Path: utzoo!utgpu!news-server.csri.toronto.edu!mailrus!umich!samsung!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: RADAI@HUJIVMS.BITNET (Y. Radai)
Newsgroups: comp.virus
Subject: Re: Disk Manager (PC)
Message-ID: <0001.9008231338.AA20624@ubu.cert.sei.cmu.edu>
Date: 21 Aug 90 16:01:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 33
Approved: krvw@sei.cmu.edu


  Brian Aslakson writes:
>I'd like to point out first that
>even if you use READ-ONLY, it is designed for normal write operations,
>and a virus which ignore this will probably get around this.  (I'll
>check if you ask me too).  Second, if you use their software for a
>purpose it was never intended for (I did ask already) and you get
>surprised, don't even consider blaming anyone but yourself.  Ontrack's
>Disk Manager is not virus protection software!

  First of all, I'd like it to be clear that I was not recommending
Disk Manager as an anti-viral product, but merely pointing out that
Michael Greve's reference to DM as hard-disk protection was not as
absurd as it apparently sounded to some readers (some of whom may have
been unaware of the possibility of making a partition read-only when
using DM).

  Secondly, the fact that DM was not designed for anti-viral purposes
does not necessarily mean that the read-only option can't be useful in
preventing infection by file viruses.  Now if the protection were im-
plemented by setting the read-only bit of each file in the protected
partition, then you'd be right, for almost every virus clears this bit
before trying to infect the file.  But DM uses a device driver to con-
trol all access to the logical drive, and that's a different story.
True, it might still be possible to circumvent this protection, but I
think it would be a lot harder.  It should also be taken into account
that very few virus writers would bother trying to write code to by-
pass a particular anti-viral program unless that program were used on
a very large percentage of computers.

                                     Y. Radai
                                     Hebrew Univ. of Jerusalem, Israel
                                     RADAI@HUJIVMS.BITNET