Posted-Date:  31 Jul 92 10:24 EDT
Newsgroups: bit.listserv.win3-l
Date:         Fri, 31 Jul 1992 10:20:00 EDT
From:         Vince Scarafino <Scarafino@MULTICS-A.PMS.FORD.COM>
Subject:      Re: viruses
X-To:         Microsoft Windows Version 3 Forum
              <WIN3-L%UICVM.BITNET@PUCC.PRINCETON.EDU>

 >Date:  31 July 1992 01:49 edt
 >From:  KARGRA at GBA930.ZAMG.AC.AT
 >Subject:  viruses

 >A simple question: I read now and then, that a new programupdate for various
 >antivirus-software will run under WIN and protect your PC. I doubt, that this
 >is possible. How can software in a multitaskingenvironment determine, what
 >another task is doing - especially, when the bogus program tries to hide its
 >presence ???!!! So there should not be any help against viruses within WIN.
 >(except an UAE or GPF :-)) But after it occured, the damage alredy has
 happened.
 >At least WSCAN claims to do this. Any comments? VINCE ?
 >
 >Sincerely, Alfred

Depends on the nature of the beast (virus) and the characteristic of the
operating environment.  Multitasking per se doesn't really change
anything *by itself*.  You have to look at the environment.  Take
Windows 3.1 as an example.  (I thought it might be an interesting
example to use.)  Windows 3.1 has a single address space that is shared
among all the processes that it runs.  It attempts to protect processes
from each other, but since it does not utilize hardware protection
(Windows 3.1 runs in ring 3, the same ring that it's application
processes run in.  It also does not utilize the 32 bit segment
addressing support for purposes of isolating processes address spaces
from each other.)  it is possible to write an application that could
analyze the Windows 3.1 environment.  Utilization of virtual DOS machine
hardware support for non-Windows applications does complicate the
problem.

However, most of the viruses do their damage through modifying the file
system or boot sectors.  A program running under Windows should be able
to analyze this type a problem.  So I would think a program used to
check out floppys or hard disks for the presence of viruses should work
okay.

Memory resident viruses are another matter.  I think it would be
possible for a program to examine the Windows 3.1 virtual memory to
search for this type of virus, but I don't think it would be an easy
thing to get right.  For the DOS windows, each one has the potential to
pick up a virus, but depending on where in memory it planted itself,
might or might not be invisible to any virus scanning program that isn't
running in that particular DOS image.  Of course, once it does damage to
the file system, any virus scanning program running on the machine
should catch it.

I don't know if I've helped or confused the issue.  Seems the safest
approach is to run your virus checkout in the simplest environment,
which is probably under DOS immediately after power up and before you
bring up Windows.  But, such an approach is incovenient for checking out
floppys that are brought to you while you're in the middle of doing
stuff.  I suppose you could set up a memory resident virus sentinel in
Windows *and* in every DOS session you create.  A little complicated,
but possible, I presume.  Oh well, life isn't meant to be easy.

Vince
Newsgroups: bit.listserv.win3-l