CrisNews #2  -  05/01/94

Reprinted With Permission
By: Cris Research Staff


                             The Virus Threat
                           (c) Ian Douglas 1993

Has the threat from viruses started to decline? �The number of viruses for the
IBM PC (Intel x86) platform grows daily, but various events are making the IBM
environment safer. �(Experts predict around 4000 - 6000 DOS viruses by the end
of 1994.)

Chief �amongst these is the move away from DOS to new operating systems. ��The
trend �started �with �Windows �(not really �an �operating �system), ��and �has
accelerated with the advent of a reliable OS/2. �Further down the line, �there
is Windows NT and UNIX. �These environments are very unfriendly for the �3000+
DOS-based viruses. �There is a joke that Windows is a good virus detector - if
a Windows file gets infected by a DOS virus, it crashes :-)

There �are two known viruses that can infect Windows executables, �but none at
present that can infect OS/2 �executables. �No known DOS viruses can run under
native �OS/2, �but only in a DOS session. �Also, �the constant upgrades to DOS
itself prevent some viruses from working altogether.

There �are three main areas of virus spread: �Large �businesses, ��educational
institutions, and swopping disks among friends. Many large business are moving
to OS/2, �others will move to Windows NT. In both cases, �they are cutting out
an important vector of virus spread. �I �foresee that educational institutions
will �also move to these new operating systems in the near future. �The market
will �demand �students trained in them. �This will once again cut out a �major
vector for virus spreading.

That �leaves �the average user, �still running DOS. �His has �less �chance �of
getting a virus, since the two main vectors are being cut out. The most common
viruses �are boot sector infectors, �like Stoned. �While these may be able �to
infect a machine running OS/2, they will not spread from such a machine.

The other interesting development has been in the underground. �In the race to
create �the super-duper type viruses, �they have been trying to write �complex
viruses. These take longer to write and are usually more buggy. Thus they make
fewer �viruses. ��In �order to brag, �they publish the viruses �in �electronic
magazines, and make them available for download on virus exchange BBS's. �This
means �that they end up in the hands of anti-virus authors, �before they �have
had a chance to spread widely. Thus the AV authors soon include detection, and
the virus does not spread very much.

Many virus exchange BBS's have mostly junk (virus wannabe's) �available. Since
the �person �downloading it only finds out afterwards, �the spread of �viruses
from these BBS's is not as bad as it might have been.

There �also �seems �to �be a growing maturity �amongst �some �members �of �the
underground, �leading to fewer virus writers and viruses. Hopefully, they will
ALL grow up soon.


Cheers, Ian