🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #5305

Memory scans vs. file scans

#5305
From: on GEC 4190 Rim-E at UCL
Date: Fri, 02 Mar 1990 11:53
22 lines
1784 bytes
Since my earlier posting to this list (about a problem with SCAN
reporting a virus in the memory, and not in the file) a number of
things happened.  First, we did some hacking of cleaned programs, and
found out that the problem was indeed in cluster boundary when DOS
writes a file to disk, which was subsequently confirmed by John
McAfee, and when the file is scanned, SCAN can't find anything in the
file. Now, I have a further question for the list. Correct me if I am
wrong, but I belive that it shouldn't be to hard to calculate the
cluster boundary, and write zeroes to the end of the last cluster
which is occupied by the file, or, alternatively, write zeroes over
the full length of the file, and then update the directory entry. That
I belive, should cure such problems and confusion.

Nino Margetic

*******************************************************************************
*JANET:       N.Margetic@uk.ac.ucl.euclid             | Mr. Nino Margetic     *
*EARN/BITNET: N.Margetic%euclid.ucl.ac.uk@ukacrl      | University College    *
*INTERNET: N.Margetic%euclid.ucl.ac.uk@cunyvm.cuny.edu| Dept. of Med. Physics *
*Phone:       [+ 044-1  | 01] 380-9846                | 11-20 Capper Street   *
*FAX:         [+ 044-1  | 01] 380-9577                | London WC1E 6AJ       *
*******************************************************************************
Technical Details
Message-ID: <0006.9003051143.AA06715@ge.sei.cmu.edu>
Path: arc1-ca.pugleaf.net!utzoo!attcan!uunet!jarthur!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!attcan!uunet!jarthur!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: RMAP222@EUCLID.UCL.AC.UK (on GEC 4190 Rim-E at UCL)
Newsgroups: comp.virus
Subject: Memory scans vs. file scans
Message-ID: <0006.9003051143.AA06715@ge.sei.cmu.edu>
Date: 2 Mar 90 11:53:00 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 22
Approved: krvw@sei.cmu.edu