Path: utzoo!censor!geac!torsqnt!news-server.csri.toronto.edu!bonnie.concordia.ca!thunder.mcrcim.mcgill.edu!snorkelwacker.mit.edu!usc!elroy.jpl.nasa.gov!swrinde!cs.utexas.edu!evax!cs4344af
From: cs4344af@evax.arl.utexas.edu (Fuzzy Fox)
Newsgroups: comp.sys.cbm
Subject: Re: GEOS Companion Disk
Keywords: Simple fix...
Message-ID: <1991Feb20.063301.26802@evax.arl.utexas.edu>
Date: 20 Feb 91 06:33:01 GMT
References: <1991Feb17.234810.11358@garfield.cs.mun.ca>
Organization: Computer Science Engineering Univ. of Texas at Arlington
Lines: 26

In article <1991Feb17.234810.11358@garfield.cs.mun.ca> roger@garfield.cs.mun.ca (Roger White) writes:
>4. Do what I did... [...edit the file type bytes in the directory...]

I fail to see how this avoids the Berkeley Trojan (isn't that a great
name for it?)...  The Trojan does NOT look at the directory at all, but
instead checks track 18, sector 0, byte offset $BD, which is set to 0
for a work disk, "P" for a master disk, and "B" for a boot disk.  If the
byte is "B", and the copy protection fails, then the Trojan zaps the
first three entries of the directory to zeroes, WITHOUT checking to see
what they are.  In effect, you can defeat the Trojan another way by
moving the 3 boot files to another page on the disk, and making sure
that no file ever occupies one of the first three slots on page one.
(But of course GEOS won't let you move the boot files, will it?  Gee, I
wonder why?)  You'll have to use another disk editor to do this.

Anyway, I contend that you have just been lucky so far.  I believe if
you boot GEOS and remove the boot disk as your first action after
booting, you will most likely not have a problem with your files
disappearing.  Try moving files around on the DeskTop for a while, and
perhaps you will see the files disappear.

-- 
David DeSimone, aka "Fuzzy Fox" on some networks.          /!/!
INET:    an207@cleveland.freenet.edu                      /  ..
Q-Link:  Fuzzy Fox                                        /   --*
Quote:   "Foxes are people too!  And vice versa."         /  ---


Brought to you by Super Global Mega Corp .com