🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #4585

doom 2 (PC)

#4585
From: Eric_Florack.Wbst311
Date: Thu, 20 Jun 1991 15:16
24 lines
1734 bytes
It would appear to me that VIRx 1.4 isn't cleaning up after itself.
You guys just ran accross different bits of code because of different
ares of RAM being used to store the search strings.

I state this obvious point, to make a point. This would seem slopy
code on two points: One that VIRx doesn't clean up after itself,
allowing other programs to find it's code fragments, is of course a
major concern to the users of the program. (Should also be of great
concern to the authors, but no matter for that for now..)

The second point is that it's a security problem for all computer
users.  Consider: It's simplicity itself for someone who can write a
virus to tear apart the non-encrypted VIRx code and determine the
search strings used in VIRx.

Now, this in itself wouldn't be a problem, I guess, but consider that
what SCAN saw, were the search strings that VIRx was using.... meaning
they're using the SAME strings. Based on this info, anyone who wanted
to, could, in theory, modify the virus enough that the string would no
longer bee caught by the current search strings.

Encrypting the search strings in your code, therefore is always a good
idea, as is cleaning up the mess your program makes in RAM. VIRx,
apparently doesn't address these two points.
Technical Details
Message-ID: <0007.9106202012.AA20764@ubu.cert.sei.cmu.edu>
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: Eric_Florack.Wbst311@xerox.com
Newsgroups: comp.virus
Subject: doom 2 (PC)
Message-ID: <0007.9106202012.AA20764@ubu.cert.sei.cmu.edu>
Date: 20 Jun 91 15:16:55 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 24
Approved: krvw@sei.cmu.edu