Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!uakari.primate.wisc.edu!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: frisk@rhi.hi.is (Fridrik Skulason) Newsgroups: comp.virus Subject: Anti-virus viruses Message-ID: <0005.8909281133.AA14331@ge.sei.cmu.edu> Date: 27 Sep 89 14:25:25 GMT Sender: Virus Discussion ListLines: 32 Approved: krvw@sei.cmu.edu I have been following the anti-virus-virus discussion with some interest, but I have not yet seen anybody mention the fact that one such virus already exists. The virus is the "Den Zuk" (Translation: The Search) virus, which was written to fight the Brain virus. When this virus finds a Brain-infected diskette, it removes Brain and puts a copy of itself in place. It also looks for old versions of itself and "upgrades" them if necessary. The virus resides on track 40 on diskettes (normally 360K diskettes only have tracks numbered 0-39), and thus takes up no usable space. So far, so good. However - this virus also demonstrates what can (and will) go wrong with anti-virus-viruses. The programmer did not anticipate 1.2M or 3.5" diskettes. When the virus infects a disk of that type, it will destroy data. Also, several "hacked" versions of this virus have been reported, including one that will disable the SYS command and destroy all data on drive C: on September 13. 1991. (One more of those "Friday the 13th viruses. Why can't virus writers have a little more imagination :-) ) So - the conclusion is simple: "The only good virus is a dead one." ---- frisk