Path: utzoo!mnetor!uunet!husc6!mit-eddie!bbn!rochester!cornell!batcomputer!braner
From: braner@batcomputer.tn.cornell.edu (braner)
Newsgroups: comp.sys.atari.st
Subject: Re: Virus--  suggestion!
Message-ID: <4132@batcomputer.tn.cornell.edu>
Date: 23 Mar 88 15:08:09 GMT
References: <1288@uop.edu> <254@laura.UUCP>
Reply-To: braner@tcgould.tn.cornell.edu (braner)
Organization: Cornell Theory Center, Cornell University, Ithaca NY
Lines: 24
Keywords: virus, GEMDOS, atari, GNOME

[]

Another suggestion: could somebody make a dump of the boot sectors of
a standard SS floppy, a DS one, standard HD setup, etc?  These dumps could
be compared with what's on a disk that is suspected of having been hit
by a virus.  One could even write a program that has these dumps embedded,
compares with what's on the disk, reports about differences, and,
upon request, replaces what's on the disk with the standard.

Is this a good idea or am I completely ignorant as to how viruses work?

Of course such a program would be also helpful in fixing up damaged disks
and in removing utilities (like HDB) that will not remove themselves and
are incompatible with others (e.g. HDB and the Supra HD boot SW).

Note that this would only help with viruses that modify the boot sector.
There are probably others, e.g. accessories that modify system variables
in RAM, or whatever.  Other fixes would be needed for those.

- Moshe Braner

PS: GNOME is up for FTP at <tcgould.tn.cornell.edu>, in the directory
/usr/spool/ftp/pub/gnome.  You may start out at .../ftp or even .../pub
when you connect as anonymous.  See the "readme" file there.