🚀 go-pugleaf

   Hello everyone,
   
 From: cjkuo@ccmail.norton.com (Jimmy Kuo) writes:
 >Subject: Re: Infection density (PC)

> For file infectors, over the past 6 months, we've only heard of one or
> two cases where the number of infected files were in the couple of
> hundreds.  Otherwise, it was always one's and two's.  (Otherwise

   This does make sense. Considering that many people run only a few
programs on a regular basis, those programs would be the ones
affected.  Of course, if the virus looks for its victims, then it
would spread to other programs as well. Many common resident viruses
infect on load/exec or open/create, instead of findfirst/findnext; so,
this is not the case. If you have a fast infector that monitors FF/FN,
and you happen to run a program like "tree", it would be quite
interesting :-) Similarly, a virus scanner could very well spread the
infection if the virus is active and the scanner is not aware of it.
Or if the user forced the scanner to skip the memory scan, the same
thing could happen. I still argue that memory scan should NOT be
optional. It is useful during testing to be able to turn it off, but
to the end-user (who may not be familiar with handling viruses), it is
a dangerous option.  And use of dynamic decoys should be considered,
even if they are limited.

> This is probably as good a place as any to advance my own "infection
> rate" theory.  I would propose that a virus will spread only until it
> meets an anti-virus system.  Thus, it would be one exponential
> function chasing another, which would reduce to a linear effect.

> involved topology.  I think my explanation is easier to comprehend.
> :-) "A virus spreads until it encounters an anti-virus system.")

   Well, well. . . Yet another philosopher among us :-) But don't mind
my making an observation sir. Your "theory" has been suggested long
long time ago by others: "If all you have is a hammer, everything
looks like a nail."  Or something along those lines. Let us not
exaggerate the utility of anti-viral software. It is usually an alert
user who discovers the beast, even without an a-v product. After that
discovery, they bring in the big guns. Many organizations still lack
adequate a-v protection today. My theory is that if one is involved in
a field for too long, one might start to get into the habit of
self-congratulation, or even congratulating each other without good
reason. It's human nature I guess :-)

> Jimmy Kuo                                       cjkuo@ccmail.norton.com
> Norton AntiVirus Research

   Hmm... I was not familiar with the theoretical work conducted at
Norton, but I just found out that you indeed engage in such endeavors
:-) Keep up the good work.

   Jokes aside, I'd like to mention a recent paper from Cohen,
published in Computers & Security:

   "Defense-in-Depth Against Computer Viruses" by Frederick B. Cohen
   Computers & Security, 11 (1991) 563-579
   
   Some sections include:
      A Multitude of Broken Defenses, Coding Techniques, Optimal Detection 
      and Infection Limitation, Automated Repair, Fault Avoidance Techniques.
   
   Dr. Cohen's coverage of the material is fairly broad yet concise.
Curious individuals are recommended to take a look at it. You might
learn something.  Here is one: "... for small files, deriving CRC
coefficients is trivial; and for "empty" files, CRC codes may show the
CRC coefficients directly."
   
Regards,
Tarkan Yetiser
VDS Advanced Research Group
P.O. Box 9393
Baltimore, MD 21228, U.S.A.
(410) 247-7117
tyetiser@umbc8.umbc.edu