Path: utzoo!mnetor!uunet!portal!cup.portal.com!Linkers
From: Linkers@cup.portal.com
Newsgroups: comp.sys.mac
Subject: Re: Virus on the Mac?
Message-ID: <3963@cup.portal.com>
Date: 19 Mar 88 05:57:26 GMT
References: <1056@hubcap.UUCP> <2489@utastro.UUCP> <1062@hubcap.UUCP>
Organization: The Portal System (TM)
Lines: 15
XPortal-User-Id: 1.1001.3881


It seems to me that the only effective way to check for a virus would be
to take a snapshot of the entire environment before running the suspected
program, and another afterwards, and then examine what changed.  This process
would have to be repeated in conjunction with updating the clock to detect
virus' that are triggered after certain dates.
Unfortunately, on all existing Mac CPU's there is no way to simulate the
programs environment, (this should be possible under an 68030 multitasking
and memory mapped architecture) to develope a program capable of testing
another for viral effects.
However, it is possible to develop a way to take a snapshot in the form
of a checksum of every executable/system file on the system before each
program is executed, and then to determine which files changed between
the previous program execution.
Hopefully some saintly organization/individual will take up the challenge.
Scott Bryan