🚀 go-pugleaf

KARGRA@GBA930.ZAMG.AC.AT writes:

> 3) Watching the filenames that pop up for short, I got the impression, that
> OS2SCAN does not scan *.DLL, *.DRV, *.ADD files. You can correct this either
> with /A or /E switch. But these do belong to the standard executables and it
> should not be necessary to think about these. Probably there are more ex-
> tensions to be included.

I know almost nothing about OS/2, but are these files really
executable? OK, I understand that they contain executable code, but
can they be started from the command line or by clicking on them? You
see, there are currently no known OS/2 viruses. Any known-virus
scanner for OS/2 can only scan for DOS viruses. Therefore, it makes
sense for it to scan only things that the known DOS viruses can
infect. In order a known DOS virus to infect something, it must either
have an executable extension, or it must be executed by the Exec
function call. Are the files with the extensions mentioned by you
executed in this way? If not, then it does not make sense to scan them
for viruses...

> 4) Did you think of the built-in undelete-function ? I hope the /D switch
> works correct. You need to overwrite first, and then delete the file to en-
> sure it does not survive as a deleted shadow.

What do you mean? If a file is really overwritten before it is
deleted, then what's the point to undelete it?

> 8) SCAN for DOS rel.9.0 V99 (most recent on Dec. 12th, 1992) does not do any-
> thing within a OS2 DOS-box. Neither windowed nor fullscreen. Although I read

Please, try NETSCAN 99B instead and post the results. Be aware,
however, that it will not check the boot sectors.

> 9) In Virlist I found a passage for the fam*-viruses where no information
> is provided about their behaviour. Is this correct ? And if so, why ?

The Fam* viruses reported by SCAN are something like heuristic scan
strings. They are signatures (usually very short) for code that is
often found in viruses. In this way they can detect a lot of silly 
viruses with a few short signatures, but no identification of the
virus can be obtained. Don't consider such reports as indications of a
particular virus; instead consider them just as reports for viral
code.

> I thought, that Mutation Engine is a .OBJ-file to be linked with viral coding
> So DAME itself would not be a virus to be listed this way in VIRLIST.TXT.

Correct, but SCAN (as most other scanners) is not able to distinguish
between the different MtE-based viruses. I agree, however, that the
description of the "DAME virus" in VIRLIST.TXT is completely bogus.

> It would be better to introduce a new column for viruses using MtE.

A better idea is to introduce a new column, for polymorphism. This
would be more general, since there are many other polymorphic viruses,
not only the MtE-based ones...

> 10) I did some testing on F-Prot 2.06a too. The /NOBOOT switch is the thing t
o
> make it run on HPFS drives. What I miss in COMMANDS.DOC is the /EXT= switch
> to force scanning of other extensions. Especially within WINDOWS and OS2 we
> find extensions like *.DLL, *.DRV and the like. The should be scanned by
> standard too, as they contain executable code like any *.OV?. Also an example
> in the *.doc file for /EXE=switch would be nice. I did not manage to make it
> recognise multiple extentions. Does it work and if, what is the delimiter ?

Probably, yes. The delimiter is a dot. In my tests I am using the
switch like this: "/EXT=COM.EXE.SYS.BOO". It was me who insisted that
Frisk includes something similar in his program, so I knew the
syntax... :-) Isn't it explained well in the docs?

> 13) A more special question. I hope I didn't miss it in the faq-list: What is
> exactly a companion virus? I mean, under which circumstances does it infect
> and in which environments. Somehow I have the impression, they are especially
> dangerous within networks. Vesselin? Padgett? Anybody?

See the FAQ, question B8), "What is a companion virus?". :-) We've put
quite a lot of effort in this FAQ, it would be nice if at least some
people read it... :-))

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany