From: broeker AT acp3bf DOT knirsch DOT de (Hans-Bernhard Broeker)
Newsgroups: comp.os.msdos.djgpp
Subject: Re: Not COFF
Date: 22 Oct 1999 15:18:11 +0200
Organization: RWTH Aachen, III. physikalisches Institut B
Lines: 33
Distribution: world
Message-ID: <7upo6j$3cn@acp3bf.knirsch.de>
References: <380F153B DOT 6034D333 AT arcticmail DOT com> <380F21D1 DOT 5CAD AT erols DOT com> <SGJP3.563$SS6 DOT 15142 AT dfiatx1-snr1 DOT gtei DOT net>
NNTP-Posting-Host: acp3bf.physik.rwth-aachen.de
X-Trace: nets3.rz.RWTH-Aachen.DE 940598294 14783 137.226.32.75 (22 Oct 1999 13:18:14 GMT)
X-Complaints-To: abuse AT rwth-aachen DOT de
NNTP-Posting-Date: 22 Oct 1999 13:18:14 GMT
X-Newsreader: TIN [version 1.2 PL2]
To: djgpp AT delorie DOT com
DJ-Gateway: from newsgroup comp.os.msdos.djgpp
Reply-To: djgpp AT delorie DOT com

Damian Yerrick (web DOT poison AT pineight DOT 8m DOT com) wrote:
[...]
> Perhaps someone should change "File not COFF" to "File infected or
> not COFF" to make the message a bit clearer.

No need to, as the current message already does that. The original
poster didn't quote it in full. The actual message text is:

	{Program name}: not COFF (Check for viruses)

If that message text isn't explicit enough to carry the idea across,
no other one will do, I suspect. Some people simply don't *want* to
believe that something like a virus could be happening to them...  It
once took me about half an hour of talking to convince the staff of
the PC store that there indeed was a virus on that unwritable VGA card
driver diskette they'd given me (5 1/4" disk, without any notch at
all). My scanner didn't even detect it clearly, yet, calling it a
suspected variant of another, known one. Turned out it was
'Michelangelo', which became rather famous later on, partly because it
*was* spread on 'factory-written' write-protected disks of various
kinds.

> So there aren't any COFF only viruses yet?

No DJGPP viruses, to be precise. Win32 PE viruses are COFF viruses,
technically spoken, but they won't usually work with DJGPP programs,
either.  Maybe DJGPP profits from 'securicy by obscurity', here. There
just aren't enough users of DJGPP-compiled programs for any virus
writer to view it as a useful population to plant a virus in, I
assume. So far.
-- 
Hans-Bernhard Broeker (broeker AT physik DOT rwth-aachen DOT de)
Even if all the snow were burnt, ashes would remain.