On Mon, 12 Oct 1998, Helge Hafting wrote: > In <[EMAIL PROTECTED]>, on 10/09/98 > at 01:16 PM, " Raymond A. Ingles" <[EMAIL PROTECTED]> said: > > [...] > > No, a boot-sector virus essentially runs under the BIOS. This *can* > >infect a Linux machine but I find it difficult to believe that Linux > >would still boot in such a circumstance. > > A boot virus could spread during boot (i.e. infect other partitions and > floppies) while LILO load the kernel. The virus would end as soon as the > kernel loads, and would be unable to mess with linux executables. Linux > might still boot if the virus doesn't try to mess with the kernel being > loaded.
That last part is tricky, though, from what I hear. I've never heard of a boot sector virus that didn't assume that what was on the MBR was a standard DOS/Win boot sector. Since they don't expect LILO, they tend to trash it pretty thoroughly. LILO's actually reputed to be a halfway decent virus detector that way. :-> Sincerely, Ray Ingles (248) 377-7735 [EMAIL PROTECTED] "One of the main reasons for the downfall of the Roman Empire was that, lacking zero, they had no way to indicate successful termination of their C programs." - Robert Firth