Path: utzoo!utgpu!watmath!clyde!att!osu-cis!killer!ames!lll-winken!snll-arpagw!paolucci
From: paolucci@snll-arpagw.UUCP (Sam Paolucci)
Newsgroups: comp.sys.amiga
Subject: Re: IRQ virus
Message-ID: <29@snll-arpagw.UUCP>
Date: 10 Jan 89 03:16:04 GMT
References: <27@snll-arpagw.UUCP> <13341@cup.portal.com>
Reply-To: paolucci@snll-arpagw.UUCP (Sam Paolucci)
Organization: Sandia National Labs, Livermore, CA
Lines: 14

In article <13341@cup.portal.com> dan-hankins@cup.portal.com (Daniel B Hankins) writes:
->Re self-checking programs:  Not effective.  The virus prepends itself to
->the program.  After the virus executes, *then* in loads the regular program
->and runs it.  The regular program never knows the virus was there.  The
->checksum matches.

Not if the checksum code is part of the startup code.

->Dan Hankins
-- 
					-+= SAM =+-
"the best things in life are free"

				ARPA: paolucci@snll-arpagw.llnl.gov