Article View: comp.virus
Article #4585doom 2 (PC)
From: Eric_Florack.Wbst311
Date: Thu, 20 Jun 1991 15:16
Date: Thu, 20 Jun 1991 15:16
24 lines
1734 bytes
1734 bytes
It would appear to me that VIRx 1.4 isn't cleaning up after itself. You guys just ran accross different bits of code because of different ares of RAM being used to store the search strings. I state this obvious point, to make a point. This would seem slopy code on two points: One that VIRx doesn't clean up after itself, allowing other programs to find it's code fragments, is of course a major concern to the users of the program. (Should also be of great concern to the authors, but no matter for that for now..) The second point is that it's a security problem for all computer users. Consider: It's simplicity itself for someone who can write a virus to tear apart the non-encrypted VIRx code and determine the search strings used in VIRx. Now, this in itself wouldn't be a problem, I guess, but consider that what SCAN saw, were the search strings that VIRx was using.... meaning they're using the SAME strings. Based on this info, anyone who wanted to, could, in theory, modify the virus enough that the string would no longer bee caught by the current search strings. Encrypting the search strings in your code, therefore is always a good idea, as is cleaning up the mess your program makes in RAM. VIRx, apparently doesn't address these two points.
Technical Details
Message-ID:
<0007.9106202012.AA20764@ubu.cert.sei.cmu.edu>Path:
arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvwShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!sdd.hp.com!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: Eric_Florack.Wbst311@xerox.com Newsgroups: comp.virus Subject: doom 2 (PC) Message-ID: <0007.9106202012.AA20764@ubu.cert.sei.cmu.edu> Date: 20 Jun 91 15:16:55 GMT Sender: Virus Discussion List <VIRUS-L@LEHIIBM1> Lines: 24 Approved: krvw@sei.cmu.edu