Virus detection via crcs

Article View: comp.virus

Article #4382

#4382

From: John Blakeney
Date: Wed, 22 May 1991 13:21

14 lines
1238 bytes

crd check is only effective way of looking for viral activity unless
search strings are known for the viruses listed in letters. trhere is
no known virus(to my knowledge which does not alter crc check. the
only way to dodge this check would be to alter files so that there is
no change in crc. there has been a rumour of a virus which was written
in a command.com file and the alteration of the crc was only by one
bit! even in this case the truncating of the command com files to
accomodate the virus was unsuccessful in hiding it.  There havew even
been rumours ofscan being infected because another viral check found a
string which resembled that of a known virus.(sorry about lousy
typing!)

- --- TMail v1.21j
 * Origin: Prophet BBS (3:713/1701)

Technical Details

Message-ID: <0004.9105281939.AA08091@ubu.cert.sei.cmu.edu>

Path:

arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!rpi!think.com!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!rpi!think.com!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: john.blakeney@f1701.n713.z3.fido.oz.au (John Blakeney)
Newsgroups: comp.virus
Subject: Virus detection via crcs
Message-ID: <0004.9105281939.AA08091@ubu.cert.sei.cmu.edu>
Date: 22 May 91 13:21:10 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 14
Approved: krvw@sei.cmu.edu