Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: millerje@holst.tmc.edu (jeffrey scott miller)
Newsgroups: comp.virus
Subject: Re: Virus questions (PC)
Message-ID: <0003.a9102112100.AA03693@ubu.cert.sei.cmu.edu>
Date: 11 Feb 91 01:16:47 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 54
Approved: krvw@sei.cmu.edu

While I am by no means a virus expert, I hope these answers help...

boone@athena.cs.uga.edu (Roggie Boone) writes:
>I have 4 questions regarding computer viruses.  I am rather new to the
>study of compuer viruses and the texts that I have read have not answered
>these questions for me.
>
>1)  I have seen the SCAN software (MaAffee) scan a computer's memory for
>    viruses and noticed that it only scanned the base 640K of RAM.  Do
>    viruses typically not infect or use extended/expanded memory?  Are there
>    virus scanning packages that will scan the additional memory?  I raise
>    this question, because it seems I read somewhere that some computers
>    with certain memory management drivers may not erase the contents of
>    extended memory on a warm boot, and hence may not erase any virus that
>    may be sitting in extended memory. (My memory isn't too good on this
>    topic).

It would seem to be a waste for any virus to affect EMS, as not all pc
users have exp/ext memory, while ALL users (I hope!) have 1 MB.
Furthermore, I would assume that any hi memory managers would be able
to detect a change in high memory, as they usually intercept the
vectors.

>2)  Are there anti-virus packages (for PC or any computer) that use
>    artificial intelligence techniques to protect the system, or is such
>    an effort overkill?

Artifical intelligence?  For what purpose.  99% of scanning for
viruses just requires looking for a "search string".  The only way AI
might help is to see if there is more disk activity than normal, but
how do you define "more disk activity"?

>3)  Not meaning to plant ideas, but I was talking with a facutly member
>    in the dept. where I work, and the question arose as to whether a virus
>    could be transmitted to an orbiting satellite and cause the same havoc
>    that viruses cause us PC users.  Is this possible?

Any thing is possible... whether it's likely or not is another
story...

>4)  I have also noticed that SCAN, for instance, scans basically the .EXE,
>    .COM, .SYS, .OVL files in a directory.  Do viruses not infect .TXT or
>    .DOC files or maybe C (Pascal, Basic) source code?

True.  Viruses cannot infect text files, as they are never executed.
Viruses CAN look to see if a certain filetype is being accesses (i.e.
DBF), but since there is no executable code in a text file, there is
no way a virus can "latch" onto the file.

 _____________________________________________________________________________
|                                                                             |
|  "NUKE THE UNBORN GAY WHALES!"       |  Jeff Miller                         |
|             - graffiti               |  millerje@handel.CS.ColoState.Edu    |
|_____________________________________________________________________________|