Path: utzoo!attcan!uunet!sugar!peter
From: peter@sugar.uu.net (Peter da Silva)
Newsgroups: comp.sys.amiga
Subject: Re: IRQ virus
Message-ID: <3243@sugar.uu.net>
Date: 8 Jan 89 14:30:17 GMT
References: <27@snll-arpagw.UUCP>
Organization: Sugar Land Unix - Houston, TX
Lines: 14

In article <27@snll-arpagw.UUCP>, paolucci@snll-arpagw.UUCP (Sam Paolucci) writes:
> Then when the program is started up
> the first thing it does is compute its checksum and it checks the
> result with the one stored in the code.  If the two match then it
> runs, otherwise it doesn't and a message to that effect could be
> printed out.

I don't think that would even catch the IRQ virus, because it sticks all the
program's code in a data hunk... which when loaded should end up with the
right checksum. If it actually went to disk to re-read itself, then the virus
could fake a copy of the original in RAM.
-- 
Peter "Have you hugged your wolf today" da Silva  `-_-'  Hackercorp.
...texbell!sugar!peter, or peter@sugar.uu.net      'U`