Path: utzoo!utgpu!watmath!clyde!att!pacbell!ames!ucsd!orion.cf.uci.edu!oberon!nunki.usc.edu!castor.usc.edu!wdao
From: wdao@castor.usc.edu (Walter Dao)
Newsgroups: comp.sys.amiga
Subject: Re: IRQ virus
Keywords: -beep-
Message-ID: <2301@nunki.usc.edu>
Date: 9 Jan 89 23:50:41 GMT
Sender: news@nunki.usc.edu
Reply-To: wdao@castor.usc.edu (Walter Dao)
Organization: University of Southern California, Los Angeles, CA
Lines: 33

hmmmm let me think .... 

YEAAAHHH !!!

how about fighting fire with fire ? 
lets write a virus counter virus ? 

lets have somewhere in the program a checksum of the program calculated by I 
dont know what mean and stored at a fixed offset from the start of the 
executable code. 
the checksum is calculated only once when the program is finished.
(like at the same time as ATOM ....) and then the chcksm is merged to the 
esecutable code itself. 

then have pseudo virus in the amiga ram that acts like a virus that does the 
following :
1) when a prg has to be loaded , 
   recalculate the whole chcksum (I am not going to go in deep but you get
   the idea).
2) get the checksum we got and which is imbedded in the code.
3) compare . if  same then ok , everything is fine. 
     othewise, the code is not the same . 

what the IRQ virus could do . 
- After the irq merges itself with the code, recalculate the chcksum.
  (they will have to have the right formula to calculate the chcksum).
  but to much of a hassle ....

well that was on top of my head ... 



 D . W .