Path: utzoo!utgpu!news-server.csri.toronto.edu!mailrus!uunet!mcsun!isgate!krafla!frisk
From: frisk@rhi.hi.is (Fridrik Skulason)
Newsgroups: comp.sys.ibm.pc
Subject: Re: Write protect for hard drive
Message-ID: <1744@krafla.rhi.hi.is>
Date: 1 Jun 90 09:07:37 GMT
References: <2935@crash.cts.com>
Reply-To: frisk@rhi.hi.is (Fridrik Skulason)
Organization: University of Iceland (RHI)
Lines: 21

>>I write:
>>>Forget about software solutions - they are not 100 % reliable.

In article <2935@crash.cts.com> jca@pnet01.cts.com (John C. Archambeau) writes:
>The only way for it to get around HDSENTRY would be to restore the hard drive
>write interrupt and the trojan/virus would have to be intelligent enough to
>know that the interrupt has been bypassed.  Sorry, but I think such software
>solutions do work, especially if they intercept interrupts.

They don't work, even if they intercept interrupts.  Many "write-protecting"
programs only intercept INT 13, but it is easy to write to the
hard disk without using INT 13, so monitoring it won't help.  As a matter of
fact, there are two or three Bulgarian viruses able to do it already.

-frisk


-- 
Fridrik Skulason      University of Iceland  |       
Technical Editor of the Virus Bulletin (UK)  |  Reserved for future expansion
E-Mail: frisk@rhi.hi.is    Fax: 354-1-28801  |