Hi Kurt,
Quoting Kurt Wismer to The Visionary, on 23 Dec 96
TV>> I would have to say that if every .EXE file was engineered to
TV>> CRC itself before execution, there would be no more .EXE
TV>> infections, since that in itself is a fairly solid form of
KW> some of the smallest viruses in the world work around it... they're
KW> overwriting infectors...
Any full stealth virus would get around it. The virus would be executed
before the part of the program that checked the CRC, and if the virus is full
stealth (ie removes itself from the program/file just loaded before returning
control, to avoid the confusion we had last time!) then the program wouldn't
notice anything out of the ordinary.
Paul
--- FMail 1.02
---------------
* Origin: There can be only one! (2:253/417.46)
|