Path: utzoo!mnetor!uunet!husc6!uwvax!dogie!uwmcsd1!ig!agate!ucbvax!USU.BITNET!FATQW
From: FATQW@USU.BITNET
Newsgroups: comp.sys.amiga
Subject: Guidelines for virus authors
Message-ID: <8802072054.AA03747@jade.berkeley.edu>
Date: 7 Feb 88 19:48:00 GMT
Sender: daemon@ucbvax.BERKELEY.EDU
Lines: 43

[Yes, I'm serious!!]

I don't think we should discourage people from writing viruses, as long as they
are harmless.  You have to make the distinction between a practical joke and
vandallism (sp?).  I think probably SCA was meant as a practical joke, except
the authors didn't take precautions to keep it that way (i.e. it unexpectedly
turned out that it WILL destroy things).  As for the new killer virus, I think
the knucklehead who wrote it deserves to get his brains bashed.

Here are my two (wow!) guidelines for virus writers:

        1) Make it harmless
        2) Make it easy to kill

The first one is very straight forward.  When you change something (like the
boot block), make sure it's already "normal".  Don't do anything to something
you don't recognize.  This would have prevented SCA from turning into a killer.

As for the second guideline, yes, I know part of the fun of writing viruses
is making them "invulnerable".  However, every virus should have a "weak spot"
where they can be killed easily.  For example, someone might make a viruse
just to see if he can make it good enough to fool VCheck into thinking there's
no virus there.  However, he should always have a "back door", so he can make
his own little virus protector.  Also, if the virus is a very "good" one,
then it should have a way to kill itself off, say at a certain date, or after
a certain number of "infections".  For example, a boot-block virus, as soon
as it "grabs" a boot-block, a counter is set to, say, 50.  Every time that
virus propagates itself, it decrements the counter.  When the counter reaches
0, it puts back the normal boot-block, but sets a certain byte to something
different, so that boot-block will never be able to be infected again.
Maybe the author of VCheck (Bill Koester, isn't it?) should, when examining
a disk, don't check the last byte or word.  That way viruses or virus
protectors would set this byte to something, and the virus won't propagate
itself onto this disk.

Anyway, basically the idea is to make viruses (semi-)harmless.

                                Bryan

        Bryan Ford                    //// A computer does what \\\\
Snail: 1790 East 1400 North          //// you tell it to do, not \\\\
        Logan, UT 84321         \\\XX///  what you want it to do. \\\XX///
Email: FATQW@USU.BITNET          \XXXX/ Murphy's Law Calendar 1986 \XXXX/