Path: utzoo!utgpu!watserv1!watmath!att!tut.cis.ohio-state.edu!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Newsgroups: comp.virus
Subject: Re: Anti-virus viruses
Message-ID: <0011.9009101250.AA03627@ubu.cert.sei.cmu.edu>
Date: 8 Sep 90 17:35:50 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 21
Approved: krvw@sei.cmu.edu

FXJWK@ALASKA.BITNET (Jo Knox - UAF Academic Computing) writes:
>Every virus that I know of is already platform-specific, and I don't see why
>it shouldn't be easy to make a virus OS-specific:
>  (pseudo code)
>     if( os-version != "6.0.5" ) exit;
>     infect_it();

Even if the WDEF virus for the mac contained such a test, it would
still probably be the case that "the virus causes the Mac IIci, the
IIfx, and the Portable to crash almost immediately after insertion of
an infected floppy."  (Disinfectant 2.1 help screen)

The issue is the same here.  The author of the wdef virus didn't have
any of these machines to test the virus on at the time (most of them
weren't released yet (I don't know the exact timing)).  But they are
all supported by system 6.0.5.

There's no way to write that test correctly.  Virus writers can't test
for machines they don't know about.

ajr