Scanning infected files (PC)

Article View: comp.virus

Article #4490

#4490

From: Finnegan Southey
Date: Fri, 07 Jun 1991 01:31

17 lines
1409 bytes

      In regards to the problem of anti-viral programs infecting files
they scan when a memory-resident virus is present: Wouldn't it be
possible to read disks sector by sector instead of opening files
through DOS calls?  This reading would be much the same as a disk
editor program.  The scanner could consult directory listings to find
program boundaries and then check approp- riate areas without opening
the files as a file?  As I'm not an MS-DOS expert I'm not sure if this
makes sense, but I thought I'd ask.

-
 -------------------------------------------------------------------------------
 Finnegan Southey - Computing Services, University of Guelph, Ontario, CANADA
        BitNet: ACDFINN.VM.UOGUELPH.CA  CoSy: fsouthey@COSY.UOGUELPH.CA
           You are in a maze of twisty little passages, all alike...
-
 -------------------------------------------------------------------------------

Technical Details

Message-ID: <0007.9106101933.AA10096@ubu.cert.sei.cmu.edu>

Path:

arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!sample.eng.ohio-state.edu!purdue!news.cs.indiana.edu!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!sample.eng.ohio-state.edu!purdue!news.cs.indiana.edu!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: ACDFINN@vm.uoguelph.ca (Finnegan Southey)
Newsgroups: comp.virus
Subject: Scanning infected files (PC)
Message-ID: <0007.9106101933.AA10096@ubu.cert.sei.cmu.edu>
Date: 7 Jun 91 01:31:23 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 17
Approved: krvw@sei.cmu.edu