On Thu, 07 Aug 2008 08:56:40 +0100, Invisible wrote:

>>> Well it's a lot safer than "keeping a collection of real viruses for
>>> test purposes". ;-)
>> 
>> Depends on what you want to test.  I was using it to test virus
>> interaction with software; the Eicar test file isn't particularly
>> useful for that.
> 
> Surely this is going to vary arbitrarily for each individual virus?

Not necessarily.  In my example of running WordPerfect from a networked 
drive, the problem was reproducible every time.  Infect machine, start up 
WP, start doing work, WP starts creating massive temporary files on the 
network drive until the space is used up.

Similarly, we had write-protected boot diskettes for the machines, but 
the lab assistants would re-enable write by taping over the hole (3.5" 
diskettes, we'd remove the write protect tabs on the boot diskettes) so 
the diskette would get infected.  Warm boot infected machine with write 
protected diskette, you'd get a "write error" on boot every time.  The 
virus was actually coded to intercept a warm boot and keep itself in 
memory while actually rebooting the machine, then would try to write 
itself out to the boot diskette in order to spread.

Really strange to get a write protect error before DOS seemingly started 
up.

Jim

Post a reply to this message