BEGPAND.CVP  931111
 
                        3.4 Weird Behaviour
 
As I have mentioned, there are a great many things that computers do
which have nothing to do with viral programs.  People are all too
ready to cry virus for every oddity they see.
 
The truth is, most viral programs do not display any overt signs. 
The viri that do are self-limiting, because they alert the user to
something wrong, and therefore get destroyed before they have a
chance to spread.  The Stoned virus, for example, is said to display
the message, "Your PC is now Stoned," on the screen.  It does--very
rarely.  The only time it might display is when the computer is
booted from an infected floppy disk.  Even then, there is only a one
in eight chance that it will display.  Once the infection is
resident on the hard drive, unless you boot from an infected floppy
disk again you will never see the message display.
 
The MacMag virus was said to display a "universal message of world
peace."  This, however, would only happen on the target date of
March 2, 1988.  At any time before that, there was no overt sign of
any change.  The Scores virus, on the other hand, did make some
overt changes to both folders and icons.  These changes, though,
were not very spectacular, and unless you knew the virus and its
effects, it was not something many users noticed.
 
Some changes, of course, are inevitable:  that is the idea behind
change detection software.  The Monkey virus affects the hard disk
such that, when the computer is booted from a clean disk, the hard
disk is inaccessible.  Of course, most security software does the
same thing.  Both Stoned and Michelangelo reduce the "total memory"
as reported by DOS.  Of course, a lot of computers do the same
thing.  High density disks infected by Stoned may become unreadable. 
Of course, lots of disks become unreadable for no apparent reason. 
Windows programs will refuse to run if infected by a virus.  Of
course, Windows seems to take random "time outs" anyway.
 
If you suspect a virus simply on the basis of odd behaviour, please
get a scanner and check it out.  Get a very new, very good scanner. 
If you still want to report odd behaviour, please give all details
of your computer, your operating system, your resident programs, any
device drivers, and which specific antiviral programs you have used
to assess the problem.  Get the behaviour to reproduce, and give
specific details of how you do it.  (Reports of intermittent
oddities are almost useless.)
 
copyright Robert M. Slade, 1993   BEGPAND.CVP  931111

==============                      
Vancouver      ROBERTS@decus.ca    | "A modern US Navy cruiser now requires 
Institute for  Robert_Slade@sfu.ca |  26 tons of manuals.  This is enough 
Research into  rslade@cue.bc.ca    |  to affect the vessel's performance."
User           p1@CyberStore.ca    |             "New Scientist" article
Security       Canada V7K 2G6      |              on the "paperless office"