NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/comp/org/eff/talk/8459

Text File | 1993-01-08 | 1.7 KB | 39 lines

Newsgroups: comp.org.eff.talk
Path: sparky!uunet!gatech!emory!nastar!phardie
From: [e-mail] (Pete Hardie)
Subject: Re: Beneficial Virus?
Message-ID: <[e-mail]>
Organization: Digital Transmission Systems, Duluth, GA.
References: <[e-mail]>
Date: Fri, 8 Jan 1993 15:22:10 GMT
Lines: 28

In article <[e-mail]> [e-mail] (Clayten Hamacher) writes:
>>But if the environment requires virus-free code, ANY infected program is not
>>acceptable.  Just because the pop-up message says "I'm just a decompression
>
>Then you shouldn't use any program that is over a month old.. Someone could
>have written a trojan into it. But then you can't trust new programs because
>they might be trojans... Hmmm, hire in-house programmers to make ALL your
>s/w.

Although this isn't the group for a security discussion.....

You can compare an executable (for non-changing code) against a known clean
copy, to check for infection after the clean copy date.

>P.S. if someone was going to write a virus they wouldn't have it say "Hi, i'm
>nice, trust me", they'd have it secretly infect..

But that's just what the BCV does, in one description.  It prompts the user
for an action (suicide, install marker file, etc).  If the BCV existed,
how long do you think it would be before someone wrote a copy-cat virus
that looked for the same marker file, performed the same compression, and
at some later date, wiped the disk clean?

--
Pete Hardie:  phardie@nastar  (voice) [phone]
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection"
Position:  Goalie               |