From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: New Anti-viral Product Announcement (PC)
Date: 9 Apr 92 19:47:26 GMT

TYETISER@ssw02.ab.umd.edu writes:

>         New Anti-viral Package Featuring Real Intelligence,
>                          not Artificial

Sigh... It sounds pretty tempting, like an anti-virus programs
everybody would like to have, but unfortunately, it seems more like
and April Fool joke to me...

>    Description: VDS (Virus Detection System) 2.0 is an anti-viral
> software package designed to contain the spread of computer viruses by
> providing early detection and quick recovery. What distinguishes VDS
> from other anti-viral products is that its operation is based on
> analyzing viral behavior rather than just looking for known byte
> sequences extracted from virus samples. Therefore, VDS does not
> require frequent upgrades.

A heuristic analyser? Beurk... I would prefer something more reliable.

>    VDS uses a proprietary triple-pass verification technique to catch
> the most evasive "stealth" viruses even when they are active in
> memory. Coupled with its blazing operational speed (thanks to its

I fail to see why a triple memory scan is needed. Any stealth virus
can be caught in memory with a simple one-pass scan. They are stealth
in files, not in memory you know...

> optimized internal cache), VDS represents the strongest software
> solution currently available.

Nope... When speaking about strong solutions, nothing that doesn't
involve integrity checking does not sound strong to me...

>    VDS generates a customized device driver during installation. The
> device driver barely adds three seconds to bootup time and catches all
> system infectors with ease. It can recover vital system areas such as
> the master boot record and the partition boot record automatically,
> and place a copy of the affected area in a file so that the user can
> examine it later. The user is given an opportunity to embed his own
> message inside the device driver. This message is displayed if a
> possible infection is detected.  Businesses will find this feature
> very useful since it can be used to prompt users to report any
> incidents as instructed by the message. The device driver can also be
> configured to freeze the computer after displaying the customized
> message to ensure that it is not ignored.

Even if the whole message is a joke, the above is pretty realizable.
In fact, several anti-virus products already offer similar options (or
at least some of them, like automatic restoration of the boot sectors
and customized alert messages).

>    A unique feature of VDS is its decoy launching mechanism.
> The decoys are used to lure any viruses active in memory and to
> capture them in a POV (Prisoner Of VDS) file for examination.  The
> captured intruders can speed up diagnosis process since you will know
> which virus you are dealing with or whether it is a new virus.

The only problem is to convince the virus to infect the decoy... :-)
Victor Charlie used a similar approach in the past... maybe still uses
it.

>    VDS documentation rivals many books on computer viruses not

Name some of them.

> only by its readability but also by its technical content. It offers
> practical guidelines and a risk analysis test designed to evaluate the
> vulnerability of your computers to viral attacks.

Jokes aside, I think that something like this can be found in Fred
Cohen's manual for ASP IT or at least in his "Short Course on Computer
Viruses".

>    The package includes a special utility program that helps users to
> recover from all system infectors that target vital areas of hard
> drives such as the master boot record. Another program in the package
> allows users to search DOS-compatible (including network) drives for
> known viruses.  This program sports an easy-to-use menu-driven user
> interface as well as a spartan command-line mode for individuals who
> do not mind remembering half a dozen options. It also has a mechanism
> to add new virus patterns externally.

All this is possible and in fact already available in several
products.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54