-=> Quoting John Kismul to Rick Collins <=-
-=> FidoMail to 1:163/215, please.-=<
rc> Incomplete. You stated "with a virus in memory". A virus in the
rc> disk read buffer will _not_ infect the system because the
rc> contents of the disk read buffer are not executed. 
JK> Well, when a virus is in memory it is not in the disk buffer.
The disk buffer is in memory, John.  Therefore, a virus in the disk
buffer _is_ in memory, but won't be executed.
RC> JK> And I answers, Because when the VIRUS is active in memory
RC> JK> it checks all the files that gets executed or accessed, and
RC> JK> if the virus finds a file it want to infect it will infect
RC> JK> it.
rc> You have changed your position. You now are stating "the virus
rc> is _active_ in memory". Your original post said only "in
rc> memory". The key element here is "active" - and the fact that
rc> you didn't mention that point is _why_ I asked "where in memory"
rc> and "what causes the IP to point to those addresses". 
jk> Have YOU ever heard of a virus that just is in memory without
jk> doing ANYTHING. I have never. 
You haven't been listening.  We have been telling you of just that
circumstance for a week now:  to wit, a DIR of an infected floppy can
end up with a virus signature in the disk buffer (that's in memory,
John), but it will _never_ be executed there.  A scanner, though, may
detect a "memory infection" caused by that virus fragment. 
Therefore, the myth that "doing a DIR on an infected floppy will
infect your system".  It doesn't, that's what we've been trying to
tell you, and we've been trying to tell you _why_ a scanner may
detect a virus in that situation and _why_, nevertheless, the system
is _not_ infected.
rc> Which doesn't answer the question. The answer, of course, is
rc> because the virus is _active_ in memory, by definition, the IP
rc> will point to and execute the virus instructions. The point of
rc> that question was to lead you to the point of saying or
rc> appreciating that the virus must be "active" - meaning that the
rc> CPU will, at some point, execute the virus instructions, and
rc> simply being "in memory" wasn't enough. 
JK> Yes but of course I know that the virus must be active in memory.
You have not demonstrated taht you knew that for at least a week. 
That's the point of all these posts.
TTFN. Rick.
Ottawa, ON 9 Jan 1:54 
--- Blue Wave/DOS v2.20
---------------