🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.sys.mac.apps
Article #2905

Re: Disinfectant 2.9 && Autodoubler

#2905
From: John T. Chapman
Date: Fri, 11 Sep 1992 14:12
53 lines
3130 bytes
In article <djpadz.716159241@orion.oac.uci.edu> Dj Padzensky,
djpadz@orion.oac.uci.edu writes:
>AutoDoubler's files contain no resource fork, so I don't think
>Disinfectant will detect viruses in them.  However, if you run
>Disinfectant on the decompressed file and it turns up clean, the
>compressed file, lacking the resource fork, will be basically immune
>to virus infection.
>

Well, um, kinda.

(This is mostly speculation - I use both AutoDoubler and Disinfectant 
frequently and have a fair amount of technical knowledge, but have not 
seen the inner workings of either program. Please post a correction if I 
have made any invalid assumptions.)

If you are booting from a 'Emergency Disk' that does NOT have AutoDoubler 
installed, Disinfectant will have problems finding viruses in compressed 
files, whether they are infected or not.

However, if you are working from a startup disk that does have 
AutoDoubler working, Disinfectant should be able to find infections in 
compressed files as AutoDoubler should be uncompressing to memory and 
passing Disinfectant the 'real' files. Similarly, AutoDoubler should 
uncompress to disk if Disinfectant needs to Disinfect a file.

Unfortunately this probably also applies to many viruses. As long as the 
virus is using more or less standard file access methods (ala Apple's 
guidelines), AutoDoubler should try and decompress the file to disk, 
since something wanted write access to it.

The advantages and disadvantages of transparent compression...

DiskDoubler archives, on the other hand (and StuffIt archives and
CompactPro 
archives), _should_ be relatively safe from infection by MOST viruses as 
they do not possess executable code in their resource forks. However they 
are still subject to damage and infection by viruses that work on 'files' 
as well as applications.
Similarly, all Self-Extracting Archives are vulnerable to infection as
they 
are applications, regardless of what they have archived within. 

Hope this helps.

-------------------------------------------------------------------------
  John T. Chapman                                     jtc1@cornell.edu
  Office of Computing and Statistical Consulting
  Cornell University - College of Human Ecology
-------------------------------------------------------------------------
"I believe the word you're looking for is 'Aaaaaaaaaaaaa'."
                                             - Penguin, Batman Returns
-------------------------------------------------------------------------
Technical Details
Message-ID: <1992Sep11.141254.22766@mail.cornell.edu>
Path: arc1-ca.pugleaf.net!sparky!uunet!newsstand.cit.cornell.edu!news
References: <1992Sep9.204055.3675@arizona.edu>

Show Full Headers
Complete Article Headers
Newsgroups: comp.sys.mac.apps
Path: arc1-ca.pugleaf.net!sparky!uunet!newsstand.cit.cornell.edu!news
From: John T. Chapman <jtc1@cornell.edu>
Subject: Re: Disinfectant 2.9 && Autodoubler
Message-ID: <1992Sep11.141254.22766@mail.cornell.edu>
X-Xxdate: Fri, 11 Sep 92 15: 25:28 GMT
Sender: news@mail.cornell.edu
Nntp-Posting-Host: 132.236.42.176
Nntp-Posting-User: jtc1@cornell.edu
Organization: Office of Computing and Statistical Consulting
X-Useragent: Nuntius v1.1.1d9
References: <1992Sep9.204055.3675@arizona.edu>
Date: Fri, 11 Sep 1992 14:12:54 GMT
Lines: 53