Path: utzoo!utgpu!news-server.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: G.D.Shaw@durham.ac.uk
Newsgroups: comp.virus
Subject: Re: Emulation
Message-ID: <0005.9009211539.AA17296@ubu.cert.sei.cmu.edu>
Date: 20 Sep 90 16:00:26 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 20
Approved: krvw@sei.cmu.edu

>what are the possibilities of a virus being emulated

Any good IBM emulator ought to be able to support a virus - after all,
the objective is create an enviroment that, from the program's point
of view, is identical to an IBM PC.  In fact, an emulator can provide
an excellent virus testbed.  I have an Acorn Archimedes, which has a
proprietory CPU and operating system.  The IBM emulator can support a
hard disc which is in actuality a large file within the Acorn filing
system.  It is therefore possible to examine the disc 'at arms length'
with absolutely no chance of virus inteference or replication.

In practice, though, writing a 100% compatible emulator is no easier
than building a 100% compatible PC - for example, the AIDS trojan that
my hard disc was actually a floppy, and refused to install itself.
The bottom line, though, is that if your emulator is capable of
running MSDOS, it is almost certainly capable of supporting a virus.

Graham Shaw
Department of Physics
Durham University