Article View: comp.sys.mac
Article #34697Re: nVIR virus found in "Kill Virus"
From: Dave Platt
Date: Tue, 22 Nov 1988 19:24
Date: Tue, 22 Nov 1988 19:24
47 lines
3074 bytes
3074 bytes
In article <5563@saturn.ucsc.edu> bushnel@ucscb.UCSC.EDU (Bill Bushnell) writes:
> I recently was given a disk full of PD software by a friend. I checked the
> disk with Interferon 3.1 before running any of the programs. Interferon gave
> me a error #002, ironically enough, in a file called "Kill Virus INIT" and
> in a file called "Kill Virus." Just thought I'd let people know...
That may not indicate infection. The nVIR virus can be kept from
infecting files by installing a dummy "nVIR" resource (ID=10, I
believe). Some anti-nVIR programs include such a resource in their own
set, and/or will install such a resource in other applications in order
to render these applications immune to infection.
Naturally, the presence of this resource will tend to trigger
infection-alerts by virus-seekers... and so it's not necessarily a
good technique.
By analogy: there is an effective medical vaccine available against
tuberculosis (I believe it's based on the related "BCG" bacterium)
which is being used in some countries (mostly Third World, I believe).
However, it's not being used in this country, because it interferes
with the standard skin-patch screening test for TB infection. If
you've received the BCG vaccine, then you'll respond with a "false
positive" if tested for tuberculosis infection.
The medical establishment in this country has decided to emphasize
detection of TB infection, and treatment of those found to be infected,
rather than vaccination against TB. Apparently, this makes good sense
if the infection-rate is low (less expensive, no adverse allergic
reactions to the vaccine, etc.). A preventive vaccine is preferable
under conditions in which the disease is more common, victims are more
difficult to locate and identify, or treatment is more difficult to
render.
So... if you're willing to run Interferon frequently (to detect
infections) and apply "safe software sex" techniques (to avoid exposure
to infected applications), then you should probably not use a
dummy-nVIR blocking technique such as (I believe) Kill Virus uses. On
the other hand, if you're not willing to do these things, then you
might as well install Kill Virus and have it innoculate your
applications against nVIR, and accept the fact that Interferon and
VirusDetective will scream bloody murder.
--
Dave Platt FIDONET: Dave Platt on 1:204/444 VOICE: (415) 493-8805
UUCP: ...!{ames,sun,uunet}!coherent!dplatt DOMAIN: dplatt@coherent.com
INTERNET: coherent!dplatt@ames.arpa, ...@sun.com, ...@uunet.uu.net
USNAIL: Coherent Thought Inc. 3350 West Bayshore #205 Palo Alto CA 94303
Technical Details
Message-ID:
<14462@coherent.com>Path:
arc1-ca.pugleaf.net!utzoo!attcan!uunet!tank!ncar!ames!coherent!dplattReferences:
<5563@saturn.ucsc.edu>Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!attcan!uunet!tank!ncar!ames!coherent!dplatt From: dplatt@coherent.com (Dave Platt) Newsgroups: comp.sys.mac Subject: Re: nVIR virus found in "Kill Virus" Message-ID: <14462@coherent.com> Date: 22 Nov 88 19:24:37 GMT References: <5563@saturn.ucsc.edu> Reply-To: dplatt@coherent.com (Dave Platt) Distribution: comp Organization: Coherent Thought Inc., Palo Alto CA Lines: 47