Newsgroups: comp.sys.mac.misc
Subject: Re: The answer Re: Virus vs disk compression
From: Joe Simpson <JSIMPSON@MIAMIU.BITNET>
Date: Tuesday, 13 Oct 1992 15:03:46 EDT
Organization: Miami University - Academic Computer Service

In article <ldkttrINNq7@dimebox.cs.utexas.edu>, werner@cs.utexas.edu (Werner
Uhrig) says:
>
> Jim.Kauffman@f20.n3603.z1.FIDONET.ORG (Jim Kauffman) writes:
>
>>...an article suggesting that "While any disk compacting utility,
>>such as Disk Doubler, or Auto-Doubler, is active, your Virus protection
>>software is rendered virtually useless." I will assume by this statement
>>that they mean to include other utilities such as More Disk Space,
>>SpaceSaver, and others as well.
 
There are two methods used to detect/defeat computer viruses.
Method one.  Actually detect the infection attempt.  On the Macintosh
one of the activities monitored is any attempt to add or modify a
a CODE resource.  Mac anti-viral programs monitor the routines that
write CODE resources.  This a a prophylaxis stragegy.
 
The second method used is to scan a file (perhaps when it is copied,
or after a diskette or cartrige drive is inserted.  This method
us more like preventative medicine.  A checkup to make sure that
you are still healthy.
 
Programs that have been compressed (for example by Stuffit or
Compactor) will not be detected by scanning.  So... consider the
following scenario.
User inserts diskette with .sit or .cpt file on it.  Anti-viral
software scans disk and reports that it is clean.
User uses stuffit or compactor, or even worse still uncompacts
the file as a self extracting archive.
Unfortunately, the origional program contained a virus.  This
virus is now dormant on the user hard disk.
User executes program, the virus self replication mechanism
activates.  If prophylaxis is in force user should be protected.
If not, virus replicates across hard disk.
Or worse....   Virus contains code that causes harm.  User
executes program, the virus harming code is triggered and
harm is caused even though the prophylatic anti-viral code
protects against replication.
 
My personal opinion of this is that the magazine artice, if
accurately quoted a) overstates the risk and b) promotes a
perspective on virus protection that is not very useful.
 
Information that cannot be shared looses most of it's value.
 
Virus protection should be viewed from a risk management point
of view, just like disk crash protection, physical theft,
access protection of files.
 
As a practical matter, one can avoid the worst case disaster
outlined above by inserting one step in the process.
After extracting, but before running, the application use
an anti-viral scanner to scan for viruses.  I do this, but
not every time.
 
There aren't that many Mac viruses.  Few were truely malicious.
I don't think there is much risk.  All of the risk can be avoided
with proper procedures.
 
IMHO with even indiferent virus protection procedures you are at
greater risk of data loss from hardware and software failures
than you are from viruses in the Macintosh environment.
 
A single disclaimer:  Assume that none of this discussion applies
to MS-DOS computer virus protection.
Newsgroups: comp.sys.mac.misc