🚀 go-pugleaf

On Tue, 22 Dec 92, Suzana wrote:

S> Suppose that we have an A-V product which in regular intervals or
S> randomly send a virus in system. Virus (fast infector) infects only
S> programs which checksum doesn't correspond to previously calculated
S> values. If no such program is found virus deletes itself or removes
S> from memory. If changed program found virus activates scanner to check
S> if there is any known virus.  If known virus is found message is sent
S> to the user. If program is changed and no known virus is found the
S> message is sent to the user to make decision.  If decision is to leave
S> program as is, virus cuts itself from the program.  The whole process
S> (except messages) takes place in background. There is no need for all
S> A-V program (which is combination of I-checker and scanner) to be TSR,
S> only virus is occasionally TSR. 

This looks interesting, but you might run into performance problems
as the 'good virus' looks for non-infected programs.  Also, if you
had a stealth virus that was already active in memory, when your
virus infects a file, it might overwrite part of the program code (or
the stealth virus, depending on infection method), causing you to
lose the program.

Wouldn't this program be easier as a TSR?  That way it wouldn't have
to infect the files, and only needs to check programs that you
actually execute.

S> There is slight similarity in this
S> idea with reaction of human immunity system. Anyone has ethical
S> problem with her/his own immunity system ?

Actually, yes.  Since my immunity system makes periodic attempts to
kill me, in the name of protecting me, I do have a problem with it. 
You see, I am one of those unfortunate people who are allergic to
bees.  Each time I am stung, my immune system makes a faster and
harsher response, and one day this will kill me if I do not get
medical help.  Is it possible that the A-V virus might (accidentally)
act in the same way?

- ---
Ron Whittle
cscrdw%curie@epavax.rtpnc.epa.gov