Path: utzoo!utgpu!news-server.csri.toronto.edu!mailrus!iuvax!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: FXJWK@ALASKA (Jo Knox - UAF Academic Computing)
Newsgroups: comp.virus
Subject: Re: Antivirus viruses
Message-ID: <0003.9008171919.AA16211@ubu.cert.sei.cmu.edu>
Date: 16 Aug 90 19:40:03 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 38
Approved: krvw@sei.cmu.edu

Scott Erickson (erickson@lclark.BITNET) writes:

>         Viruses don't have to ask for user permission to infect files.
> Viruses do not spread by beguiling computer users; they simply hide in
> the shadows and slither from disk to disk.  I see no new dangers users
> could find themselves in if antiviruses do in fact make an appearance
> in the computer world.

  For the most part, I agree with Scott; however, the antiviruses
we've been discussing (which present an alert box and options) will
themselves be targets.  That is, if some one releases an antivirus
(call it VANTIV) which computer users become familiar with, then the
next malicious virus will impersonate VANTIV.  Users will lose trust
in VANTIV and stop using it (losing the benefits); the author of
VANTIV could be blamed for the effects of the impersonator (do we call
this a "trojan virus"?)
  Rather than this scenario, I suggest a "quiet" antivirus. (No
flames, yet; please read on!)  Let's split computer users into two
groups; there are those who are fairly "virus aware", literate users
who check every new disk (most of us on this list). The second group
is by far the majority; they know viruses exist, but only learn much
about them *after* becoming infected, sometimes long after!
  I doubt anyone in the former group would welcome an antivirus, and
the majority would catch and kill it before infection.  I certainly
wouldn't welcome this critter on my machine, which I know to be clean!
However, I might write such a virus, and even distribute it "on the
sly".  I assume that those who don't need it won't get it (having
killed it first), and those who do are quite possibly already infected
(this campus is rife with nVir B).
  As far as the morality/ethics question, I have no problems with this
idea; there's no reason you can't help someone without their
knowledge!
  This entire scenario makes one possibly large assumption: that this
"antivirus virus" is itself not too virulent, is well programmed in
detection, eradication, and even prevention, and is generally
well-behaved.  Jo My musings herein are not necessarily endorsed by
the University of Alaska And when this thing does show up, I didn't
write it...