From: phardie@nastar.uucp (Pete Hardie)
Subject: Re: Purpose of a (beneficial) compression virus
Organization: Digital Transmission Systems, Duluth, GA.
Date: Mon, 11 Jan 1993 18:01:11 GMT

In article <JXB4wB5w165w@ruth.UUCP> rat@ruth.UUCP (David Douthitt) writes:
>Giving some thought to the purpose for such a virus, I find myself with more
>and more questions...
>
>    1. If the only true action of the virus is to load itself into memory
>       when called, why not place it into a clear plain-as-day CONFIG.SYS
>       file as a device driver?

EXACTLY!

>    2. What is different between a virus which takes up residence to
>       compress executables on the fly and a device driver which
>       compresses files as they are loaded for the first time?

The device driver can compress ALL files that benefit from compression, not
just executables.  Text files are the best for this.

>Seems to me the underlying purpose of a virus is to infect systems; if
>the user has to install the marker file then the virus can no longer
>infect by its own and is no longer useful as a virus.  Why couldn't
>the user install a device driver instead?
>
>I would suggest that the best use for a beneficial virus would be on a
>larger scale to replicate some code/action over a wide audience.
>
>For example:
>   - a virus could suggest repair (and possibly effect the actual
>     repair) of an operating system or any other program.

Suggesting repair is not a bad idea.  Actually repairing is bad - lots of
trouble with virus-checkers then complaining, introducing new bugs, breaking
old programs that depended on the bugs, etc.

>   - update old programs with new versions.

Again, new versions can cause trouble for developers who are expecting the
old version's quirks.  Not to mention how do you make sure that the person
has paid for the update?

>   - take (nationwide! international!) surveys/polls.
>     [SAY!  Is this an idea or what?  :-) ]

Not on my machine.  If you want to ask my opinion, you do it in a manner that
allows me to [slam the door|hang up the phone].  A virus that started to
ask me questions would be akin to a pollster who broke into my house to
ask them.

>   - eradicate other (malicious) viruses.

Difficult to detect and distinguish viral purpose.  Suppose 2 people wrote
2 versions of this virus, and they met on one system?  Not to mention the
counterattack of a virus that eradicated viral eradicators (except itself!)

>   - eradicate pirated copies of software (its possible!)

How do you determine a priated copy from a test copy, or a null copy used
as disk filler?

Basically, the problem is that there is no general agreement that any given
action is always beneficial.  Compression, which seems nice, can be trouble
for people wanting to swap files, or people trying to test full disks, or 
people who need every last MIP of performance from their computer.  All of
the suggestions above are nice, to some, and not to others.  A hostile virus
is a lot easier to write, because its task is obvious - do some form of
harm to the system, and spread copies of itself.

-- 
Pete Hardie:  phardie@nastar  (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team           |  cat * | egrep -v "signature virus|infection" 
Position:  Goalie               |
Newsgroups: comp.org.eff.talk