Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!ceres.physics.uiowa.edu!iowasp.physics.uiowa.edu!ns-mx!uunet!samsung!usc!ucsd!casbah.acns.nwu.edu!casbah.acns.nwu.edu!jln Newsgroups: comp.sys.mac.apps Subject: Re: Virus Programs Message-ID: <1991Apr26.193058.17522@casbah.acns.nwu.edu> From: jln@casbah.acns.nwu.edu (John Norstad) Date: 26 Apr 91 19:30:58 GMT Sender: news@casbah.acns.nwu.edu (Mr. News) References: <2519@lee.SEAS.UCLA.EDU> <1991Apr26.130358.2711@mmm.serc.3m.com> Distribution: comp Organization: Northwestern University Nntp-Posting-Host: mac181.acns.nwu.edu Lines: 24 In article <1991Apr26.130358.2711@mmm.serc.3m.com> pejacoby@mmm.serc.3m.com (Paul E. Jacoby) writes: > But you need to keep this in context--both Jon Norstad and Jeff Shulman > have apparently said that the reason they will NOT update is because the > virus is written in HyperTalk, and as such is easily modifiable to avoid > whatever detection-mechanism they implement. Will everyone who uses SAM > or Virex be forced to upgrade again and again as various individuals > modify the HC script for the new virus? That's what Henry Norr wrote in his MacWeek article, but he must have gotten this from Jeff, not from me. As I told Henry, the reason I'm not updating Disinfectant for the new HyperCard virus is because I don't make any attempt in Disinfectant to deal with the entire complex issue of application-specific viruses which spread via the application scripting languages. These are very different from the other kinds of viruses which Disinfectant was designed to deal with. Adding detection and repair capabilities to Disinfectant for these kinds of viruses would be a very major task, and I don't have the time or the energy at this point for such a project. John Norstad Academic Computing and Network Services Northwestern University j-norstad@nwu.edu