somebody else with write access, the virus will be able to infect the programs on the server. Later, when 'B' runs an infected program from the server, his machine will be infected and also the programs located there. - -frisk