Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!cs.utexas.edu!usc!apple!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: spaf@cs.purdue.edu (Gene Spafford) Newsgroups: comp.virus Subject: Re: Shrink Wrap...still safe? Message-ID: <0003.9001151235.AA07390@ge.sei.cmu.edu> Date: 12 Jan 90 15:09:31 GMT Sender: Virus Discussion List Lines: 35 Approved: krvw@sei.cmu.edu Many large retailers (and some wholesalers) have shrinkwrap machines. They use these to rewrap packages of software that endusers may have purchased and then returned. They may also rewrap software packages that they have been using in-house as demo programs. They usually do not check the diskettes to see if they have been modified with a virus or other nasty. The purchaser usually has no way of knowing if the package they have just purchased has been rewrapped in this manner. Additionally, there have been some commercial distributions shipped with a virus on the diskettes. Usually, this contamination occurs in the stages where the diskette is formatted or copied, not when the master copy of the software is produced. That is, the machines doing the copying are infected and they introduce the infection when they copy the master version onto the diskette. Most software houses are now aware of this problems and they take greater care to protect the machines used to produce the distribution. Words of advice: Get in the habit of using virus scan programs on EVERY new diskette you add to your system. It will only take you a few extra minutes but may save you a great deal of trouble. Establishing the habit is very good practice. Keep a virus monitor (e.g., Gatekeeper, FluShot+) installed on your system and activated just in case. Point out to your retailer/wholesaler that should you ever buy a product from them with a virus on it, introduced because they have re-wrapped an infected product, they are liable for damages in a lawsuit. Encourage them to label any package so rewrapped -- then be extra careful when purchasing same. - -- Gene Spafford NSF/Purdue/U of Florida Software Engineering Research Center, Dept. of Computer Sciences, Purdue University, W. Lafayette IN 47907-2004 Internet: spaf@cs.purdue.edu uucp: ...!{decwrl,gatech,ucbvax}!purdue!spaf