Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!cs.utexas.edu!usc!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: jer@ida.org (Eric Roskos)
Newsgroups: comp.virus
Subject: Re: virus scanning
Message-ID: <0006.9001151235.AA07390@ge.sei.cmu.edu>
Date: 12 Jan 90 14:53:42 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 31
Approved: krvw@sei.cmu.edu

> I am told that in the November '89 issue of the American Mathematical
> Monthly, to the effect that no completely safe computer virus test is
> possible.  The proof is suppose to be short, and along the lines of
> the various proofs of the Halting problem.

Of course.  Just replace the "halt" instruction with a sequence of code
to insert a virus (or to perform any malicious action).

The approach to addressing the problem of viruses is not to automatically
analyze code, but rather to prevent the propagation of viruses.

This aside, turning to what I'd intended to say when I started this
reply (I get easily sidetracked by computing theory :-)):

> The Desktop Fractal Design System by Michael F. Barnsley, Iterated Systems,
> Inc. (1989) is infected with a virus.

This surprises me, since I bought a copy of this program at Reiter's
Scientific Bookstore in Washington DC last November, and used it on my
PC for a couple of days (before getting inspired by it to write my own
programs...  some of his algorithms he gives in the manual are really
hard to figure out, since he's optimized them for integer arithmetic and
he doesn't show all the simplifications he did, only the final
result)...  since then I have used the PC everyday, and have run one of
the virus-checking programs on it several times, without any indication
of a problem! Does anyone have details on which particular virus this
is, or what is added to the end of the object files that one can check
for? I'll run the virus-checking program on the disk itself this evening
to make sure, but from the (very limited) evidence it looks like either
not all the copies of the program are infected, or this is not one of
the standard viruses.