[comp.virus] Preventing virus attacks

usenet@saturn.ucsc.edu (Usenet News Account) (09/27/89)

subject mentioned, so here goes (with a dumb idea).
Will changeing a file attribute to READ ONLY stop or slow down a virus?
What about write locking a whole Directory?
Does hiding a file or directory have any effect???
I'm guessing that a virus will disregard any attribute settings.
			-ted-
ted@helios.ucsc.edu
From: ted@helios (Ted Cantrall)
Path: helios!ted

frisk@rhi.hi.is (Fridrik Skulason) (09/27/89)

> Will changeing a file attribute to READ ONLY stop or slow down a virus?
> What about write locking a whole Directory?
> Does hiding a file or directory have any effect???

This is a very common question, but in general the answer is NO.

Boot sector viruses are of course not affected by the read-only
protection, since they do not infect files.

Some viruses can be stopped my making program files read-only, but
right now I can only think of two such viruses:

    South African "Friday 13."  (and the related VIRUS-B)
    Lehigh

However, those two viruses are very rare. The rest of the PC viruses
remove the read-only attribute from files, before infecting them. Most
of them restore it later ("Icelandic" does not).

So - making files read-only will not provide any protection from
viruses like:

    Jerusalem (Israeli Friday 13.) and relatives (Fu Manchu)
    Vienna (DOS-62)
    Traceback
    DataCrime
    Icelandic and relatives (MIX1 and Saratoga)

The main use of read-only protecting .EXE and .COM files is really to
protect the user from his own mistakes.

Hiding a file is equally ineffective.

                                --- frisk