From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: The Harmless Virus
Date: 9 Oct 92 14:22:20 GMT

>From:    bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)

>WHMurray@DOCKMASTER.NCSC.MIL writes:

>> This is a simple oversight, but writing the perfectly harmless virus
>> requires this knowledge plus perfect knowledge of all other relevant 
>> factors about every system in the population.  Such perfect knowledge
>> is impossible.

>The above is, of course, true, but it also holds for any program, not
>just for viruses. 

As we leave the "first generation" of PC programmers, this is
becomming more and more evident. Lately the amount of *bad* code from
major manufacturers is increasing, not deacreasing.

One example is the rising number of "do-it-all" packages that do not
seem to know how to handle removable drives. First it was NAV and NDW
that would get upset if I did not have a disk in my Bernoulli drive,
now we can add Addstor's "SuperStor Pro" Windows element to that list.

In another example of "someone who should know better", I saw the use
of 286 instructions in a program for "all PCs". Wonder what compiler
they were using ?

The most recent is the discovery that a particular MBR error will
render a system unbootable from floppy with MS-DOS 5.0 (and 6.0 beta).
You can still use 4.01 & earlier but then will not be able to use
FDSIK /MBR. (Booting from a lower DOS and expert use of DEBUG can
restore everything though).

Saw this in a security product that touted prevention of floppy boots
- - guess the author was not aware of earlier DOS versions 8*(

In short, lately there seems to be a regrettable decline in the
quality of the gigantic software packages reaching the market today.
More disturbingly, often when I call to report such bugs, the only
person reachable obviously has no idea what I am talking about and has
no inclination (possibly by direction) to pass me on to anyone who
does.

Must admit that often I'll call the publicised numbers just to find
out what will happen to Joe Public. Recently was on hold for 45
minutes (luckily I had a good book) only to finally reach a security
operative - tech support went home 15 minutes earlier. One I enjoyed
the most was a recording announcing that I had reached TS "after
hours" and being advised to call back "between 9 am and 4 pm PST,
Mon-Thurs". It was.

On the plus side, the quality of hardware seems to be improving.
BIOSes are now allowing not only boot selection but providing password
protection (would like to think that this is a result of our
prodding). In the last week I have seen notice of disk controllers
with hardware implimentation of disk compression built in and a single
chip AT-Ethernet interface.

Have just upgraded to a Maxtor 7213A disk in my "big" PC. Called to
ask about documentation. Two days later a thirty page tech document
arrived telling me not only everything about the drive but also quite
a bit about IDE drives in general (also available in SCSI). With a
street price of under US2.00/MB and dropping, this may be the new
standard (will have to see if the logetivity will match my MK-1 ST-412
10 MB drive that was my telephone stand for a few years before its
current compressed use in an 286 based answering/fax machine).

IMHO networks are going to be what will slow/stop the spread of common
viruses since they do not have to be subject to the "Turing halting
problem".  However, this applies only to a true client/server network
exhibiting dual state operation (client-server) and state isolation,
*no* peer-peer network that I have seen need apply since they are all
collections of single state machines.

Unfortunately, this condition "just happened" and I have seen little
interest by the manufacturers (with the possible exception of Novell)
in making this a central strategy. We can hope.

					Warmly,
						Padgett

ps At DEBUG offset 4368h into DOS 5.0 Command.Com I found the byte pair "B7 07"
   changing the 07h to 17h "fixes" a CLS to return a "sticky" White on Blue
   screen on a colour display instead of White on Black. The first nibble is 
   the background colour, the second is the foreground. Note: after changing
   a reboot is necessary otherwise an "invalid COMMAND.COM" message may occur.
   No guarentees 8*).