Xref: utzoo comp.sys.atari.st:14336 comp.sys.apple:10448 comp.sys.mac:27530 comp.sys.ibm.pc:25419
Path: utzoo!attcan!uunet!lll-winken!csd4.milw.wisc.edu!bbn!apple!rutgers!att!mtuxo!lzfme!jwi
From: jwi@lzfme.att.com (Jim Winer @ AT&T, Middletown, NJ)
Newsgroups: comp.sys.atari.st,comp.sys.apple,comp.sys.mac,comp.sys.ibm.pc
Subject: Re: Right of reply, virus- public, private- a thin line
Summary: Viruses are detected by effects, not by recognizing code
Message-ID: <1154@lzfme.att.com>
Date: 27 Feb 89 15:16:17 GMT
References: <415@odin.cs.hw.ac.uk> <14940@cup.portal.com> <3936@ttidca.TTI.COM> <1270@husc6.harvard.edu>
Organization: AT&T, Lincroft NJ
Lines: 21

In article <1270@husc6.harvard.edu>, clubok@husc4.HARVARD.EDU (Kenneth Clubok) writes:
> ...When source code is distributed,
> anyone with an assembler can make minor modifications to the code that will
> make the "mutant" virus undetectible by current virus detection programs. This
> requires neither very much work nor much understaning of the workings of
> viruses.

Most virus detecting programs work by intercepting writes to the
hard disk and by checksumming programs before running them. A small
change in a virus is not going to  make it invisible to this type of
checking.

Jim Winer ..!lzfme!jwi 

I believe in absolute freedom of the press.
I believe that freedom of the press is the only protection we have
	from the abuses of power of the church, 
	from the abuses of power of the state,
	from the abuses of power of the corporate body, and 
	from the abuses of power of the press itself.
Those persons who advocate censorship offend my religion.