Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: DAVE@GERGA.TAMU.EDU (Dave Martin)
Newsgroups: comp.virus
Subject: Viruses & System 7.0 (Mac)
Message-ID: <0007.9104261444.AA20785@ubu.cert.sei.cmu.edu>
Date: 25 Apr 91 13:23:40 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 27
Approved: krvw@sei.cmu.edu

The report on GateKeeper 1.2 made me start wondering about how viruses
would behave under System 7.0 (one of the feature points said that
GK1.2 had better compatibility with Sys7, adding that users & viruses
shouldn't notice any differences). Has anyone experienced a virus
under System 7.0 (beta, FC, etc.), and if so, did they behave any
differently. Are any of them completely incompatible in that they
simply crash the machine when they try to do their dirty work, or do
they work just as they always have. Anyone looked at the code enough
even to tell what they'd do?

Of course, compatibility of old viruses aside, I get this gut feeling
that Sys7 will open the doors for more viruses, and make old ones
spread more easily. How will SAM react to an infected file run from a
FileShare folder? Or if someone puts a disk with WDEF into a drive
while a shared folder is open. Will SAM or any of the other active
detectors warn you when a virus tries to get in from the back door?
Does the AppleEvent manager have any built-in precautions to prevent
viri from sending events out to programs? Or from interfering with VM?
I know, lots of questions. Maybe they've been discussed before, I
don't know -- just signed on a week or so ago. As semi-official
manager of a small (~20) network, and someone who has had to clean
Scores, nVir, & WDEF from most of them many times, I'm curious how
much more trouble to expect from System 7.0

Thanks.
Dave Martin, Geochemical & Environmental Research Group, Texas A&M University
DAVE@GERGA.TAMU.EDU  DAVE@DBM-GERG.TAMU.EDU  BROOKS@TAMVXOCN.BITNET  AOL: DBM