Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!uupsi!sunic!isgate!krafla!frisk From: frisk@rhi.hi.is (Fridrik Skulason) Newsgroups: comp.os.msdos.apps Subject: Re: Virus Utility???? Message-ID: <2975@krafla.rhi.hi.is> Date: 26 Mar 91 16:51:01 GMT References: <2453@umriscc.isc.umr.edu> Reply-To: frisk@rhi.hi.is (Fridrik Skulason) Organization: University of Iceland (RHI) Lines: 27 In article <2453@umriscc.isc.umr.edu> mcastle@mcs213e.cs.umr.edu (Mike Castle {Nexus}) writes: >In article roy%cybrspc@cs.umn.edu (Roy M. Silvernail) writes: >> >>McAfee's SCAN will scan .COM, .EXE, .SYS and .OV? files for you, as well >>as your boot sector. Beyond those types, scanning is of little value, since a >>virus must be executed to do any damage. > >Oh, really? What about franke.387 (a 80387 emulator)?? Yes, really! The original posting asked about viruses - not a generic trojan scanner. All known viruses (well, apart from a couple of stupid little .BAT viruses) use one of to possible methods to select suitable files for infection: 1) Files having the extensions .COM and/or .EXE 2) Files supplied as argument to INT 21H, function 4BH, which includes the above, as well as occasional .OVL, .OVR, .APP etc files. A virus could THORETICALLY infect a .DLL file, but such a virus does not exist yet - so why bother scanning for it ? We don't know what to look for. Anyhow - if you want to waste time scanning everything, including .DAT, .GIF etc, you can also use my F-FCHK program posted recently on c.s.i.p.b. with the /ALL argument.