Article View: comp.sys.mac.apps
Article #2905Re: Disinfectant 2.9 && Autodoubler
From: John T. Chapman
Date: Fri, 11 Sep 1992 14:12
Date: Fri, 11 Sep 1992 14:12
53 lines
3130 bytes
3130 bytes
In article <djpadz.716159241@orion.oac.uci.edu> Dj Padzensky,
djpadz@orion.oac.uci.edu writes:
>AutoDoubler's files contain no resource fork, so I don't think
>Disinfectant will detect viruses in them. However, if you run
>Disinfectant on the decompressed file and it turns up clean, the
>compressed file, lacking the resource fork, will be basically immune
>to virus infection.
>
Well, um, kinda.
(This is mostly speculation - I use both AutoDoubler and Disinfectant
frequently and have a fair amount of technical knowledge, but have not
seen the inner workings of either program. Please post a correction if I
have made any invalid assumptions.)
If you are booting from a 'Emergency Disk' that does NOT have AutoDoubler
installed, Disinfectant will have problems finding viruses in compressed
files, whether they are infected or not.
However, if you are working from a startup disk that does have
AutoDoubler working, Disinfectant should be able to find infections in
compressed files as AutoDoubler should be uncompressing to memory and
passing Disinfectant the 'real' files. Similarly, AutoDoubler should
uncompress to disk if Disinfectant needs to Disinfect a file.
Unfortunately this probably also applies to many viruses. As long as the
virus is using more or less standard file access methods (ala Apple's
guidelines), AutoDoubler should try and decompress the file to disk,
since something wanted write access to it.
The advantages and disadvantages of transparent compression...
DiskDoubler archives, on the other hand (and StuffIt archives and
CompactPro
archives), _should_ be relatively safe from infection by MOST viruses as
they do not possess executable code in their resource forks. However they
are still subject to damage and infection by viruses that work on 'files'
as well as applications.
Similarly, all Self-Extracting Archives are vulnerable to infection as
they
are applications, regardless of what they have archived within.
Hope this helps.
-------------------------------------------------------------------------
John T. Chapman jtc1@cornell.edu
Office of Computing and Statistical Consulting
Cornell University - College of Human Ecology
-------------------------------------------------------------------------
"I believe the word you're looking for is 'Aaaaaaaaaaaaa'."
- Penguin, Batman Returns
-------------------------------------------------------------------------
Technical Details
Message-ID:
<1992Sep11.141254.22766@mail.cornell.edu>Path:
arc1-ca.pugleaf.net!sparky!uunet!newsstand.cit.cornell.edu!newsReferences:
<1992Sep9.204055.3675@arizona.edu>Show Full Headers
Complete Article Headers
Newsgroups: comp.sys.mac.apps Path: arc1-ca.pugleaf.net!sparky!uunet!newsstand.cit.cornell.edu!news From: John T. Chapman <jtc1@cornell.edu> Subject: Re: Disinfectant 2.9 && Autodoubler Message-ID: <1992Sep11.141254.22766@mail.cornell.edu> X-Xxdate: Fri, 11 Sep 92 15: 25:28 GMT Sender: news@mail.cornell.edu Nntp-Posting-Host: 132.236.42.176 Nntp-Posting-User: jtc1@cornell.edu Organization: Office of Computing and Statistical Consulting X-Useragent: Nuntius v1.1.1d9 References: <1992Sep9.204055.3675@arizona.edu> Date: Fri, 11 Sep 1992 14:12:54 GMT Lines: 53