When did modern anti-virus software stop detecting DOS and Windows 9x viruses? - Page 1
Forum section: electronics / general

author: Halcyon
author_rank: Unknown
timestamp: August 07, 2017, 08:56:11 am
content: I just tested out ESET NOD32 antivirus on a folder full of old DOS viruses, basically to see if it would still detect very old signatures. Turns out, it doesn't and ESET is not alone. Most of the big-name programs don't include the old stuff in their definitions databases.I not only rely on my modern virus scanner to protect from new threats, but old ones as well since I run a file server with a bunch of old DOS and 16-bit Windows applications stored on them. Most are from reputable sources (i.e.: I've created the images of disks or CDs myself from original media), others purport to be original images but are downloaded from the internet, so you neverreallyknow.What's the solution here to be absolutely safe? Run a separate NAS with an old enough operating system to run the old virus scanners? For those of you who might remember back to the 1980's and 1990's, there were some viruses could do actual physical damage to old machines or at the very least, render BIOS chips unusable. There were even those which would cause CRT monitors to over-scan or stress components to the point of failure (I don't recall the exact machine(s)/virus code right at the moment).

author: IanMacdonald
author_rank: Frequent Contributor
timestamp: August 08, 2017, 06:11:18 am
content: Dunno, but it might be worth sending a few tohttp://virustotal.comand see what is reported.

author: WastelandTek
author_rank: Frequent Contributor
timestamp: August 08, 2017, 06:18:14 am
content: this is the kind of thing thatreallykeeps one up at nightat least I don't have any bitcoin to worry about

author: Ian.M
author_rank: Super Contributor
timestamp: August 08, 2017, 07:07:41 am
content: I *guess* that most AV companies probably started dropping support for DOS virus detection after the Win95 EOL (end 2001) as the number of systems that could dual-boot into DOS and Windows on the same disk volume became vanishingly small. Dropping DOS and early Win9x signatures probably sped up after WinME EOL (mid 2006).Maybe take a look athttps://en.wikipedia.org/wiki/Clam_AntiVirusThe engine is FOSS and it already supports detection against custom signatures and server side scanning using them. If they don't have DOS signatures, you should be able to build a set from your virus archive.

author: Rbastler
author_rank: Frequent Contributor
timestamp: August 08, 2017, 07:08:43 am
content: You say most anti virus Programms from big name companies dont detect them.Which anti virus does then detect them ?Sent from my A0001 using Tapatalk

author: Kryoclasm
author_rank: Regular Contributor
timestamp: August 08, 2017, 07:13:37 am
content: When 16bit applications were no longer supported.

author: Halcyon
author_rank: Unknown
timestamp: August 08, 2017, 08:56:48 am
content: Quote from: Rbastler on August 08, 2017, 07:08:43 am*shrug* I'm guessing older (unsupported) programs? VSafe, Old Mcafee versions?I do note though that Trend detects the oldJunkie virusbut only since 2000. I remember once we got that particular virus off a floppy disk back in the mid-1990's.

author: Jeroen3
author_rank: Super Contributor
timestamp: August 08, 2017, 09:52:00 am
content: Why do you need to detect virusses you cannot execute?

author: Halcyon
author_rank: Unknown
timestamp: August 08, 2017, 10:08:04 am
content: Quote from: Jeroen3 on August 08, 2017, 09:52:00 amI can, on old machines I own which connect to the same file server through a firewall.

author: Jeroen3
author_rank: Super Contributor
timestamp: August 08, 2017, 10:55:28 am
content: Yes, but on that machine you have a different version of antivirus, right?

author: Halcyon
author_rank: Unknown
timestamp: August 08, 2017, 11:49:38 am
content: Quote from: Jeroen3 on August 08, 2017, 10:55:28 amYes I can, but that should only be considered a "last resort" detection mechanism considering how outdated it is. All files should be deemed safe and infection free the moment they hit my network.I have run a few tests since which ESET has passed.

author: Jeroen3
author_rank: Super Contributor
timestamp: August 08, 2017, 01:06:07 pm
content: You still have the Windows 9x machine networked?

author: Mr. Scram
author_rank: Super Contributor
timestamp: August 08, 2017, 07:05:59 pm
content: Quote from: Halcyon on August 08, 2017, 10:08:04 amThe problem does not seem to be the lack of support, but the choice of having very old and unsupported OSs in your network. If you insist on having those, you will need to be very concious about the risk they pose and mitigate those appropriately. Regardless, the old systems will always be a weak spot and a possible point of entry.

author: Halcyon
author_rank: Unknown
timestamp: August 08, 2017, 08:16:42 pm
content: Quote from: Jeroen3 on August 08, 2017, 01:06:07 pmNot just Windows 9x but Windows 3.11 and MS-DOS machines. They are networked but in their own DMZ and only have very limited access to the internet (pretty much HTTP, HTTPS and FTP only). Internally, they only have limited access to the file server, but no other devices on the "trusted" LAN.

author: Ian.M
author_rank: Super Contributor
timestamp: August 08, 2017, 09:06:38 pm
content: Ah, the joys of MS-NET 3.0 Server running on a 386 under DOS 3.31. 40MB ST506 HDD, approx 7MB for the OS and utilities and a wopping great 32MB FAT16, 8.3 naming, data partition! Then you need NETBEUI protocol on all PCs that access it, and that was discontinued after Windows XP. OTOH it cant even see the internet because it doesn't have TCP/IP so the risks of having it on the same LAN as more modern systems is minimal.

author: stj
author_rank: Super Contributor
timestamp: September 11, 2017, 07:42:16 pm
content: windows XP runs DOS programs.safe solution is to not run windows.

author: Mr. Scram
author_rank: Super Contributor
timestamp: September 11, 2017, 08:07:19 pm
content: Quote from: stj on September 11, 2017, 07:42:16 pmThe only safe solution is not to run anything. The rare exceptions possibly being fully formally verified software, even though there are a few caveats there too.

author: Cyberdragon
author_rank: Super Contributor
timestamp: September 12, 2017, 07:22:43 am
content: Ask Dancoot1 on YouTube for a list of old viruses. Note, people still make viruses for old machines just for fun, and probably don't care if they accidentally release one into the wild of the internet because they think there are no host machines left to infect. That is, untill they seep through the internet and find your system as lunch!

author: Halcyon
author_rank: Unknown
timestamp: September 12, 2017, 07:47:16 am
content: Quote from: Cyberdragon on September 12, 2017, 07:22:43 amThat's the great thing about old systems, even if "connected to the internet" there is enough air gap in between the legacy gear and the modern stuff that it had no effect unless you deliberately introduce it to the system.

author: Mr. Scram
author_rank: Super Contributor
timestamp: September 12, 2017, 04:56:26 pm
content: Quote from: Halcyon on September 12, 2017, 07:47:16 amAn air gap and internet connection are mutually exclusive. Are you sure that's what you meant?

author: hendorog
author_rank: Super Contributor
timestamp: September 12, 2017, 07:22:55 pm
content: Quote from: Halcyon on September 12, 2017, 07:47:16 amHaha interesting point. So as OS's age they actually become safer (defined as less likely to be infected) - as they lose compatibility with modern malware.

author: Halcyon
author_rank: Unknown
timestamp: September 15, 2017, 06:44:16 am
content: Quote from: Mr. Scram on September 12, 2017, 04:56:26 pm"Air gap" can mean a number of different things. In what I was describing, while there is a physical connection, there are no protocols to support connectivity. As opposed to a physical break at the physical layer, you have one at the network layer.Another example of "air gap", is the conversion from a traditional copper conductor to optic fibre. You don't break connectivity but you break the electrical connection to eliminate things like surges or where network connectivity is required in locations such as Faraday rooms where traditional cables can act as pathway for unwanted RF.