Rudy Velthuis schrieb in Nachricht <36b0996c.0@news.povray.org>...
>
>GrimDude schrieb in Nachricht <36afe9f6.0@news.povray.org>...


>>The worm can't bite what it can't write to.


>What you can do by hand, any program can do by code too. It's very simple
to
>reset a read-only attribute. So this is an almost non-existant defense.
>
>The Happy99 "worm" was not very sophisiticated, so it was easy to remove it
>(and to find out, what it does). Most viruses are much cleverer though
>(unfortunately).


Aha, now I know what you mean. This Happy worm doesn't reset the read-only
flag (yes, I studied the pages on www.avp.com) so it really can't write to a
write-protected wsock32.dll.

So this might work for this particular worm, but certainly not for all other
similar programs.

--
Rudy Velthuis

Post a reply to this message