Path: utzoo!censor!geac!torsqnt!lethe!yunexus!ists!helios.physics.utoronto.ca!news-server.csri.toronto.edu!bonnie.concordia.ca!thunder.mcrcim.mcgill.edu!snorkelwacker.mit.edu!apple!julius.cs.uiuc.edu!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: cjimenez@anyware.es (Carlos Jimenez) Newsgroups: comp.virus Subject: Re:SCAN program for IBM's (PC) Message-ID: <0012.9101111559.AA00331@ubu.cert.sei.cmu.edu> Date: 10 Jan 91 15:40:34 GMT Sender: Virus Discussion List Lines: 31 Approved: krvw@sei.cmu.edu >> From: Mr Gordon S Byron >> >> I am interested in finding a DOS antivirus program which would >> automatically scan disks as they are inserted. ideally, something like >> SAM II on the Mac. I noticed a reference to a program called McAfee's >> scan. Is that an auto-scan antivirus program? > >Only one problem with that idea: How can the machine tell when a disk >is inserted? There isn't any type of sensor in IBM floppy drives like >in the Mac. > >Doug Barlow I can sugest this idea: If you install a TSR that capture Int 13h Function 02h (BIOS Read sector) and this TSR scans virus signs in each read of the boot sector of the floppy disk you automatically detects boot viruses in the first access to the removable media (DOS will read the boot sector of the removable media, i.e floppy disk, on the first access to floppy because needs to know which is the format of the disk for access him). You can add another interrupt routine that capture Int 21h Function 4Bh or 3Dh (EXEC or OPEN) and before to execute or open some file, the TSR scans it for known sign of viruses. This is the basis for TSR vaccines like VSHIELD or F-PROT. If you wish more details you can write me to cjimenez@anyware.es Carlos Jimenez R+D Manager Phone: +34 1 556 92 15 ANYWARE Information Security +34 1 556 92 16 General Peron, 32 Fax: +34 1 556 91 58 28020 Madrid (SPAIN) EUnet: cjimenez@anyware.es