On Thu, 20 Sep 2001 16:16:27 +0100, Joerg Dietze wrote:
> Hi Sam,
> code which causes a PC to reboot can theoretically be used to
> immediately bring up a boot virus. Perhaps this is the reason why people
> from F-Prot set up this warning.
> Regards Joerg
> -- Arachne V1.70, NON-COMMERCIAL copy, http://arachne.cz/
Besides BOOTC.COM I have three other programs that will reboot the
computer. These other programs were not flagged as destructive.
They are WARMBOOT.COM, COLDBOOT.COM, and BOOTW.COM. Running
BOOTC.COM or COLDBOOT.COM I believe is equivalent to hitting the
computer's reset button. Running WARMBOOT.COM or BOOTW.COM I
believe is equivalent to pressing CTRL-ALT-DELETE. Only BOOTC.COM
was flagged as a destructive program. The program does nothing bad
as far as I know. I have used it many times. Any one of these
programs could theoretically be used to immediately bring up a boot
virus.
BTW, I do know that F-PROT did actually examine the code in
BOOTC.COM. The program was not flagged just for reason of it's name.
If I rename the program to anything else it will still get flagged.
Are there any assembly language programmers out there who would like
a copy of the program so that you might examinine it and tell me
what could possibly be wrong with it? It is only a 16 byte program.
I am really curious to know what might possibly be wrong with it.
Sam Heywood
-- This mail was written by user of The Arachne Browser - http://arachne.cz/
