New way of opeing files??? (PC)

Article View: comp.virus

Article #4710

#4710

From: Nemrod Kedem
Date: Sun, 17 Jan 1993 15:34

23 lines
1313 bytes

 >> I've heard that the NuKE group is starting to use function
 >> AX,6C00h/INT 21h to open files...

 > Why go so far? Did you here of writing to the disk via a port - instead
 > of using standard interrupt method to write?
 > I don't know of any A-V product that can monitor writing to ports,
 > (unless it was a debugger that monitors every command that an
 > application performs, and believe me: you don't want to use that!).

More then that: A product like the one you described will only work on 386,
or higher, in protected mode....

     Regards,
     Rudy.

Nemrod.Kedem@f101.n9721.z9.virnet.bad.se    (Nemrod Kedem)
FidoNet: 2:403/138   VirNet: 9:972/0, 9:9721/0, 9:9721/101
(972)3-966-7562 (14.4K)            (972)3-967-0348 (Voice)
P.O.Box 8394,     Rishon Le-Zion,   Zip 75253,     Israel.

- --- FastEcho 1.21a/Real!
 * Origin: <Rudy's Place - VirNet, Israel> Make Safe Hex! (9:9721/101)

Technical Details

Message-ID: <0011.9301281842.AA17847@barnabas.cert.org>

Path: arc1-ca.pugleaf.net!sparky!uunet!ukma!cs.widener.edu!dsinc!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!sparky!uunet!ukma!cs.widener.edu!dsinc!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: Nemrod_Kedem@f101.n9721.z9.virnet.bad.se (Nemrod Kedem)
Newsgroups: comp.virus
Subject: New way of opeing files??? (PC)
Message-ID: <0011.9301281842.AA17847@barnabas.cert.org>
Date: 17 Jan 93 15:34:00 GMT
Sender: virus-l@lehigh.edu
Lines: 23
Approved: news@netnews.cc.lehigh.edu