🚀 go-pugleaf

	In a recent virus-l, someone wrote that they liked Alan Solomon's
redefinition of a `real virus' as `a program that replicates without the
user's awareness and cooperation' (p602 V11N7 Computers and Security).

	There are some minor problems with this definition that I would
like to point out.

1) If a user is aware of the `Brain' virus on a floppy disk, and inserts
it anyway and boots, it is a virus? According to Solomon's definition it
is NOT a virus because the person was:

	a) aware
	b) cooperative

	HOWEVER - If another user does exactly the same thing without
knowing that the disk contains a virus, then it IS a virus!

	My problem is that I now have to assess the state of mind of the
user to determine whether the thing we call `Brain' is a `real virus' or
not.  We know for certain that it is a `virus', but whether it is a
`real virus' changes as the user's awareness level changes.  Careful -
if you go to sleep - it's a `real virus' - but don't worry - when you
wake up it isn't.

	How about in a multiuser environment? The same sequence of bytes
is both a `real virus' and not a `real virus' because one user is aware
that it replicates and another is not. If `backup' a `real virus'?  It
was a few days ago, but now that you are all aware that it is a `virus',
it is no longer a `real virus' for you.

	What about fully automated systems, where there are no `users',
EVERY replicating program is a virus, because there is no user
awareness.

	How about designer awareness? Administrator awareness? I guess
that my maintenance viruses are `real viruses' because the users aren't
aware of them.  Even if I tell them about the viruses - they are still
`real viruses' because the users don't have to explicitly cooperate in
order for the maintenance to take place.  So I guess we can have benevolent
`real viruses' as well.

	What is all this leading to? The environmental factor that
determines what meets Solomon's definition of Solomon's `real virus' has
to do with the state of mind of the `user'.  That means that there is no
objective test to determine whether or not something is a virus because
two different observers could draw completely different conclusions and
both be right.

	Solomon then goes on to state that ``useful (antivirus software)
differentiates between (`real viruses') and non(`real viruses')''!!! But
this means that useful anti-virus software can differentiate between the
states of mind of different users! Fantastic!!!  It read's your mind,
and only warns you if you aren't already aware or you aren't cooperating!
Of course, in testing, it never tells you about a virus, because there
are no `real viruses' in a test - after all, you know about the test and
you are cooperating.

	HUMOR ON!!! (I wouldn't want to offend anyone's sensibility)

	Is that why Solomon's toolkit does so poorly in tests? (NOTE
Solomon's toolkit is really quite good at detecting known viruses - even
in tests).  We must conclude from this that Solomon's antivirus products
are not useful - by his own claims.  But I think he wants us to believe
that they are useful, so I am anxious to find out how they detect the
state-of-mind of the user.  ...  Sorry - they don't do that yet.

	HUMOR OFF!!

	Maybe Solomon's product is very good - but his definition isn't.

__________________________________________________________________________
8:30AM-2PM Eastern		Protection		2PM-8:30PM Eastern
US+412-422-4134			 Experts		   US+907-344-5164
	FAX US+412-422-4135 -OR- 907-344-3069 24 hours - 7 days
__________________________________________________________________________