Path: utzoo!attcan!uunet!lll-winken!lll-tis!ames!mailrus!uwmcsd1!ig!agate!ucbvax!UCONNVM.BITNET!SEWALL
From: SEWALL@UCONNVM.BITNET (Murph Sewall)
Newsgroups: comp.sys.apple
Subject: Re: Virus troubles...
Message-ID: <8807281042.aa01429@SMOKE.BRL.ARPA>
Date: 28 Jul 88 01:57:56 GMT
References: <INFO@NDSUVM1>
Sender: daemon@ucbvax.BERKELEY.EDU
Organization: The Internet
Lines: 40

>Well, I have become a victim of a virus - but not directly. Some
>a$$hole has infected my Z-Link and began posting to various places
>(including, possibly Genie). If you know of anyone who has a copy of
>Z-Link Plus, tell them to get rid of it right away. It contains the
>CyberAIDS virus, which can cause bad (but not irrecoverable) damage.
>Every other time an infected SYS file is run, the virus checks the
>volume directories of all online disks and infects all SYS files it
>finds. Once the virus has executed 15 times, it trashes the volume
>directory of online disks. See news below:

It would appear that EVERY author of shareware .SYS files can easily
fall victim to this particular virus.  It may not have been a deliberate
attack on Z-Link.  All that has to happen is for some innocent user
of Dave's program to have an infected disk which would, naturally,
infect Z-Link as part of the way that it works.  If that by-stander
decides to pass Z-Link along to others by uploading it, then everyone
who downloads the program (and passes it along) would spread the
virus too.  That's what makes viruses a SERIOUS concern folks.  There is
no reason why BLU or the EXECUTIONER can't become infected the same
way.

To Dave and other helpful shareware authors: How much trouble would it
be to encrypt somewhere in the code the length (in bytes) that an uninfected
program should be and have the decyphered number print on the opening
(intro, copyright) screen?  Such a feature would offer some protection against
the innocently infected program.  Sure a virus writer could probably
figure out how to alter the number, but it would be relatively simple
to spread messages accross netland with the correct number (as in: if your
BASIC.SYSTEM file should be 21 blocks, if it's longer than that you
probably have a problem).


Murph Sewall     Sewall@UCONNVM.BITNET
Business School  sewall%uconnvm.bitnet@mitvma.mit.edu          [INTERNET]
U of Connecticut {rutgers psuvax1 ucbvax & in Europe - mcvax}
                 !UCONNVM.BITNET!SEWALL                        [UUCP]

-+- My employer isn't responsible for my mistakes AND vice-versa!
            (subject to change without notice; void where prohibited)

"It might help if we ran the MBA's out of Washington." - Adm Grace Hopper