🚀 go-pugleaf

ygoland@edison.SEAS.UCLA.EDU (The Jester) writes:

> Yes.. I understand. And may I say I STRONGLY disagree with Dr.
> Cohen's definition.

Any human-language definition will be inexact. For an exact definition
you should check his mathematical definition that involves Turing
machines... I think it is explained in his paper "Computational
Aspects of Computer Viruses", published in "Computers & Security". It
is also explained in his Ph.D. thesis (although the paper is better)
and is mentioned (without any explanation, which is rather confusing)
in his booklet "A Short Course on Computer Viruses".

> A program in the login script that checks if you
> have been updated and then updates you is NOT a virus. The program in
> the loader does NOT reproduce itself it reproduces another program
> which is itself NOT a virus.

No, you still do not understand. The "virus" is not just the login
script - it is the whole package. The login script is just the active
segment that seeks for "infectable" machines and transfers the rest of
the "virus code". It is actually a worm, but Cohen's definition does
not seem to make a difference between a virus and a worm.

> loader installs an infected program =) For me the acid test of a virus
> is:Can it reproduce itself?

Correct. So, the copy of the anti-virus package on the server
reproduces itself on each workstation when this workstation tries to
log in. Automatic update. Reproduction. Virus-like behavior.

> Is the login script programming trying to
> run around and find other login scripts or executable files to infect?

Another misunderstanding comes from the fact that most people
distinguish between a "virus" (i.e., something that modifies
executable files) and a "worm" (i.e., something that copies itself as
a whole). While it is useful to make such a distinguishment for
practical reasons, there is no real theoretical difference (e.g., what
"files" do the boot sector viruses infect? How about the companion
viruses? They do not modify anything...).

> No. It doesn't infect anyone! 'Damnit Jim, its not alive!'

Yup, it does. It "infects" the workstation with a copy of the
"virus/worm" - the anti-virus package.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany