Date:	Tue, 4 Aug 1998 20:04:10 +0200
From:	Hans-Bernhard Broeker <broeker AT physik DOT rwth-aachen DOT de>
Message-Id:	<199808041804.UAA07221@acp3bf.physik.rwth-aachen.de>
To:	djgpp AT delorie DOT com
Subject:	DJGPP vs. Viruses (was Re: Not COFF...)
Newsgroups:	comp.os.msdos.djgpp
Organization:	RWTH Aachen, III. physikalisches Institut B

Hello everyone

From article <V3%v1.1245$Tz1 DOT 2440756 AT nntpserver DOT swip DOT net>:
> I get the error message 'Not COFF: check for viruses' every time I try to
> execute a djgpp program. I'm sure it has nothing to do with viruses!!
> After recompiling and remaking the program it works fine, for a while - that
> is until I restart the computer.
[...]

Well, just so you know: I exchanged some emails with the author of
this problem, and, as I had expected, it *was* a virus. A moderately
old one, actually, known since January this year. He claimed that none
of his virus scanners had found it. Make up your own minds what that
says about using a virus scanner (or its database) that's older than,
say, 4 weeks...

The 'restart the computer, and it stops working' business was due to
the fact that the virus he had was a Win9x one, which does infect DOS
.exe files, but goes memory-resident via Winblows.

This is the second time now I've had to diagnose a virus after someone
had claimed to be certain his computer was clean, but they still got
the 'Not COFF: check for viruses' message from DJGPP programs. The
first time, it actually was a brand-new virus. So new indeed that the
author could still be hunted down and held responsible for his deeds.

This means DJGPP leads by 2:0 now, at the very minimum: two hits, and
no false alarms I ever heard of.

So, closing this, let me advise all of you to take this kind of
message from DJGPP programs _very_ seriously, _every_ time. 'Thou hast
been warned'

--
Hans-Bernhard Broeker (broeker AT physik DOT rwth-aachen DOT de)
Even if all the snow were burnt, ashes would remain.

- Raw text -