Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!sample.eng.ohio-state.edu!purdue!news.cs.indiana.edu!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: ACDFINN@vm.uoguelph.ca (Finnegan Southey) Newsgroups: comp.virus Subject: Scanning infected files (PC) Message-ID: <0007.9106101933.AA10096@ubu.cert.sei.cmu.edu> Date: 7 Jun 91 01:31:23 GMT Sender: Virus Discussion List Lines: 17 Approved: krvw@sei.cmu.edu In regards to the problem of anti-viral programs infecting files they scan when a memory-resident virus is present: Wouldn't it be possible to read disks sector by sector instead of opening files through DOS calls? This reading would be much the same as a disk editor program. The scanner could consult directory listings to find program boundaries and then check approp- riate areas without opening the files as a file? As I'm not an MS-DOS expert I'm not sure if this makes sense, but I thought I'd ask. - ------------------------------------------------------------------------------- Finnegan Southey - Computing Services, University of Guelph, Ontario, CANADA BitNet: ACDFINN.VM.UOGUELPH.CA CoSy: fsouthey@COSY.UOGUELPH.CA You are in a maze of twisty little passages, all alike... - -------------------------------------------------------------------------------