From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: APL virus reference
Date: 9 Apr 92 18:13:43 GMT

FBCohen@DOCKMASTER.NCSC.MIL (fc) writes:

Hello, Dr. Cohen!

Congratulations with your new e-mail address and welcome on Virus-L.

>           The first virus given that name was described in 1984 and
> demonstrated in November of 1983.  The first network viruses I am
> vaguely aware of were supposedly written in the 1960s, but this is all
> quite fuzzy since there were only indirect reports of these events in
> the Shoch and Hupp paper, and therefore, tyhey cannot be accurately
> verified.

>           The first virus that can be accurately verified as such and
> which was used for the purpose of attack rather than experiment was
> launched in the middle 1980s.  I am sorry I cannot give further details.

It's really amazing then that the Polish SF writer Stanislav Lem
described in his novel "Peace to the Earth" (in 1984) the possible use
of computer viruses as warfare... The description looks rather
realistic and naturally follows from his early ideas about machine
evolution guided by natural selection first expressed in "The
Invincible"...

>           As to integrity checkers, it is clear from your many articles
> back and forth on the subject that most of you haven't thought the
> matter out very well.

>           There are and have been integrity checkers that defeat all
> current and probably most future stealth viruses - even in the
> partition table!

I wish the people who market anti-virus software had the same
exactness of expression... :-) Indeed, there are integrity checkers
that are already able to defeat all current and -probably- -most- of
the future viruses, if they are used correctly... Yet the marketing
people are constantly trying to convince us that their product defeats
ALL POSSIBLE viruses, including ANY possible future ones... You
understand very well that this is, of course, impossible...

>           Several integrity checking systems are "perfect" at repairing
> infected files that they are able to repair.  The ASP Integrity Toolkit
> either does it right or tells you that it couldn't (assuming you have
> not told it to be silent about things).

Yep, but they differ in how often are they able to actually repair the
file... The ASP IT succeeds more often, since it relies on on-line
- -backups- (but needs more space), while another product that has been
discussed here recently (The Untouchable) succeeds less often (but
takes -much- less space), since it store only some information about
the files. Recently Dr. Solomon told me the idea to reach a compromise
- - to allow the user to specify how much of the file should be saved.
If it is 100 % this is equivalent to the on-line backups; if it is a
few bytes from the entry point this is equivalent to UT. Each user
should be able to specify the ratio to a value that meets his/her
feelings of "safety".

>           By the way, I now have an at least relatively permanent
> temporary network mailing address.  DO NOT USE THIS TO SEND PRIVATE
> MESSAGES - If you want confidential communication with me, I am now
> providing RSA messaging for the PC, and you can use my system to do
> this.  Get in touch with me for details.

:-) There are obviously some problems with the private messages, since
I got only the first line of the one that you have sent me... Will try
to get in touch with you nevertheless...

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54