Internet Surfer 2.0/Internet Surfer 2.0 (Wayzata Technology) (1996).iso/pc/text/mac/faqs.020

Text File | 1996-02-12 | 29KB | 641 lines

Frequently Asked Questions (FAQS);faqs.020




E9) Some people say that disinfecting files is a bad idea.  Is that
    true?

Disinfecting a file is completely "safe" only if the disinfecting
process restores the non-infected state of the object completely.  That
is, not only the virus must be removed from the file, but the original
length of the file must be restored exactly, as well as its time and
date of last modification, all fields in the header, etc.  Sometimes
it is necessary to be sure that the file is placed on the same
clusters of the disk that it occupied prior to infection.  If this is
not done, then a program which uses some kind of self-checking or
copy protection may stop functioning properly, if at all.

None of the currently available disinfecting programs do all this.
For instance, because of the bugs that exist in many viruses, some of
the information of the original file is destroyed and cannot be
recovered. Other times, it is even impossible to detect that this
information has been destroyed and to warn the user.  Furthermore,
some viruses corrupt information very slightly and in a random way
(Nomenklatura, Phoenix), so that it is not even possible to tell which
files have been corrupted.

Therefore, it is usually better to replace the infected objects with
clean backups, provided you are certain that your backups are
uninfected (see D10).  You should try to disinfect files only if they
contain some valuable data that cannot be restored from backups or
compiled from their original source.


E10) Can I avoid viruses by avoiding shareware/free software/games?

No.  There are many documented instances in which even commercial
"shrink wrap" software was inadvertently distributed containing
viruses.  Avoiding shareware, freeware, games, etc. only isolates you
from a vast collection of software (some of it very good, some of it
very bad, most of it somewhere in between...).

The important thing is not to avoid a certain type of software, but to
be cautious of ANY AND ALL newly acquired software.  Simply scanning
all new software media for known viruses would be rather effective at
preventing virus infections, especially when combined with some other
prevention/detection strategy such as integrity management of
programs.


E11) Can I contract a virus on my PC by performing a "DIR" of an
     infected floppy disk?

If you assume that the PC you are using is virus free before you
perform the DIR command, then the answer is no.  However, when you
perform a DIR, the contents of the boot sector of the diskette are
loaded into a buffer for use when determining disk layout etc., and
certain anti-virus products will scan these buffers.  If a boot sector
virus has infected your diskette, the virus code will be contained in
the buffer, which may cause some anti-virus packages to give the
message "xyz virus found in memory, shut down computer immediately".
In fact, the virus is not a threat at this point since control of the
CPU is never passed to the virus code residing in the buffer.  But,
even though the virus is really not a threat at this point, this
message should not be ignored.  If you get a message like this, and
then reboot from a clean DOS diskette and scan your hard-drive and
find no virus, then you know that the false positive was caused by the
fact that the infected boot-sector was loaded into a buffer, and the
diskette should be appropriately disinfected before use.  The use of
DIR will not infect a clean system, even if the diskette it is being
performed on does contain a virus.


E12) Is there any risk in copying data files from an infected floppy
    disk to a clean PC's hard disk?

Assuming that you did not boot or run any executable programs from the
infected disk, the answer is generally no.  There are two caveats: 1)
you should be somewhat concerned about checking the integrity of these
data files as they may have been destroyed or altered by the virus,
and 2) if any of the "data" files are interpretable as executable by
some other program (such as a Lotus macro) then these files should be
treated as potentially malicious until the symptoms of the infection
are known.  The copying process itself is safe (given the above
scenario).  However, you should be concerned with what type of files
are being copied to avoid introducing other problems.


E13) Can a DOS virus survive and spread on an OS/2 system using the
     HPFS file system?

Yes, both file-infecting and boot sector viruses can infect HPFS
partitions.  File-infecting viruses function normally and can activate
and do their dirty deeds, and boot sector viruses can prevent OS/2
from booting if the primary bootable partition is infected.  Viruses
that try to directly address disk sectors cannot function because OS/2
prevents this activity.


E14) Under OS/2 2.0, could a virus infected DOS session infect another
    DOS session?

Each DOS program is run in a separate Virtual DOS Machine (their
memory spaces are kept separated by OS/2).  However, any DOS program
has almost complete access to the files and disks, so infection can
occur if the virus infects files; any other DOS session that executes
a program infected by a virus that makes itself memory resident would
itself become infected.

However, bear in mind that all DOS sessions share the same copy of the
command interpreter.  Hence if it becomes infected, the virus will be
active in *all* DOS sessions.


E15) Can normal DOS viruses work under MS Windows?

Most of them cannot.  A system that runs exclusively MS Windows is,
in general, more virus-resistant than a plain DOS system.  The reason
is that most resident viruses are not compatible with the memory
management in Windows.  Furthermore, most of the existing viruses will
damage the Windows applications if they try to infect them as normal
EXE files.  The damaged applications will stop working and this will
alert the user that something is wrong.

However, virus-resistant is by no means virus-proof.  For instance,
most of the well-behaved resident viruses that infect only COM files
(Cascade is an excellent example), will work perfectly in a DOS
window.  All non-resident COM infectors will be able to run and infect
too.  And currently there exists at least one Windows-specific virus
which is able to properly infect Windows applications (it is
compatible with the NewEXE file format).

Any low level trapping of Interrupt 13, as by resident boot sector and
MBR viruses, can also affect Windows operation, particularly if
protected disk access (32BitDiskAccess=ON in SYSTEM.INI) is used.


=========================================
= Section F.    Miscellaneous Questions =
=========================================

F1) How many viruses are there?

It is not possible to give an exact number because new viruses are
being created literally every day.  Furthermore, different anti-virus
researchers use different criteria to decide whether two viruses are
different or one and the same.  Some count viruses as different if
they differ by at least one bit in their non-variable code.  Others
group the viruses in families and do not count the closely related
variants in one family as different viruses.

Taking a rough average, as of October 1992 there were about 1,800 IBM
PC viruses, about 150 Amiga viruses, about 30 Macintosh viruses, about
a dozen Acorn Archimedes viruses, several Atari ST viruses, and a few
Apple II viruses.

However, very few of the existing viruses are widespread.  For
instance, only about three dozen of the known IBM PC viruses are
causing most of the reported infections.


F2) How do viruses spread so quickly?

This is a very complex issue.  Most viruses don't spread very quickly.
Those that do spread widely are able to do so for a variety of
reasons.  A large target population (i.e., millions of compatible
computers) helps...  A large virus population helps...  Vendors whose
quality assurance mechanisms rely on, for example, outdated scanners
help...  Users who gratuitously insert new software into their systems
without making any attempt to test for viruses help...  All of these
things are factors.


F3) What is the plural of "virus"?  "Viruses" or "viri" or "virii" or...

The correct English plural of "virus" is "viruses."  The Latin word is
a mass noun (like "air"), and there is no correct Latin plural.
Please use "viruses," and if people use other forms, please don't use
VIRUS-L/comp.virus to correct them.


F4) When reporting a virus infection (and looking for assistance), what
    information should be included?

People frequently post messages to VIRUS-L/comp.virus requesting
assistance on a suspected virus problem.  Quite often, the information
supplied is not sufficient for the various experts on the list to be
able to help out.  Also note that any such assistance from members of
the list is provided on a volunteer basis; be grateful for any help
received.  Try to provide the following information in your requests
for assistance:
        - The name of the virus (if known);
        - The name of the program that detected it;
        - The version of the program that detected it;
        - Any other anti-virus software that you are running and
whether it has been able to detect the virus or not, and if yes, by
what name did it call it;
        - Your software and hardware configuration (computer type,
kinds of disk(ette) drives, amount of memory and configuration
(extended/expanded/conventional), TSR programs and device drivers
used, OS version, etc.)

It is helpful if you can use more than one scanning program to
identify a virus, and to say which scanner gave which identification.
However, some scanning programs leave "signatures" in memory which
will confuse others, so it is best to do a "cold reboot" between runs
of successive scanners, particularly if you are getting confusing
results.


F5) How often should we upgrade our anti-virus tools to minimize
    software and labor costs and maximize our protection?

This is a difficult question to answer.  Antiviral software is a kind
of insurance, and these type of calculations are difficult.

There are two things to watch out for here: the general "style" of the
software, and the signatures which scanners use to identify viruses.
Scanners should be updated more frequently than other software, and it
is probably a good idea to update your set of signatures at least once
every two months.

Some antiviral software looks for changes to programs or specific
types of viral "activity," and these programs generally claim to be
good for "all current and future viral programs."  However, even these
programs cannot guarantee to protect against all future viruses, and
should probably be upgraded once per year.

Of course, not every anti-virus product is effective against all
viruses, even if upgraded regularly.  Thus, do *not* depend on the
fact that you have upgraded your product recently as a guarantee that
your system is free of viruses!


=====================================================================
= Section G.    Specific Virus and Anti-viral software Questions... =
=====================================================================


G1) I was infected by the Jerusalem virus and disinfected the infected
    files with my favorite anti-virus program.  However, Wordperfect
    and some other programs still refuse to work.  Why?

The Jerusalem virus and WordPerfect 4.2 program combination is an
example of a virus and program that cannot be completely disinfected
by an anti-virus tool.  In some cases such as this one, the virus will
destroy code by overwriting it instead of appending itself to the
file.  The only solution is to re-install the programs from clean
(non-infected) backups or distribution media.  (See question D10.)


G2) I was told that the Stoned virus displays the text "Your PC is now
    Stoned" at boot time.  I have been infected by this virus several
    times, but have never seen the message.  Why?

The "original" Stoned message was ".Your PC is now Stoned!", where the
"." represents the "bell" character (ASCII 7 or "PC speaker beep").
The message is displayed with a probability of 1 in 8 only when a PC is
booted from an infected diskette.  When booting from an infected hard
disk, Stoned never displays this message.

Recently, versions of Stoned with no message whatsoever or only the
leading bell character have become very common.  These versions of
Stoned are likely to go unnoticed by all but the most observant, even
when regularly booting from infected diskettes.

Contrary to some reports, the Stoned virus -does NOT- display the
message "LEGALISE MARIJUANA", although such a string is quite clearly
visible in the boot sectors of diskettes infected with the "original"
version of Stoned in "standard" PC's.


G3) I was infected by both Stoned and Michelangelo.  Why has my
    computer became unbootable?  And why, each time I run my favorite
    scanner, does it find one of the viruses and say that it is
    removed, but when I run it again, it says that the virus is still
    there?

These two viruses store the original Master Boot Record at one and the
same place on the hard disk.  They do not recognize each other, and
therefore a computer can become infected with both of them at the same
time.

The first of these viruses that infects the computer will overwrite
the Master Boot Record with its body and store the original MBR at a
certain place on the disk.  So far, this is normal for a boot-record
virus.  But if now the other virus infects the computer too, it will
replace the MBR (which now contains the virus that has come first)
with its own body, and store what it believes is the original MBR (but
in fact is the body of the first virus) AT THE SAME PLACE on the hard
disk, thus OVERWRITING the original MBR.  When this happens, the
contents of the original MBR are lost.  Therefore the disk becomes
non-bootable.

When a virus removal program inspects such a hard disk, it will see
the SECOND virus in the MBR and will try to remove it by overwriting
it with the contents of the sector where this virus normally stores
the original MBR.  However, now this sector contains the body of the
FIRST virus.  Therefore, the virus removal program will install the
first virus in trying to remove the second.  In all probability it
will not wipe out the sector where the (infected) MBR has been stored.

When the program is run again, it will find the FIRST virus in the
MBR.  By trying to remove it, the program will get the contents of the
sector where this virus normally stores the original MBR, and will
move it over the current (infected) MBR.  Unfortunately, this sector
still contains the body of the FIRST virus.  Therefore, the body of
this virus will be re-installed over the MBR ad infinitum.

There is no easy solution to this problem, since the contents of the
original MBR is lost.  The only solution for the anti-virus program is
to detect that there is a problem, and to overwrite the contents of
the MBR with a valid MBR program, which the anti-virus program will
have to carry with itself.  If your favorite anti-virus program is not
that smart, consider replacing it with a better one, or just boot from
a write-protected uninfected DOS 5.0 diskette, and execute the program
FDISK with the option /MBR.  This will re-create the executable code
in the MBR without modifying the partition table data.

In general, infection by multiple viruses of the same file or area is
possible and vital areas of the original may be lost.  This can make
it difficult or impossible for virus disinfection tools to be
effective, and replacement of the lost file/area will be necessary.

====================
[End of VIRUS-L/comp.virus FAQ]

Xref: bloom-picayune.mit.edu comp.os.mach:2528 news.answers:3092
Path: bloom-picayune.mit.edu!mintaka.lcs.mit.edu!olivea!spool.mu.edu!darwin.sura.net!zaphod.mps.ohio-state.edu!cis.ohio-state.edu!news.sei.cmu.edu!po1!boone
From: [e-mail] (Jon Boone)
Newsgroups: comp.os.mach,news.answers
Subject: comp.os.mach.FAQ
Message-ID: <[e-mail]>
Date: 22 Sep 92 01:45:54 GMT
Expires: Mon, 2 Nov 1992 00:00:00 GMT
Reply-To: [e-mail]
Followup-To: comp.os.mach
Organization: Pittsburgh SuperComputing Center, Pittsburgh, PA, USA
Lines: 277
Approved: [e-mail]
Supersedes: <[e-mail]>


Archive-name: comp-os-mach-faq

-----               COMP.OS.MACH FREQUENTLY ASKED QUESTIONS (FAQ)         +++++
+++++                    maintained by Jon "Iain" Boone                   -----
-----                 send any additions and/or correctionst to           +++++
+++++                         [e-mail]                        -----

Sometimes a question you have is asked so often that many people who
have been following a group for a while know the answer and asking the
question might generate an unusually large number of replies.  In
order to save net.bandwidth as well as to provide a usefull source of
answers for some of the more basic questions, the following list of
Frequently Asked Questions is presented.

1) Where can I get a release of Mach for my machine?
2) What 386/486 boards does Mach 3.0 run on?
3) How easy is it to install MACH?
4) What about NeXT OS?
5) What about OSF/1?
6) What about the GNU HURD?
7) What are some books I can read to find out about MACH?
8) When will the 4.4 BSD Unix single server be ready?

ANSWERS:

1) Where can I get a release of Mach for my machine?

   MACH 3.0:

        This is only the micro-kernel - no filesystem, no ttys, no
        nothing. To get the rest, you need to have some type of source
        license for BSD -> which implies a source license from AT&T .

        The sources for the Mach 3.0 distribution can be obtained via
        uucp, ftp, sup and afs.  In order to recieve them via uucp, the
        normal uunet mechanism for retrieving source or call 1-900-GOT-SRCS
        (login ``uucp'' - no passwd) and retrieve files with the uucp
        command - the cost is $0.40(US) per minute on your phone bill.  For
        questions about the uunet service, send them to [e-mail].

        The preferred method of distribution is via a program called SUP.
        If you use SUP, you can retrieve files which require a AT&T
        license, which you can not get through either uucp, ftp or afs.  To
        find out more about SUP, send mail to [e-mail].

        You can get the sources and other interesting info over afs from
        the directory /afs/cs.cmu.edu/project/mach/public/src.

        The same sources can be obtained via anonymous ftp from the
        following places:

        US:

          username:anonymous
          passwd:  <name>@<site>

             cmu: mach.cs.cmu.edu (128.2.209.192) in /usr/mach/public/src
             uunet: ftp.uu.net (137.39.1.2) in packages/mach

        JAPAN:

          username:ftp
          passwd:  YOUR EMAIL ADDRESS

             sh.wide.ad.jp (133.4.11.11) in MACH
             ftp.dit.co.jp (133.156.1.1) in pub/MACH
             ftp.mei.co.jp (132.182.49.2) in mach
             ftp.cs.titech.ac.jp (131.112.16.39)

        FINLAND:

           username:anonymous
           passwd:<name>@<site>

             nic.funet.fi (128.214.6.100) in pub/mach/Mach3.0


        Mary Thompson <[e-mail]> writes:

          Both docmuments and sources for Mach are now available from the
        same machine and subdirectory. To find out what is available use
        the following instructions:

          Ftp to mach.cs.cmu.edu (128.2.209.192), as "anonymous", at the
        password prompt send your Username@site (you must include the "@"
        or the login will fail).  Then "cd /usr/mach/public".  You can then
        use the standard ftp commands, e.g. get, ls with relative path
        names for the files.

          The FAQ directory contains answers to frequently asked questions.
        The doc dirctory (and its subdirectories) contain technical reports
        and some papers. The src directory contains the part of the Mach
        3.0 kernel sources that are available without licenses The sup
        directory has sources and docmumentation for our Software Update
        Protocol program. The conferences directory has annoucements of
        up-coming conferences or courses pertaining to Mach.


   MACH 2.5:

           A Mach 2.5 distribution is available for the IBM RT, PC-AT
           clones, Vaxen and Sun3's from Mt. Xinu.  This is a complete
           source distribution including a BSD 4.3-tahoe utility set.
           This requires an AT&T source license.

           Mt. Xinu also has a product known as Mach386, which runs on
           PC-AT clones (386, 486 or 386SX cpu).  It is a binary-only
           distribution which contains ``Mach 2.5 kernel and
           utilities'', ``4.3 BSD interface'', ``GNU utilities (GCC,
           GDB, GAS, EMACS,BISON)'' and ``on-line reference manuals
           (man pages) for Mach and 4.3 BSD.''  Optional modules for
           Networking, X and On-line Documentation (source) are
           available. Mt. Xinu claims that it runs on ``most of the
           common AT-bus IBM PCs and compatibles such as Compaq,
           Intel, Olivetti, Toshiba and Hewlett-Packard.''  The X11 is
           a complete R4, including 8-bit color and support for many
           extended VGA cards, basedon the work by Roell.

           For further information, contact [e-mail]
           (email) or 1+(510)-644-0146.

           Tenon Intersystems has a product known as MachTen.  MachTen is
           an implementation of Berkeley's 4.3BSD Unix, built on a Carnegie
           Mellon Mach 2.5 foundation.  MachTen runs as an application on
           the native Macintosh Operating System (MacOS). Included with
           MachTen are Unix programs and a Mach kernel.  The kernel
           supports a standard Unix applications environment which includes
           over 300 standard Unix applications.  That environment also
           allows all standard Macintosh programs, such as a Macintosh
           spreadsheet or desk accessory application, to run simultaneously
           with Unix programs.  MachTen extends MacOS with true Unix
           multitasking, full internet communications, a distributed file
           system via NFS, and a Unix software development environment.
           MachTen does not currently support Macintosh System 7, but
           support for System 7 will be available early in 1992 as a free
           upgrade.  MachTen runs on all modern Macintoshes, MacPlus
           through Mac IIfx.

           For further information, contact [e-mail] (email) or
           1+[phone].


2) What 386/486 boards does Mach 3.0 run on?

     George Scott <[e-mail]> writes:

        Gateway 486/33 (works great with factory hardware)
           Micronics motherboard

        AT&T 6386WGS (factory ESDI hard drive controller does not work!)
           Olivetti/AT&T proprietary


3) How easy is it to install MACH?

4) What about NeXT OS?

     Avie Tevanian of NeXT writes:

     NeXT started with the Mach 2.0 sources and have picked up most of the
     Mach 2.5 and beyond kernel fixes, except for external pagers. The NeXT
     environment includes all of Unix and goes well beyond  supporting
     object oriented programs and lots of fancy graphics.

     It is possible to get the machine-independent kernel sources as well
     as all the library and environment sources from NeXT. Only the
     machine-dependent sources such as device drivers are unavailable.

     From Carrick Talmadge
     [e-mail]

     The latest NeXT price lists reportedly shows:

     N5515   NeXT 2.0 Mach Source Release on Floppies   $10,000
            [$5000 for educational institutions].

     I am led to understand that this includes the various licensing fees.

5) What about OSF/1?

     The Open Software Foundation releases a version of Mach that starts
     from the Mach 2.5 kernel sources. They incorporated the University of
     Guelph's NFS implementation and have expanded the user environment
     from straight BSD4.3 to include some System V features and Motif.

     From: Nick dokos <[e-mail]>

     Grace Perez has left OSF, so sending mail to [e-mail] won't work.

     For more information on pricing, availability etc. of OSF/1, contact
     OSF Direct Channels, [e-mail], [phone].

     From: Joseph Boykin <[e-mail]>

     OSF distributes and supports two source platforms:
     The Encore Multimax and DecStation 3100.

     They also distribute a number of "contributed ports".  That is,
     companies which have done ports of OSF/1 to various architectures and
     are willing to ship it, but which OSF does not support.  The OSF/1
     tape includes support for:

        HP/Apollo's 68030 (Dn2500)
        i860
        Clipper (Series 6000 workstation w/C300 processor)

     OSF will ship a 386 version, but they're still working on it.

6) What about the GNU HURD?

   From Michael I Bushnell <[e-mail]>:

     The GNU Hurd (`Hurd' is an acronym, but its meaning is not public
   yet) [Hurd has subsequently been defined as a set of mutually recursive
   acronyms:  Hurd stands for "Hird of Unix-Replacing Daemons" and Hird
   stands for Hurd of Interfaces Representing Depth" - iain ] is a set of
   servers which, in combination with the GNU C Library, will provide Posix
   and BSD functionality on top of the Mach 3.0 microkernel.  The initial
   target is the i386, with the pmax probably following shortly thereafter.
   The Hurd is still in development, but those interested in discussing
   various aspects of it are welcome to join the hurd-folks mailing list.
   To join the list or find out how to get the current sources, send mail
   to [e-mail].

     Right now there is not a lot of work that can be done by people
   outside the FSF, but those who are interested in having the Hurd
   ultimately run on their machine would help a lot by writing free
   ports of the 3.0 microkernel.  Contact [e-mail] for
   information on doing this; CMU coordinates these efforts.

                -mib


7) What are some books I can read to find out about MACH?

   Information about Mach can be found in the following books:
   --------------------------------------------------------

   Operating Systems Concepts
   A. Silberschatz, J.L Peterson, P.B. Galvin
   Addison-Wesley Publishing Company, 3rd Edition 1991

   Chapter 16, pages 597-628 is about Mach.
   --------------------------------------------------------

   Distributed Operating Systems: The Logical Design
   A. Goscinski
   Addison-Wesley Publishers., 1991

   Chapter 14.8, pages 864-888 is about Mach
   -------------------------------------------------------

   Not out yet, but promised

   The Design of the Mach Operating system
   N. Bitar, A. Langermann and E. Sheinbrood
   to be published by Prentice-Hall.

   --------------------------------------------------------

8) When will the 4.4 BSD Unix single server be ready?

   CMU is working on a 4.4 BSD Unix single server to run under MACH
   3.0.  Currently, it is scheduled for release in the late spring.







/*****************************************************************************/
/* Jon Boone  Network Systems Administrator Pittsburgh Supercomputing Center */
/* [e-mail]  [e-mail]   I'm a member of the LPF, how 'bout you?    */
/*    I don't speak for anyone other than myself, unless otherwise stated.   */
/*****************************************************************************/
Xref: bloom-picayune.mit.edu rec.crafts.textiles:2934 alt.sewing:5643 rec.org.sca:32687 news.answers:4581
Path: bloom-picayune.mit.edu!enterpoop.mit.edu!think.com!spool.mu.edu!uunet!ogicse!news.u.washington.edu!uw-beaver!cornell!alg
From: [e-mail] (Anne Louise Gockel)
Newsgroups: rec.crafts.textiles,alt.sewing,rec.org.sca,news.answers
Subject: Historical Costuming FAQ
Summary: Lists of sources for patterns and supplies for historical costuming.
    Bibliography of relevant books.  Info relevant to SCA periods (600 AD
    to 1600 AD) and Civil War.  Some pointers to Historical Reenactment
    groups.
Keywords: FAQ, historical costuming, sewing, textiles, books, patterns, sources
Message-ID: <[e-mail]>
Date: 14 Dec 92 12:45:45 GMT
Article-I.D.: cs.1992Dec14.124545.14149
Expires: Sun, 14 Feb 1993 05:00:00 GMT
Sender: [e-mail] (Anne Louise Gockel)
Reply-To: [e-mail]
Followup-To: rec.crafts.textiles
Organization: Cornell Univ. CS Dept, Ithaca NY 14853
Lines: 791
Approved: [e-mail]
Supersedes: <[e-mail]>