DEFGEN3.CVP   910714
 
                   Specialty viral programs
 
If we stick to a strictly "Cohenesque" definition of viral
programs as only those which attach to specific programs, then
there are some difficulties with defining other, similar,
programs which reproduce themselves, but without being linked to
a specific program.
 
Unfortunately, although attempts have been made to address this
issue, there is, as yet, little agreement as to the terminology.
 
In early multitasking operating systems, programs often "broke
the bounds", and would overwrite sections of other programs or
data.  Since this damage was generally random, the pattern of
damage, when mapped, gave the appearance of twisting tracks
which appeared and disappeared.  This closely resembled the
patterns seen when cutting through a piece of worm eaten wood,
giving rise to the term "worm" for such rogue programs.  One
such program escaped not only from its own partition within the
computer, but actually escaped from the orginal computer to
another over an early computer networking system.  The term
"worm" has therefore come to be used to refer to viral programs
which do not attach to specific programs, and, more
specifically, to those which use network communications as a
vehicle for spreading and reproduction.
 
Two examples of this usage are the famous Morris/Internet/UNIX
worm of late 1988, and the lesser known CHRISTMA EXEC mail worm
of December 1987.
 
This still leaves a class of viral programs which do not attach
specifically to programs.  There are actually many sub-groupings
within this group, and there are within viral programs
generally.  However, European researchers, particularly those
from France, often refer to such programs as "bacteria", rather
than viri.
 
In these areas of terminology there is often much debate about
whether a given virus, or type of viral program, fits into a
given class.  Boot sector infectors, for example, would not
appear to fit the definition of a virus as infecting another
program, since BSI's can be spread by disks which do not contain
any program files.  However, the boot sector of a normal disk,
whether or not it is a "system" or bootable disk, always does
contain a program (even if it only states that the disk is not
bootable), and so it can be said that a BSI is a "true" virus.
 
copyright Robert M. Slade, 1991   DEFGEN3.CVP   910714

===================
Vancouver          ROBERTS@decus.ca         | "Power users think
Institute for      Robert_Slade@sfu.ca      |  'Your PC is now
Research into      rslade@cue.bc.ca         |  Stoned' is part of
User               p1@CyberStore.ca         |  the DOS copyright
Security           Canada V7K 2G6           |  line." R. Murnane