Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!csd4.milw.wisc.edu!leah!bingvaxu!sunybcs!boulder!pikes!udenva!isis!nbires!maa
From: maa@nbires.nbi.com (Mark Armbrust)
Newsgroups: comp.binaries.ibm.pc.d
Subject: Re: Viruses and LZARC
Summary: "fiz"-like program for LHARC
Message-ID: <381@nbires.nbi.com>
Date: 15 Apr 89 16:35:14 GMT
References: <2530005@hpbsla.HP.COM>
Reply-To: maa@nbires.UUCP (Mark Armbrust)
Organization: NBI Inc, Boulder CO
Lines: 38

In article <2530005@hpbsla.HP.COM> eboston@hpbsla.HP.COM (Ed_Boston) writes:
>
>as time went on, the ability to create self-running COM files were discovered
>and the feeling about LZARC changed.  This function now allow people with a
>warped sense of humor, a simple way of infecting disks with a virus.

This is really no different that ANY self-extracting archive file.  Anyone who
runs software of questionable origin on his system is asking for trouble.  The
self running batch file option only works with self-extracting LHARC archives.

From the LHARC manual:

	3.  Self-Extracting Files.

	If a self-extracting file is executed, then it will try to extract
	all of the archived files into the current directory.  Every
	extracted file has the attribute  20h. If a file with a name
	of AUTOLARC.BAT exists, this batch file is activated immediately.
	
	It is possible to embed some jokes or even so-called viruses in
	this autolarc.bat file.  The possibility exits even with other SFX
	files from ARC or PKware.  So I have chosen to keep the batch file
	option active in the present version because the world is now
	well-prepared for those tricks.

>Because of this problem, I would suggust not using LZARC unless you have 
>placed safegards against viruses and trojans on your system.  I vote against
>LZARC or any program that allows self-running programs.

I have just finished writing a program that scans LHARC files and reports the
location of file headers in them.  This info can be used by the same program
to extract files from damaged archives and self-extracting archives.  It should
be sent to comp.binaries.ibm.pc later this weekend or on Monday if I cannot get
it uploaded from home.

Mark Armbrust
maa@nbires.nbi.com
maa@nbires.UUCP