[comp.virus] Saveinfo.exe

IA96@PACE.BITNET (IA96000) (06/20/89)

I just downloaded a program named safeinfo.exe from a bbs
at (201)473-1991. safeinfo (tm) is a trademark of
safeware (TM) incorporated. the program is a clone of norton's
sysinfo with more features.

what makes it worthy of mention here is the fact that safeware (TM)
runs an internal test upon itself each and every time it is loaded.

this test checks a crc as well as the file length of the particular
safeware (tm) product being run. if  >> any << changes have been
made since it was compiled, execution stops and the user is then
informed of the change that was made.

i tested it, and any changes made to the file are picked up and
reported as claimed. The full documentation is not included with
safeinfo (TM) but i managed to speak to the author and the here is
a capsule of what was discussed, with his permission.

safeware (TM) is a unique new concept in shareware. all safeware (TM)
products run safeware's (TM) proprietary selftest (TM) module as soon
as they are loaded.

selftest (TM) checks the file and only lets execution proceed if the
file has not been altered in any way since it was compiled.

any change made is immediately picked up and reported

stripes@wam.umd.edu (06/22/89)

In article <0007.8906201731.AA26692@spot.CC.Lehigh.EDU>
VIRUS-L@IBM1.CC.Lehigh.EDU writes:

[stuff deleted]
>safeware (TM) is a unique new concept in shareware. all safeware (TM)
>products run safeware's (TM) proprietary selftest (TM) module as soon
>as they are loaded.
[stuff deleted]

Of corse as soon as safeware's (TM) proprietary selftest gets too
popular (assumeing they intend to sell the selftest to other
programers, or that they become massavaly popular...) a new virus
could just remove the checking code.  (same deal for Word Perf.)

To make a selftest strong you have to make them non-standard.  (i.e.
change the code on every release even if the last release was fine,
make it diffrent for each product, and whenever else you can).
- --
           stripes@wam.umd.edu          "Security for Unix is like
      Josh_Osborne@Real_World,The          Mutitasking for MS-DOS"
      "The dyslexic porgramer"                  - Kevin Lockwood
                "Dammit Jim, I'm a Doctor not an Excorsist"
                   - One of Bones' lines in a previous ST:V script...

jwright@atanasoff.cs.iastate.edu (Jim Wright) (06/22/89)

In article <0007.8906201731.AA26692@spot.CC.Lehigh.EDU>
VIRUS-L@IBM1.CC.Lehigh.EDU writes:
| I just downloaded a program named safeinfo.exe from a bbs
| at (201)473-1991. safeinfo (tm) is a trademark of
| safeware (TM) incorporated. the program is a clone of norton's
| sysinfo with more features.
|
| what makes it worthy of mention here is the fact that safeware (TM)
| runs an internal test upon itself each and every time it is loaded.

If you like this idea, you can use it with your own programs.  A shareware
package ($10-$15) called CAware allows "your C programs to be self-aware".
The registration fee gets you source code.  This is available from the
IBMPC anti-viral archive sites.

- --
Jim Wright
jwright@atanasoff.cs.iastate.edu