OLD perfect Virus protection

[ECA]

I used to have(on the amiga, and C64)
A Virus protection program that set checksums, on EVERY file. When the file was accessed, the VP would check the file and the checksum at the end to see if it was changed. This is a VERY long process to Start. But it worked VERY well. I havent seen A Virus prog, do this lately.
Whats NEET about it, was NO Virus, NEW or OLD could infect the system. Would be nice to do it NOW days, insted of getting NEW protection ALL the time, and you would ONLY pay for it ONCE. That may be the problem.

:sponge

[v8juice]

You poor thing, just living in the past...

[llbbl]

How were the checksums generated?

[ECA]

1, you COULDNT have a virus.
2. it ran a Algorythm thru EVERY file.
3. it added the checksum to the END of the file, and made a LIST that had all of them listed on it, alond with the NAME of the file for checking later.

This prog, took ALONG time to run, the first time. But, after that, you didnt have ANY problems.

[llbbl]

A full virus scan is a pretty complicated things these days. Using that method it would seem to be alot of overhead. It sounds like a combination of md5 and that program cleansweep. The problem is that we don't know exactly what the AV programs are doing when it scans through everything. It has to be more complicated than checking the name of the file against a list. I'm sure they do more than THAT.

[ECA]

Current V. progs, only ceck the files for certain codes. Its a fast process. And dont find NEW ones until its updated.. This is a fool proof method. And with current systems being do fast, it should take much.
I was on a C64 and it took ALOT of time. On the Amiga it was faster, but it STILL took time. we now have systems that are 100x's faster.

[llbbl]

I still think it would be too much of a pain because you would have to constantly monitor every file for when it is used and generate a new checksum each time it changes. There goes 30 - 50 % of your processor.

[ECA]

This program was made at a time when your OS, didnt CHANGE unless you did it.

And most of WINDOWS dont change that much except for a few files.

[llbbl]

Oh I see now, you are saying that now OS's spontaneously change without user input?


I think they use alot more files than you think. Every time you check your email it adds to one file. Every time you logon to trillian. Every time you run a program part of the information about that .exe changes.

[ruri]

A Virus protection program that set checksums, on EVERY file. When the file was accessed, the VP would check the file and the checksum at the end to see if it was changed

F-Prot has this feature, and it really did worked well back in the DOS 3.3 days.

Before a program is executed, F-prot would intercept it and compare the current checksum with the initial value that it calculated when the program was first run. If the checksum failed, the F-Prot will not allow it to run. The checksum was a MOD function if I recall correctly; it didn't calculate a hash function like MD5, though I could be wrong...

Unfortunately, F-Prot can only intercept executable files, not .DLL and certainly not macro viruses that run within another program (like Excel or Outlook).

You can still get F-Prot for DOS, but I don't think it will work too well under Windows.

[ECA]

Would be nice to run under windows. be nice if they went back to that format... It worked, VERY well. But as you say, windows likes to CHANGE things, esp, with itself.

[llbbl]

Originally posted by ECA
Would be nice to run under windows. be nice if they went back to that format... It worked, VERY well. But as you say, windows likes to CHANGE things, esp, with itself.

Its not that windows is bad because it does this. You can't go back to old technology and expect the new systems to conform to the methods exactly. You have to develop new methods based on your project goals tailored to the updated software and hardware. I'm not saying that you utilize old techniques if they can be adapted to work in the new enviroment.