Path: utzoo!mnetor!uunet!husc6!bu-cs!polygen!pablo
From: pablo@polygen.uucp (Pablo Halpern)
Newsgroups: comp.sys.mac
Subject: Re: Virus killer
Message-ID: <131@polygen.UUCP>
Date: 19 Mar 88 21:30:50 GMT
References: <238@faui10.UUCP>
Organization: Polygen Corporation, Waltham, MA
Lines: 51

From article <238@faui10.UUCP>, by msurlich@faui44.UUCP (Matthias Urlichs ):
> Place this short INIT into your active System folder and reboot.
> From now on, the virus will be removed automatically from every program
> you start.
> Your System will also be virus-free. The INIT installs a "nVIR" 10 resource
> in the System to prevent the virus from doing anything.
> (This is a feature the virus author has thoughtfully put in - didn't want to
> get problems with his own Mac, I suppose.)
[ BinHex code follows ]

Has anybody tried this and confirm that it works?  The last thing I want to
do is install a virus when I'm actually trying to vacinate against them.
I don't want to insult Matthias but, never having met him, I have no
way of knowing where he's been :-).  Since I don't have a hard disk, I
will try this vacine on an isolated disk.  In fact, I recommend all public
domain software be tried with your hard disk powered down (if you have
an internal hard disk, let a friend try it first).  Check sizes and mod
dates on all files before and after installating and running a program you
got from the net, including the size and mod date of the program itself.

In fact, if there are any Mac programmers out there that would be willing
to write this, we all could use a program that:

	1. Produces a database of the mod dates, sizes, and several different
	   types of checksum (straight add, CRC, etc.) for all files on
	   a disk.

	2. Checked the disk against to database to see what's changed.

With a program like that you could check to see if anthing has changed
that shouldn't have changed.  For example, if the program doesn't install
things into your system, the system file shouldn't change.  Very few
programs have a legitimate need to change an applications file.  If
something strange happens, a virus might be the cause.  If you did this
operation entirely on backup floppies, congratulations, you may have just
prevented the spread of a virus.  If you did this on a hard disk..., well
early diagnosis gives you the best likelyhood of a cure :-).

All this need for protection really bugs me.  My car has a $300 security
system just because people steal cars!  Now I need to screen public domain
software just because people write viruses!  Yuk!

One more thing.  There are clubs that distribute public domain software.
They usually charge just enough to cover costs.  Maybe some of them will
start doing virus checks on the software they distribute.  It would be
nice to have a "clean" source of PD programs.

Pablo Halpern		|	mit-eddie \
Polygen Corp.		|	princeton  \ !polygen!pablo  (UUCP)
200 Fifth Ave.		|	bu-cs      /
Waltham, MA 02254	|	stellar   /