[comp.virus] Self Replicating Virus Hunter / Seekers

davids@uunet.UU.NET (David Scollnik) (09/26/89)

In a recent posting CZMUREK%DREW.BITNET@VMA.CC.CMU.EDU writes ...

% I began to design a virus algorythm that would eventually serve
% as the platform for the destruction of other viruses.  It's purpose
% would be to infect single programs, single disks, or multiple disks in
% the first, second and third versions respectively.  Before any alarm
% sets in here about my intentions, I would like to say that the purpose
% here is to aid in the effort to combat these little nasties.

I thought many of you might be interested to know that at least one such
"utility" has been written and distributed for the Amiga. The one I have
heard of is called "System-Z" , which is composed of two parts , namely
the System-Z "installer" and the Sys-Z "bootblock".

When an Amiga is booted up from a disk containing the Sys-Z bootblock,
it announces to the user that it is now present in memory ( until the
machine in question is de-powered ) by way of a quick rainbow screen
and a short series of musical notes. This program will identify a
variety of Amiga specific viruses located in other disk's bootblocks,
and allow the user the option of overwriting the bootblock of the
infected disk with the Sys-Z bootblock. Apparently it does NOT write
itself indiscriminately to other disk's bootblocks, but only when the
user selects to do so.

Many Amiga users do not consider this to be a virus , but many others
do. In fact , at least one Virus Checker / Disinfectant / Obliterator
I know of considers it to be a virus , and identifies it as such. The
reason many do consider it a virus is the fact that it locates itself
in the bootblock. I believe that this "utility" hails from Europe ,
and might even of been of a commercial nature.

Perhaps someone else out there has more info on this creature. I have
never actually seen it in action , only seen documentation on it in
forums like this and in one Virus Killer's documentation.

--
  David P.M. Scollnik         |   UUCP:   utstat!davids
  University of Toronto       |  bitnet:  davids@utstat.utoronto
  Deptartment of Statistics   |    arpa:  davids@utstat.toronto.edu
  (hi mom !!!)