Path: utzoo!news-server.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: 8326442@AWIWUW11.BITNET (martin zejma)
Newsgroups: comp.virus
Subject: False alarms using scan (PC)
Message-ID: <0011.9103081913.AA10967@ubu.cert.sei.cmu.edu>
Date: 8 Mar 91 14:54:19 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 23
Approved: krvw@sei.cmu.edu

Hello hunters |

Long time ago, around end of June 90', I posted a question about false
alarms when scanning memory using scan ( happend with all versions I
know ).

The solution : Once upon a time... i've been infected with the 170x
virus.  I detected the infection instantly and healed all corrupted
files.  BUT | the viral part behind the EOF of each file naturally
didn't disappear ( filling up the last cluster of the file ) , and
that also happend to command.com , only invoked from within a
different directory when using the Norton Commander, so then scan
reported an active 170x virus in memory.  After watching behind the
EOF with Norton Utilities, I erased the dumb virus part, and voila |
no more false alarms .
                                 Simple solution this time , Martin


+-----------------------------------------------------------------------+
| Martin Zejma                                8326442 @ AWIWUW11.BITNET |
|                                                                       |
| Wirtschaftsuniversitaet Wien  ---   Univ. of Economics Vienna/Austria |
+-----------------------------------------------------------------------+