Article View: comp.virus
Article #4575Re: Scanning infected files (PC)
From: Fridrik Skulason
Date: Wed, 19 Jun 1991 08:26
Date: Wed, 19 Jun 1991 08:26
7 lines
712 bytes
712 bytes
>Good question, but: wouldn't it be possible for the stealthy virus to >trap the sector I/O and "fix" it to also hide its tracks? Not only possible - it has already been done. At least one virus, simply known as INT13 does just this. - -frisk
Technical Details
Message-ID:
<0010.9106201437.AA20289@ubu.cert.sei.cmu.edu>Path:
arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sun-barr!lll-winken!iggy.GW.Vitalink.COM!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvwShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sun-barr!lll-winken!iggy.GW.Vitalink.COM!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: frisk@rhi.hi.is (Fridrik Skulason) Newsgroups: comp.virus Subject: Re: Scanning infected files (PC) Message-ID: <0010.9106201437.AA20289@ubu.cert.sei.cmu.edu> Date: 19 Jun 91 08:26:44 GMT Sender: Virus Discussion List <VIRUS-L@LEHIIBM1> Lines: 7 Approved: krvw@sei.cmu.edu