NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/comp/virus/4813

Internet Message Format | 1993-01-05 | 3.4 KB

Path: sparky!uunet!elroy.jpl.nasa.gov!usc!cs.utexas.edu!qt.cs.utexas.edu!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: [e-mail] (Kevin Andrew Buhr)
Newsgroups: comp.virus
Subject: Re: Viruses in OS/2 HPFS (OS/2)
Message-ID: <[e-mail]>
Date: 25 Dec 92 09:12:10 GMT
Sender: [e-mail]
Lines: 59
Approved: [e-mail]

[e-mail] (Brett J.L. Landry) writes:
|
|  There has been aa lot of talk about OS/2 not being able to be infected
|  from regular old DOS boot sector viruses using the HPFS. This is false
|  since regular old STONED can infect both logical and physical parttions
|  on OS/2 using HPFS.  Why wait for true OS/2 viruses when you can suffer
|  from regular DOS viruses.

Keep in mind there is at least one special consideration with respect
to OS/2 and the "Stoned" variety of viri, however.  Be forewarned that
the following is a mixture of real knowledge and a bit of deduction.
The deduction part might trip me up a bit, but I'm pretty sure most of
the details are accurate.

For one thing, if a boot sector virus infects your system on start up,
it won't survive the OS/2 startup process.  You may get the "Your
computer is stoned!" message, since this is displayed (randomly
approximately one out of every eight times in many cases) before the
operating system is loaded.  HOWEVER, OS/2's own floppy disk device
drivers will take control of the floppy drive away from the boot
sector virus.  The virus will be neutralized, and will not spread to
floppy disks.  This will be true whether you are using the HPFS or the
FAT file system.

(In special situations, the virus may remain in a "semi-active" state.
It will not be able to infect floppy disks, but it may still cause a
system crash when the virus is overwritten by OS/2.  See the note
below for more information on this.)

"Normal" DOS sessions you start under OS/2 will *not* contain copies
of the virus, because they are not "booted" in the normal sense.  Only
special "DOS from Drive A"-style sessions, which are booted from
floppies, could potentially become infected if the floppy was
infected.  Only in these cases would the virus be able to spread, and
it would only spread during floppy drive accesses in the infected DOS
sessions; accesses from other sessions would have no effect.

As mentioned above, there is a special case where the boot sector
could remain partially active and interfere with OS/2's operation.  To
allow OS/2 to work with special hard disk devices (like Bernoulli
drives, I understand), OS/2 can be set up to use the built-in BIOS
routines for disk control rather than its internal drivers.  I'm not
sure how OS/2 behaves in this situation (i.e. I don't know whether it
uses the value of the INT 13 vector or generates an address in a more
elementary manner), but it seems possible to me that OS/2 could
mistake the virus code for the BIOS disk routines.  In this case, OS/2
could attempt to operate the hard drive via the virus code.

Because of the way OS/2 handles memory management, when OS/2 attempts
to access the hard drive, the virus code will probably be "invisible".
As a result, the operating system will immediately trap and display an
error message.

In summary, the worst you can expect is your system simply not
working.  An infected OS/2 system generally won't infect new floppy
disks unless you use the special "DOS from Drive A" sessions with an
infected boot floppy.

Kevin <[e-mail]>