Article View: comp.virus
Article #4306Re: Untouchable (PC)
From: Vesselin Bontchev
Date: Fri, 11 Dec 1992 21:47
Date: Fri, 11 Dec 1992 21:47
26 lines
1622 bytes
1622 bytes
RADAI@vms.huji.ac.il (Y. Radai) writes: > When I said that companion viruses began to appear only in 1990, I > meant those which appeared in "the wild". Correct me if I'm wrong, > but I don't think that was true of TP_Worm (at least in 1989 and > probably regardless of date). Sigh... It depends on the definition of "in the wild"... It has been "in the wild" in the Technical University of Sofia, at least for a short time... Side note... Till now we all thought that PATH companions are just a theoretical attack and no such viruses exist yet. Looking carefully at the source of the TP Worm, I see that it has been not only the first companion virus, but also the first PATH-companion... When it is first started on a clean system, in its "initial burst", it spreads a lot of its spoofing bodies in up to 10 randomly selected directories from the PATH variable... Regards, Vesselin - -- Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg Tel.:+49-40-54715-224, Fax: +49-40-54715-226 Fachbereich Informatik - AGN < PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C e-mail: bontchev@fbihh.informatik.uni-hamburg.de D-2000 Hamburg 54, Germany
Technical Details
Message-ID:
<0004.9212161818.AA12845@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!spool.mu.edu!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!spool.mu.edu!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) Newsgroups: comp.virus Subject: Re: Untouchable (PC) Message-ID: <0004.9212161818.AA12845@barnabas.cert.org> Date: 11 Dec 92 21:47:17 GMT Sender: virus-l@lehigh.edu Lines: 26 Approved: news@netnews.cc.lehigh.edu