Return-Path: XPUM04@prime-a.central-services.umist.ac.uk Received: from G.SEI.CMU.EDU by ubu.cert.sei.cmu.edu (5.61/2.3) id AA25957; Tue, 12 Jun 90 06:58:00 -0400 Received: from SEI.CMU.EDU by g.sei.cmu.edu (5.61/2.5) id AA13041; Tue, 12 Jun 90 06:57:58 -0400 Received: from nsfnet-relay.ac.uk by sei.cmu.edu (5.61/2.3) id AA04390; Tue, 12 Jun 90 06:57:51 -0400 Received: from sun.nsfnet-relay.ac.uk by vax.NSFnet-Relay.AC.UK via Janet with NIFTP id aa09987; 12 Jun 90 11:21 BST From: Anthony Appleyard To: KRVW <@NSFnet-Relay.AC.UK:KRVW@sei.cmu.edu> Date: Tue, 12 Jun 90 11:08:08 BST Message-Id: <$TGVTCZHTCBVQ at UMPA> Subject: Virus-L vol 0 issue #0812 Virus-L Digest Fri, 12 Aug 88, Volume 0 : Issue #0812 Today's Topics Re: Mainframe Viruses and whatnot What's the latest on the conference thing Conference Notes ------------------------------ Date: Fri, 12 Aug 88 09:00:00 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: "Joseph M. Beckman" Subject: Re: Mainframe Viruses and whatnot In-Reply-To: Message of 11 Aug 88 16:05 EDT from "David M. Chess" > Christma wasn't really a virus in the usual sense, since it didn't >insert itself into any executable files, ... a real, spreading, >arbitrary-program altering, virusy virus. I suppose the "Lehigh virus" wasn't a virus then, since it didn't insert itself into "arbitrary programs"? Of course, we will also have to excuse the "Brain virus" since it propagated to the boot sector, not an arbitrary program. > ...it's Real Easy to write a filter that just zaps anything of the >right size called CHRISTMA EXEC... Sure! And I can write a filter that zaps Command.Com & zeros out the boot block too! That'll stop those beasties! > Let's reserve it for ... a program that can 'infect' other programs >by modifying them to include a possibly evolved copy of itself. Closer. The question is, what distinguishes an ordinary Trojan Horse from the virus variant? The answer is, the virus has a more-automated distribution mechanism. If I infect WORD PERFECT or WORDSTAR (trademarks of some company) with an ordinary Trojan Horse, it will end up in zillions of places. The distribution, though is at human speeds. Someone has to learn about the package order it, have it shipped, etc. (In the government it is 'bureaucratic speed', an oxymoron). A virus speeds that distribution up by propagating itself electronically. Focusing on "programs" is a little misleading; the distinction between "data" and "programs" in the general sense is very difficult to make cleanly. For instance, the CHRISTMA EXEC existed within each user's VM space. Now VM is just another program, so since the virus existed within it, it had "infected" that user's VM "program." Joseph -------------------- Date: Fri, 12 Aug 88 13:07:43 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: me! Jefferson Ogata Subject: What's the latest on the conference thing Hey folks. This list has been pretty quiet lately. What's new? - Jeff Ogata -------------------- Date: Fri, 12 Aug 88 16:42:31 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Loren K Keim -- Lehigh University Subject: Conference Notes We have MANY replies in on the virus conference. Right now, we are trying to set upa conference for October 21-23. We are trying to contact possible speakers, and making certain we can get rooms. We will have most of the major details worked ou by the end of the weekend. I'll write about it then. Thank you for all the respones! Loren -------------------- *** end of Virus-L issue ***