Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!think.com!zaphod.mps.ohio-state.edu!pacific.mps.ohio-state.edu!linac!att!news.cs.indiana.edu!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: mrs@netcom.com (Morgan Schweers)
Newsgroups: comp.virus
Subject: Re: Dead vs Live: Commercial Necessity?? (some philosophizing added.)
Message-ID: <0003.9105291438.AA09086@ubu.cert.sei.cmu.edu>
Date: 29 May 91 08:36:52 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 74
Approved: krvw@sei.cmu.edu

Greetings,
>> Is the stoned virus, for example, so prevelent because it is well
>> designed and/or defeats virus detection, or because it proceded the
>> large increase in sites with virus detection programs. Does not, in
>
>I would say that Stoned is so successful because it exploits a flaw in
>the PC architecture which is also our main ally in the fight against
>viruses - booting from floppy. How many times have you seen a student
>put their disk in the PC then switch it on? I do it by mistake myself
>sometimes. Whether the author was a great visionary(!) or got lucky
>doesn't matter, he was the first(?) to use the technique.

    Nope.  The major reason the Stoned spreads is two-fold.  1) It's
been around for a LONG LONG time.  However, the Brain has been around
just as long, so that can't be all of it.  2) It infects HD's.  When
it *HAS* infected an HD, it infects every single disk that passes
through it.  THAT is what makes it such a successful virus.  The Brain
didn't infect HD's, and is now reduced greatly in population.
(Interestingly, though, I feel sure that there are more people
infected with the Brain than are reported, since it *IS* the first
stealth virus, and does a good job of hiding.)

>> Without a continual influx of successful viruses, that is new
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    I'd put 'successful' viruses at about one every month or so, recently.
    Those are viruses which were spread by someone with a knowledge of
    the dynamics of spreading these things.  The kind of virus that hits
    a few thousand people in the first few weeks of it's life.  A large
    percentage of those people aren't going to realize it's there.  They'll
    be the 'typhoid PC' in that area, spreading it more and more.  It also
    includes new viruses being spread by companies shipping software or
    hardware.  ('getting lucky' in some folks terms.)  These are viruses
    that the marketplace can expect to live with, because they weren't
    caught early enough to nip their spread.

>> techniques, the only marketable force behind upgrades and/or market
>> share are dead viruses.
>
>Cruel. Perhaps virus fighters ought to remember that their ultimate
>goal, like doctors, is to make themselves redundant.

    A very important point.  I hope one day to put myself out of this
crazy business, and write a book about the insanity all over the
field.
    Goodness, the personality conflicts alone would make for an
wonderful novel, then we add in the hysterics of the commercial side
of the business...  Of course, a fictional bar scene with all the
principal players would be...frightening.  I picture these ten people
suddenly realizing who else is at the bar, and the temperature
dropping twenty to thirty degrees suddenly.  *grin* Other patrons
diving for cover, and huddling behind tables suddenly.  Yupyup...  For
an industry this size, there's been a lot of backstabbing and
slandering, etc.
    If people could RELAX it would be good.  'Course there's money in
them thar PC's, and that changes some folks.

    Anyone care to make guesses on how long the Virus problem will be
around?  I'm still looking forward to writing that book.  *grin*

    (A side and sad note...  It is not us, the anti-viral researchers,
who will kill the viruses once and for all.  It's the OS writers who
will finally produce an OS which supports the protections a machine
needs.  It's the users who will finally leave this damned MS/DOS
troublemaker behind.  THAT is when viruses will vanish, slowly but
surely, and then we can all have a beer together and laugh about the
nonsense of having to clean up behind Microsoft.)

                                                    --  Morgan Schweers
- --
    "My tongue is firmly stuck in my cheek, and I'm rarely ever serious.
One of my first quotes on the job was, 'So my job is to put myself out
of a job, right?  No problem!'  I like to think that most AV folks share
the opinion."
                                        --  mrs@netcom.com