Re: VIRUS Alert for the LIST

[Bob Buchanan <bobbyb@xxxxxxxxxxx>]

If the user has authority to the system, especially QSECOFR, a program
run from a pc can delete everything on the system that is not in use. 
"deltree \\AS400\*.*".  When you want to test your disaster recovery,
run that one.

2.  Using Client Access interfaces and APIs, a PC program can:
        Copy something (save file data) into an IFS folder (or directly into a
save file)
        Copy that stream file to a save file (if necessary)
        Execute a remote command to restore the program (or do other nasty 
things)
        Attach a program to a file likely to be accessed by QSECOFR
(triggers)(just in case 
                the existing user doesn't have quite enough authority)
        This program can find out what other AS/400s it is attached to and 
mount/copy/restore/attach
                itself to other systems.
Assumes the executor of the PC program is logged into the AS/400 in some
fashion when it is executed 
so it doesn't prompt for the signon info and that that user has enough
authority to perform some of
the above tasks (restore, etc.).

Of course, if you don't allow anyone with a PC on your AS/400, you are
pretty safe.
-Bob Buchanan

Pete Hall wrote:
> 
> At 14:12 12/26/1999 , boothm@earth.goddard.edu wrote:
> >What no one still has answered though:  Can any known virus attack a
> >mapped network drive?  If so, can it clean off the IFS?
> 
> I'd guess that it would depend on the user's rights. If the user can delete
> files or directories, the virus can also, when running under that user 
>profile.
> Pete Hall
> pbhall@execpc.com
> http://www.execpc.com/~pbhall
> +---
> | This is the Midrange System Mailing List!
> | To submit a new message, send your mail to MIDRANGE-L@midrange.com.
> | To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
> | To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
> | Questions should be directed to the list owner/operator: david@midrange.com
> +---
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---