Path: utzoo!mnetor!uunet!cbmvax!carolyn
From: carolyn@cbmvax.UUCP (Carolyn Scheppner CATS)
Newsgroups: comp.sys.amiga
Subject: Re: Virus Author comes forward!!!
Message-ID: <3064@cbmvax.UUCP>
Date: 31 Dec 87 22:27:53 GMT
References: <3007@cbmvax.UUCP> <3008@cbmvax.UUCP> <6028@cisunx.UUCP> <4862@well.UUCP> <597@inria.UUCP>
Reply-To: carolyn@cbmvax.UUCP (Carolyn Scheppner CATS)
Organization: Commodore Technology, West Chester, PA
Lines: 88
Keywords: virus, diskkiller

In article <597@inria.UUCP> rouaix@inria.UUCP (Francois Rouaix) writes:
>[]
>
>FLAME ON
> I'm beginning to get tired with all this fuss about Viruses.
>
> The point is:
>	1- You may be contaminated only by a bootable disk

   As far as we know.  We still have not been sent samples of these
new viruses.  

>	2- Commercial software are not contaminated when sealed under
>		the original package...

   Not necessarily true.  We have heard rumors that there are some
commercial shrink-wrapped products that may be infected.  I have no names
or definite information on that, but there is a possibility that this
could be true.  The products could have been infected during development
or testing, and unknowingly gone to production carrying the infection.

>	3- PD disks are generally not bootable, and the official ones are
>		healthy.

  I have also heard that there may be some freely redistributable bootable
demos which are infected.    

>I think I will leave the conclusion to your bright minds.
>FLAME OFF
>	
>	If you got to the same conclusion that I draw, you will notice
>	that indeed the pirates that originally wrote the Virus are 
>	helping Software producers by making pirated copies unsafe.

This is a bit simplistic.  I'm sure the pirates are capable of using
a Virus Checker and the CLI Install program.

>	I wish we could stop this discussion about viruses.

I think it's important to discuss it, be aware of new strains, and make
all users and developers aware of what they must do to protect themselves
and their customers.

I never casually boot with unfamiliar disks.  I won't soft-boot my disks
in someone else's machine without write-protecting them.  And I don't
use pirated software.  I generally have one boot disk for each of my
Amigas, and that's what I boot with.  But I got infected.  It was a
total surprise and I have no idea how it happened.  I was finished
putting together a VCheck1.2 disk for European distribution, and decided
to copy VCheck1.2 to my hard disk in case I ever needed it.  Then I
wasn't sure I had copied it to a PATH'd directory so I typed "VCheck1.2"
to see if DOS could find the command.  Well, DOS found it, and it printed

     Your machine is INFECTED with VIRUS!!!

I checked my boot disk, and it was infected.  The only thing I can figure
is maybe somebody used one of my Amigas on a weekend or while I was
away somewhere, and then rebooted the machine with my un-write-protected
boot disk when they were done.  I now keep my boot disks write protected
at all times.  Fortunately, because I always boot with the same disks,
I only found one other disk that was infected.  Others are not so lucky.

 
>	And finally, to CATS : DON'T DISTRIBUTE this so-called Virus Protector.

If thought it was clear from Bill's postings that we will not distribute
the SCA Virus Protector because:

   a. We don't have the source 
   b. It only protects against the original Virus
  

BTW - Let's not start a flame war about this, but I truly believe that
      the SCA people thought their virus was a cute but harmless hack,
      and are sorry that it caused damage they didn't foresee.

      But I would like to strangle the vicious immature jerks who
      knowingly created new strains of the virus AFTER it was shown 
      to be dangerous.  Some commercial developers have offered
      substantial sums of money towards the apprehension and prosecution
      of these people, and I hope they get caught.

-- 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Carolyn Scheppner -- CATS   >>Commodore Amiga Technical Support<<
                     UUCP  ...{allegra,ihnp4,rutgers}!cbmvax!carolyn 
                     PHONE 215-431-9180
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=