From: hafting@Lise.Unit.NO (Helge Hafting)
Newsgroups: comp.os.os2.misc
Subject: Re: OS/2 virtual machines & viruses
Date: 6 Oct 92 13:38:10 GMT
Organization: Norwegian Institute of Technology

In article <1992Oct6.043053.10124@bsu-ucs.uucp>, 00vmszopa@bsu-ucs.uucp writes:
 > In comp.virus there was a message from Vesselin Bontchev about
 > viruses and OS/2 with something interesting in it:
 > 
 > >"...(F)urthermore, most file infectors that do not use dirty tricks
 > >will happily infect in the DOS sessions. The "nice" thing is that
 > >since all DOS sessions use one copy of the command interpreter, if
 >                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                
 > >a virus succeeds to infect it, this means that it will infect all
 > >DOS sessions. So, you'd better get some protection..."           
 > 
 > And here I thought that one of the "bulletproof" aspects of OS/2 was
 > the fact that EACH DOS or Windows 3.0 session had its OWN virtual
 > machine complete with command interpreter, memory access, and 
 > independence from other processes. Seems to me that DOS-specific
 > viruses would only be capable of crashing one virtual machine and 
 > (possibly) disrupting any storage media (ie, hard drive), and not of
 > bringing down the OS as a whole.
 > 
 > Before foolishly posting to a moderated group, two questions:
 > 
 > 1) does each DOS session have its own interpreter?
Each dos session has it's own protected memory.  So a virus that installs
itself in memory, trapping interrupts etc. will only disrupt that session.

If, however, the virus modifies executable files, and another
dos session runs one of the modified files, then that session also will get
the virus.  The msdos command interpreter is stored in a file called command.com,
wich by default is shared.

It is possible to guard against this by having all dos files that each
session uses in separate  "disk image" files.  So you may have one
bootable image for your dos word processor, another image for your each of your
dos games, and so on.  This will of course waste some disk space when command.com
and all other files that is needed in every dos session is duplicated.
   
If the virus tries to write into the boot sector, (by using the absolute disk
write interrupt in the BIOS), it will fail, as os/2 don't allow
absolute disk writes from msdos.

 > 
 > 2) if so, might not OS/2 be the perfect place for DOS programs, 
 > since an OS/2 virus protection application could monitor all 
 > suspicious activity and I/O, etc., by the virtual sessions?
Yes it can be the perfect place for dos programs, but it will cost
some extra disk space per independent application. (100-200k)

And even without multiple disk images, the only kind of virus that will work is
the kind that modifies executable files.  And they will not be able
to crash the system,  although they may still stop you from using
dos programs.
 > 
 > BTW, I haven't used it--only read about it. (see .sig)
 > 
 > Thanks!
 > 
 > -------------------------------------------------------------------
 > 00vmszopa@leo.bsuvc.bsu.edu  	
 > oh god free me from my yellow-phosphor gilt XT.
 > just a 486 with OS/2 before i die. oh and VGA too

-- 
 |  |      ^         |  |      /   ^   o
 |__| _   /|  _  _   |__| _   /|  /|   |    _   _
 |  |/_| / | / \/_|  |  |/ | /-+-/-+- /| /|/ | / \
 |  |\__/  |/\_/\_   |  |\_|/  |   \_/ |/ |  |/\_/
            __/                /              __/
Newsgroups: comp.os.os2.misc