Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: frisk@rhi.hi.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: virus checking software for PCs (PC)
Message-ID: <0015.9011141856.AA23262@ubu.cert.sei.cmu.edu>
Date: 13 Nov 90 14:36:45 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 29
Approved: krvw@sei.cmu.edu

HLIN@NAS.BITNET (Herbert Lin) writes:
>I'm looking for a virus checker for an IBM PC that has the following
>characteristics:
>
>- -- Not memory resident, and so does not check for infections in real
>time
>
>- -- runs any program I call after first checking a checksum or CRC
>against a pre-stored library (and warning me if a difference is
>found).

There are some programs which attempt to do this, but unfortunately it is
nearly impossible.

The reason is the existence of 'Stealth'-type viruses, where a program
appears unchanged after infection.

So, if you run a program infected with one of those viruses, all your
programs may be infected, without appearing to change in the
slightest.

The program will not catch the first infected program (assuming it is
new and not in the database), nor will it catch programs executed
later (as the virus is then in control)

Now ... I am not saying it is impossible, just that many current
programs have problems with this...

- -frisk