Hi Thomas:
There are some parts of your e-mail that I can't understand but I believe you try to give some kind of solution. And yes I think is correct at some point, I was wondering once about that, to do the same with native applications as for example what is done with java applets running in the browser. Containing them to some set of files. I think that yes it would be good to prevent applications corrupting other files and such things. And in fact could be great for advanced users But ...
1 - That is not a solution for viruses, there are kernel mode virus and trojans I wonder how that can get there. At the end human intelligence can't be stopped that easy and of course the opposite also happens, ignorance could be huge. I wonder how a virus like the I love you that can be written in a couple of minutes could spread that far. Believe me that won't work.
2 - That should not be enabled by default, sometimes if you present a password to users they will get lost. That happened to some users that switched from win98 to an NT based one. That was news, and was true. With the solution you propose there will be a lot that will press the Yes. Eh I even know ppl that click whatever they please when a message box appears.
Regards
Waldo
________________________________
De: ros-dev-bounces(a)reactos.com en nombre de Thomas Larsen
Enviado el: jue 11/25/2004 12:42
Para: ReactOS Development List
Asunto: RE: [ros-dev] ReactOS and Viruses
Hi why would it be a could a idea simply becures we eliminate a lot of old viruses but we could
allso make a function theire hold all exe files from execute when they contain some strange
command f.eks the delete or format funtion or some other stuff or some kind of database and the
send a signal out
Maybe
Reactos->MaybeVirusFile(Filename,Path);
VirusApps<-TestingFile(Filename,Path);
Ekstra Idea:
And a funtion to Stop new apps from run (REGEDIT RUNAPPS etc.)
Some New viruses use that way to start all the time and the user could be asked
NEW APP STARTING UP
RUN THE APP [X] DISMISS THE APP [ ] VIRUS TEST APP [ ]
Information about file
NEWER SHOW AGAIN [X]
And then make a group of apps that run i secure mode FOLDER SECURERUN
and then make a group of apps that run i unsecure mode FOLDER UNSECURERUN
So those in SECURE can´t change the reg and delete file e.g.
don´t know just and idea
but think people should care more about getting reactos to work...
Thomas
>>Hi Rick:
>Well I don't believe that would be a protection at all against viruses. Why?
>If I where to write a virus and knowing that reactos has such protection that would not stop me
at
>all. I could simply write a function to calculate the hash in the virus (or simply tell the OS to
>do it for me) and update such database. Look at windows file protection, virus laugh at it. I
>think the verification of the PE checksum is enough to tell if a file is corrupt and would be
>faster
>wich means a faster load. If you want to know some more about viruses look for the e-zines of 29A
>on the internet to find out more about the subject. Their articles are as advanced as those in
Waldo
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
_______________________________________________
Ros-dev mailing list
Ros-dev(a)reactos.com
http://reactos.com:8080/mailman/listinfo/ros-dev
Please add the following files to the bootcd:
lib\dnsapi\dnsapi.dll 1
lib\iphlpapi\iphlpapi.dll 1
lib\rpcrt4\rpcrt4.dll 1
lib\ole32\ole32.dll 1
This fixes the reboot loop FloFri was seeing with current cvs bootcds.
(ntuser/desktop.c:499) CreateDesktop: Screen-Saver
(NTDLL:ldr/utils.c:2018) Failed to create or open dll section of
'dnsapi.dll' (Status c0000135)
(NTDLL:ldr/utils.c:1357) failed to load dnsapi.dll
(NTDLL:ldr/utils.c:1819) failed to load dnsapi.dll
(NTDLL:ldr/utils.c:2085) LdrFixupImports failed for ws2_32.dll, status=c0000135
(NTDLL:ldr/utils.c:1357) failed to load ws2_32.dll
(NTDLL:ldr/utils.c:1819) failed to load ws2_32.dll
(NTDLL:ldr/utils.c:2085) LdrFixupImports failed for iphlpapi.dll,
status=c0000135
(NTDLL:ldr/utils.c:1357) failed to load iphlpapi.dll
(NTDLL:ldr/utils.c:1819) failed to load iphlpapi.dll
(NTDLL:ldr/utils.c:2085) LdrFixupImports failed for rpcrt4.dll, status=c0000135
(NTDLL:ldr/utils.c:1357) failed to load rpcrt4.dll
(NTDLL:ldr/utils.c:1819) failed to load rpcrt4.dll
(NTDLL:ldr/utils.c:2085) LdrFixupImports failed for ole32.dll, status=c0000135
(NTDLL:ldr/utils.c:1357) failed to load ole32.dll
(NTDLL:ldr/utils.c:1819) failed to load ole32.dll
(NTDLL:ldr/utils.c:1941) LdrFixupImports() failed for setup.exe
(NTDLL:ldr/startup.c:441) Failed to initialize image
--
The cheese stands alone.
Hi Gregor,
I've some problems with your changes. On my smp machine I get an assertion
from fpu.c line 452. I think, it isn't possible to use
KPCR.PrcbData.NpxThread on a smp machine. With your first patch I don't have
any problems.
- Hartmut
Hi got a problem i Reactos
The Kernel32.Def File
LIBERY KERNEL32.DLL
EXPORTS
NTDLL.RTLALLOCHEAP
And all the other def files where HAL.Somefunction NTDLL.Somefunction etc are in
I know that NTDLL.DLL IMPORTS "RtlAllocateHeap etc." those funktions from a lib in rtl.lib but
don�t know if thats the
problem becures SCSIPORT.SYS allso import some HAL.somefunction witch allso are broke
The tool DependX86 a tool use to find broke link in files can�t either find them and it a littel
strange problem becures i should work microsoft allso do that kind of linking against files and
allso use lib files to import
Use the most recent CVS of Reactos and the newest edition of MingGW
Allso tried differet option and differt compilere versions but seems to me theire must lay a
strange problem in reactos og MingGw Simpl don�t support that...
Crashlist of Files:
Kernel32.dll depend on NTdll.dll
User32.dll depend on kernel32.dll
Atapi.sys depend on Scsiport.sys depend on HAL.DLL
The Subsystem CRSS
And Many more
Anybody Help Me Please
Thomas
__________________________________
Do you Yahoo!?
The all-new My Yahoo! - What will yours do?
http://my.yahoo.com
Hi Rick:
Well I don't believe that would be a protection at all against viruses. Why?
If I where to write a virus and knowing that reactos has such protection that would not stop me at all. I could simply write a function to calculate the hash in the virus (or simply tell the OS to do it for me) and update such database. Look at windows file protection, virus laugh at it. I think the verification of the PE checksum is enough to tell if a file is corrupt and would be faster wich means a faster load. If you want to know some more about viruses look for the e-zines of 29A on the internet to find out more about the subject. Their articles are as advanced as those in phrack (the latest). I think there is not solution for viruses, users will always do insecure things and viruses will be there waiting for them to do it.
Regards
Waldo
________________________________
De: ros-dev-bounces(a)reactos.com en nombre de Rick Langschultz
Enviado el: Lun 11/22/2004 11:25 p.m.
Para: ReactOS Development List
Asunto: [ros-dev] ReactOS and Viruses
Sun will be releasing Solaris 10 shortly as a commercial product available for purchase. There is a new file system that is 128-bit, and is protected by md5 checksums, I think this is a great idea for reactos. I think before a program executes there should be a binary verifier that checks this checksum and then allows the program to run. This would help in deterring Windows viruses from attaching themselves to reactos binaries. Since ReactOS is open source it will be harder to protect a binary if there is an attack and a malicious user replaces a dll or an exe. Perhaps this can be done using a small xml file or a txt file called md5sums or something. Please let me know what you think.
I noticed yesterday while installing ros from a locally generated
bootcd that pcnet.sys is not included. Could someone add it to
reactos.dff? Thanks!
Andrew
--
The cheese stands alone.
Sun will be releasing Solaris 10 shortly as a commercial product
available for purchase. There is a new file system that is 128-bit, and
is protected by md5 checksums, I think this is a great idea for reactos.
I think before a program executes there should be a binary verifier that
checks this checksum and then allows the program to run. This would help
in deterring Windows viruses from attaching themselves to reactos
binaries. Since ReactOS is open source it will be harder to protect a
binary if there is an attack and a malicious user replaces a dll or an
exe. Perhaps this can be done using a small xml file or a txt file
called md5sums or something. Please let me know what you think.
With the issue of Ekush talking about sending us patches once they
publish thier code and what not I as many of you are worried about being
tainted, I have an idea, but I don't know how safe it is from a GPL
stand point (I know nothing of the GPL) here's the idea, when we get
patches that are questionable from *any* source, we send MS a copy of
the suggested patch, and request they compare it with thier code to see
if it is differant or the same as thier Windows code, if MS comes back
and says it's teh same we delete the patch and move on...
I know this idea sounds bad but we need to discuss a plan for any
potential tainting and how we'd deal with it, please if you don't like
my idea then please by all means suggest something else.