Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!uakari.primate.wisc.edu!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: frisk@rhi.hi.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Anti-virus viruses
Message-ID: <0005.8909281133.AA14331@ge.sei.cmu.edu>
Date: 27 Sep 89 14:25:25 GMT
Sender: Virus Discussion List 
Lines: 32
Approved: krvw@sei.cmu.edu

I have been following the anti-virus-virus discussion with some
interest, but I have not yet seen anybody mention the fact that one
such virus already exists.

The virus is the "Den Zuk" (Translation: The Search) virus, which was
written to fight the Brain virus.

When this virus finds a Brain-infected diskette, it removes Brain and
puts a copy of itself in place.

It also looks for old versions of itself and "upgrades" them if
necessary.

The virus resides on track 40 on diskettes (normally 360K diskettes
only have tracks numbered 0-39), and thus takes up no usable space.

So far, so good.

However - this virus also demonstrates what can (and will) go wrong
with anti-virus-viruses.

The programmer did not anticipate 1.2M or 3.5" diskettes. When the
virus infects a disk of that type, it will destroy data.

Also, several "hacked" versions of this virus have been reported,
including one that will disable the SYS command and destroy all data
on drive C: on September 13. 1991. (One more of those "Friday the 13th
viruses. Why can't virus writers have a little more imagination :-) )

So - the conclusion is simple: "The only good virus is a dead one."

                            ---- frisk