Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!tut.cis.ohio-state.edu!bloom-beacon!eru!luth!sunic!mcsun!hafro!isgate!krafla!frisk
From: frisk@rhi.hi.is (Fridrik Skulason)
Newsgroups: comp.sys.ibm.pc
Subject: Re: VIRUS DETECTING
Message-ID: <1241@krafla.rhi.hi.is>
Date: 23 Oct 89 11:46:04 GMT
References: <89102003371266@masnet.uucp>
Reply-To: frisk@rhi.hi.is (Fridrik Skulason)
Organization: University of Iceland (RHI)
Lines: 18

>Does anyone know if there are any programs that will
>compare the size(s) of .exe and .com files on your
>PC harddisk with size(s) recorded during a previous
>execution.  The intention being to notice any
>files which have grown because of infection from a
>virus?

Just one small problem - It is possible for a virus to infect a file, without
changing the length. In fact there are already two viruses that do just that,
Lehigh and 405.

-frisk

-- 
         Fridrik Skulason          University of Iceland
         frisk@rhi.hi.is           

          Guvf yvar vagragvbanyyl yrsg oynax .................