Path: utzoo!attcan!uunet!lll-winken!snll-arpagw!paolucci
From: paolucci@snll-arpagw.UUCP (Sam Paolucci)
Newsgroups: comp.sys.amiga
Subject: IRQ virus
Message-ID: <27@snll-arpagw.UUCP>
Date: 6 Jan 89 16:06:48 GMT
Reply-To: paolucci@snll-arpagw.UUCP (Sam Paolucci)
Organization: Sandia National Labs, Livermore, CA
Lines: 23


If I understand correctly how the IRQ virus works, I just had a
thought about possible future spread of such viruses which monkey
around with executable files.  Why not have the executable generate
its own checksum when the code is generated, and have this checksum
reside in the executable itself.  Then when the program is started up
the first thing it does is compute its checksum and it checks the
result with the one stored in the code.  If the two match then it
runs, otherwise it doesn't and a message to that effect could be
printed out.

The only possible problems that I see with the above are:
a) presently one would have to have the checksum routines in their
   executables making the codes slightly larger.  I guess _main()
   could be modified to accomplish this.
b) it would take a little longer for the program to fire up since
   it has to compute its checksum before it starts executing.  However
   note that if the code is made resident than it would be possible to
   not recompute the sum every time the code is re-executed.-- 
					-+= SAM =+-
"the best things in life are free"

				ARPA: paolucci@snll-arpagw.llnl.gov