Return-Path: XPUM04@prime-a.central-services.umist.ac.uk Received: from G.SEI.CMU.EDU by ubu.cert.sei.cmu.edu (5.61/2.3) id AA04471; Wed, 20 Jun 90 17:19:18 -0400 Received: from SEI.CMU.EDU by g.sei.cmu.edu (5.61/2.5) id AA06952; Wed, 20 Jun 90 17:19:18 -0400 Received: from nsfnet-relay.ac.uk by sei.cmu.edu (5.61/2.3) id AA23069; Wed, 20 Jun 90 17:19:13 -0400 Received: from sun.nsfnet-relay.ac.uk by vax.NSFnet-Relay.AC.UK via Janet with NIFTP id aa22906; 20 Jun 90 16:16 BST From: Anthony Appleyard To: DAVIDF@cs.heriot-watt.ac.uk Date: Wed, 20 Jun 90 16:29:56 BST Message-Id: <$TGWGCZNQBTKW at UMPA> Subject: Virus-L vol 0 issue #1009 Virus-L Digest Sun, 9 Oct 88, Volume 0 : Issue #1009 Today's Topics disk-wide CRC program ------------------------------ Date: Sun, 9 Oct 88 18:52:56 EDT From: "James R. Van Zandt" Subject: disk-wide CRC program I have enhanced Ted H. Emigh's CRC program and posted it at SIMTEL20.ARMY.MIL. Here is the blurb... - -------------------------------------------------------------------- PD1:FILE-CRC.ARC FILECRC calculates CRCs for all files on a disk and records them in a file. COMPARE then compares two such files and reports differences, highlighting suspicious changes (file contents changed but creation date unchanged). Useful for spotting viral reproduction and/or damage. This ARC includes source code, executables, and documentation for both. Written by Ted H. Emigh, translated from Pascal to C and modestly enhanced by James R. Van Zandt . - -------------------------------------------------------------------- FILECRC was originally written to detect damage caused by a program run amok. I wanted to use it to detect intentional changes, so I have enhanced it to defeat some of the simpler antiprotection measures a virus or Trojan horse might attempt. FILECRC now calculates a CRC on its own code to detect possible changes, and calculates CRCs starting at an offset into each file. The offset is defined at compile time so it can be different for each installation. COMPARE reports files deleted as well as altered. SIMTEL20 accepts ANONYMOUS ftp logins with any password. - Jim Van Zandt -------------------- *** end of Virus-L issue ***