In <[EMAIL PROTECTED]>, on 10/12/98 at 01:12 PM, " Raymond A. Ingles" <[EMAIL PROTECTED]> said:
>On Mon, 12 Oct 1998, Helge Hafting wrote: [included deleted] >> A boot virus could spread during boot (i.e. infect other partitions and >> floppies) while LILO load the kernel. The virus would end as soon as the >> kernel loads, and would be unable to mess with linux executables. Linux >> might still boot if the virus doesn't try to mess with the kernel being >> loaded. > That last part is tricky, though, from what I hear. I've never heard of >a boot sector virus that didn't assume that what was on the MBR was a >standard DOS/Win boot sector. Since they don't expect LILO, they tend to >trash it pretty thoroughly. LILO's actually reputed to be a halfway >decent virus detector that way. :-> The MBR doesn't have a dos/win boot sector, it has a program that load the boot sector from some partition. LILO in the MBR will be different from this too of course. Some boot viruses, wether they use the MBR or a partition do their trick work by copying the entire boot sector somewhere else and execute it after doing their dirty work (spreading, installing interrupt handlers,...) That might work with the linux boot process. Those that tries to coexist with the os boot loader will of course not work with lilo. So there may be a few viruses capable of spreading during a lilo run. Helge Hafting
