💾 Archived View for gemini.spam.works › mirrors › textfiles › magazines › CRISNEWS › cnews-1.007 captured on 2022-06-12 at 10:42:42.
-=-=-=-=-=-=-
-----BEGIN PGP SIGNED MESSAGE-----
Submitted to Crisnews by:
Bill Lambdin
I posted this routine once before. I have done further testing on this
idea, and it does work. even on some stealth infectors without the
necessity of booting clean from a bootable diskette.
I want to state up front, that this will not identify the virus, nor help
you get rid of it. This is detection only, and should be considered as an
enhancement to scanners, and integrity checking, and not be used to replace
either.
This will detect most (if not all) file infectors that a scanner may miss.
This will act as an early warning system for people that use integrity
checking software. namely limiting the number of infected files to a
minimum.
This can detect many viruses without the need to boot clean prior to
running the test.
If you wish to use my idea, you will need the following.
LHA. I use LHA 2.13
Archive your most common used files.
FC.EXE that comes with DOS 4.0 and above
The .BAT file below.
BAIT.BAT
@ECHO OFF
CLS
C:
CD\BAIT
DEL VIRUS.LZH
LHA A -A VIRUS \COMMAND.COM \DOS\CHKDSK.*
FC BAIT.LZH VIRUS.LZH
CD\
It would be a very good idea to rename the utilties, and directory. to
prevent a hacker from writing a virus that will delete or fool this
routine.
You can archive as many files as you wish, but I would recommend a minimum
of two files. 1.COM file, and one .EXE file. Currently; I am archiving
eight files. six are DOS programs, and two of them are Windows programs. So
I can detect either DOS or Windows viruses in one test that takes only a
few seconds on my 486. Be sure to use the asterisk for the .EXE extension.
This will make LHA add any companion infectors that are present.
Part of that .BAT file is complex, and it is vital that it be typed exactly
as shown. So I should explain how it works in more detail.
DEL VIRUS.LZH
This deletes the previous test to give you a clean and fresh test every
time.
LHA A -A VIRUS \COMMAND.COM \DOS\CHKDSK.*
In the command line above, the first A instructs LHA to add the files to
the archive.
The second paramater -A instructs LHA to add the file regardless of which
atribute(s) are set. It works for all four atributes.
Hidden
System
Read only
Archive
I have been thouroughly testing this routine for weeks.
I have tested it against the following stealth viruses.
X = detected change.
active inactive
Virus in memory booting clean
SBC X X
FRODO X X
TREMOR X
My routine should have detected SBC because it is not fully stealthed, and
it doesn't disinfect the host file when the it is opened.
My routine should not have detected FRODO because it is fully stealthed,
and does disinfect the host file on the fly when it is opened for any
reason. FRODO sets the date stamp forward 100 years. This is how that Frodo
Marks the files as infected. My routine detected the change to the date
stamp even though Frodo had disinfected the host file when LHA archived the
host file(s).
My routine is able to detect the following types of changes.
1. Change to files
2. change of file attributes
3. change of file time stamp
4. change of file date stamp
I release this routine to the public domain, and anyone may use it freely.
Bill Lambdin
-----BEGIN PGP SIGNATURE-----
Version: 2.3a
iQBVAgUBLNc4LaM4CDusTF+9AQHRagH/VBeKGX7Nbdpcwo3xHzRCCGVFppDbPQZz
KvGmA1Y8EL5dOx0ozjw57knsNGjbzU+FST5USsQfmVnf2Nc//FCiBQ==
=w7Cq
-----END PGP SIGNATURE-----