Date:	Fri, 21 Apr 1995 05:00:37 +1000
From:	Matthew Lamari <matt AT whcomprm DOT jcu DOT edu DOT au>
Subject:	Re: Internet Virus Alert
To:	Bill Currie <BILLC AT teleng1 DOT tait DOT co DOT nz>
Cc:	djgpp AT sun DOT soe DOT clarkson DOT edu, leis AT usq DOT edu DOT au, d DOT edwards AT eas DOT gu DOT edu DOT au,
	76247 DOT 3453 AT compuserve DOT com

    For starters, I resisted the temptation to subject my message "Good 
Times".  Would've given me a bit of a laugh; but the people who would 
panic are the ones I wish to address here.  (Won't help if this gets 
wiped on sight!!)

    I respect Bill Currie's intentions and computer system and protocols 
knowledge, and thank him for warning of what seems like a real threat; 
however I do have a couple of doubts.

    If what I'm thinking is correct (and maybe that is a big IF) I'm sure 
that what I've seen of the computing knowledge of most people on this 
list (which is quite impressive), this letter would be redundant for 
most.  However, as we are living in a world where people used to think 
that touching disks together spread computer viruses, I would like to go 
over what I personally think of this.

    A virus has to reproduce before showing itself, and one that isn't as 
damaging lasts longer.  I have often pondered what a virus that's not on 
either DOS or AMIGA would get by.  I can see the OS/2 Virus saying 
"Insert virus disk # 23".  And the way all unix(ish) os's run different 
code, the virus would kick into play with a message something like:

   "Modify the makefile
    move your includes
    Must use ANSI-Compatible Compiler.

      and for Linux. . . Must have version 1.2 or later."

    Also the virus would (theoretically) only have the priveleges enjoyed 
by the user, so it couldn't really wipe the drive (unless root ran a 
program belonging to someone else.)

    I can understand a message having an attatched dos program that can 
do those things; but I can't see it reproducing then.

    Mister Currie, I am not blaming you for spreading this warning.  It 
doesn't hurt to be sure; though it could be that your warning message is the 
joke (don't sweat it, you had me worried for a while.)  If it is a true 
threat, there is a pretty major flaw in the mail delivery system of all 
unixes; though as each user's mail is nothing more than a text file, I 
really don't see how this is possible (I believe that individual programs 
read and interpret this independently of the os).  Perhaps one mail 
reader could have a self-destruct ready to go upon a certain code; but, 
well. . . .


    I understand that some users may find this entire subject 
inappropriate to be discussed on this list - if so, I apologize; but I 
will still send this.  I do not have any problem with being corrected 
upon anything I have stated (just put some proof - just so there's no 
doubt.)  I hope that between my own mail and Bill Currie's, users of the 
list are assisted.


Matthew C. Lamari

- Raw text -