ebrandt at jarthur.Claremont.EDU
Thu Feb 11 16:17:21 PST 1993
> From: thug at phantom.com (Murdering Thug)
> I myself am very familiar with the virus underground, so for those who are
> not, let me explain the two newest and most deadly virus techniques which
> are being seen in the DOS world.
[ discusses stealth viruses, around for, oh, five years at least; and
the MtE. ]
Reasonably accurate discussions, but let's leave the hype for _Time_
and McAfee. "Stealth" viruses can be detected in memory, if you make
the mistake of getting infected in the first place. MtE-derived
viruses enjoyed a window of about a month while they could not be
detected by scanners; they had no such reprieve from integrity
checkers. Big deal. (Well, from the point of view of a scanner
writer, it must be a pain, but that's not the user's problem.)
Cryptohash integrity checking is probably the way to go in the long
run, but scanners still work.
The "most deadly virus technique", in terms of number of infections
caused, is probably that of boot-sector infection. Low-tech, but it
seems to work.
PGP 2 key by finger or e-mail
Eli ebrandt at jarthur.claremont.edu
More information about the cypherpunks-legacy