Article View: comp.virus
Article #3127PC Memory resident viruses detection (PC)
From: Paul Rolland
Date: Thu, 12 Nov 1992 08:45
Date: Thu, 12 Nov 1992 08:45
22 lines
1324 bytes
1324 bytes
Hello, Because I'd like write some code to have my programs doing a quick memory check when starting before doing anything else (disk access or so), I'd like to have information on the way to detect already installed viruses. I know some of them (at least 100) use hooked interrupts to check if they are alreasy present. Could some one give me these vectors and the tests to perform to see if a virus is memory resident ? Any help would be greatly appreciated ! PS : I already have the ones described in Ralf Brown's interrupt list. I don't want the code of the virus but just the interrupt to call to see if it is present. Thanks Paul Rolland, rol@grasp1.univ-lyon1.fr - --- A bug can be changed to a feature by documenting it. Developpers know ! - --------------------- DISCLAIMER ------------------- All the opinions I express in this posting are mine, but I'm ready to share them with anybody interested :-)
Technical Details
Message-ID:
<0014.9211121950.AA09997@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!ukma!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!ukma!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: rol@grasp1.univ-lyon1.fr (Paul Rolland) Newsgroups: comp.virus Subject: PC Memory resident viruses detection (PC) Message-ID: <0014.9211121950.AA09997@barnabas.cert.org> Date: 12 Nov 92 08:45:57 GMT Sender: virus-l@lehigh.edu Lines: 22 Approved: news@netnews.cc.lehigh.edu