Path: utzoo!attcan!uunet!crdgw1!rpi!zaphod.mps.ohio-state.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: landman@hanami.Eng.Sun.COM (Howard A. Landman) Newsgroups: comp.virus Subject: Re: Anti-virus viruses Message-ID: <0007.9009181331.AA11189@ubu.cert.sei.cmu.edu> Date: 18 Sep 90 02:57:23 GMT Sender: Virus Discussion List Lines: 34 Approved: krvw@sei.cmu.edu I am not arguing in favor of AVVs, but have a few technical ideas to throw out for discussion: One method of limiting the risk of an AVV would be to make it spread more rapidly where there are other viruses than where there are not. For example, the virus could award itself "food points" every time it "eats" a bad virus, and require a certain number of points before it attempts to replicate. The copy, of course, starts life with no food points ... This way, the AVV would be almost unable to spread among systems which were apparently clean, but would spread rapidly in an obviously sick environment. This property could be quite useful in focusing the concentration of the AVV to where it was needed the most. Many variants of this scheme are possible. For example, the virus might split food points with its copy, but then lose a point every time it runs and there's nothing to disinfect. Eventually it could "starve" and remove itself. If the virus was on read-only media, and hence unable to accumulate food points, it could replicate with a low probability each time it ate something, giving much the same effect as saving up points. Another safety feature would be to publish all the information needed to recognize and disinfect the virus, a few months before releasing it. That way no one would have to have it that didn't want to and already had means for virus protection. A polite AVV might ask before committing suicide, so the user had the choice of some other software to do the job. - -- Howard A. Landman landman@eng.sun.com -or- sun!landman