Path: utzoo!attcan!uunet!seismo!sundc!pitstop!sun!imagen!atari!portal!cup.portal.com!Dan-Hankins
From: Dan-Hankins@cup.portal.com
Newsgroups: comp.sys.amiga
Subject: Re: The ultimate fix!!!
Message-ID: <9062@cup.portal.com>
Date: 14 Sep 88 05:40:57 GMT
References: <681@zehntel.UUCP>
Organization: The Portal System (TM)
Lines: 20
XPortal-User-Id: 1.1001.5361

1. CRCs can be spoofed fairly easily by anyone who knows the math.  A
   disassembly of the boot block will reveal the algorithm to the virus writer
   rather quickly.

2. If I were a virus writer, I wouldn't even bother to spoof the CRC.  I'd
   just write my virus to patch out the CRC checking code so that it never
   raises an alarm.

3. Self-validating programs are in general not a promising approach to
   stopping viruses.  The virus just alters the checking code so that it
   fails to notice the virus.

   Remember:  Once a self-protecting program is released, the virus writer
   can easily study it and defeat it.


Dan Hankins

"These opinions are mine and mine alone.  They are not for sale.  They may,
 however, be rented or leased at reasonable rates."