The year 1988 was fairly quiet, as far as virus writing went. Mostly, it was the year that anti-virus vendors started appearing, making a fuss about what was at that time only a potential problem, and not selling very much anti-virus software. The vendors were all small companies, selling their software for very low prices ($5 or $10 was common). Some of them were shareware, some were freeware. Occasionally some larger company tried to pop up, but no-one was paying serious cash to solve a potential problem.
In some ways, that was a pity, because 1988 was a very virus-friendly year. It gave Stoned, Cascade and Jerusalem a chance to spread undetected, and to establish a pool of infected objects that will ensure that they never become rare.
It was in 1988 that IBM realised that it had to take viruses seriously. This was not because of the well-known Christmas tree worm, which was pretty easy to deal with. It was because IBM had an outbreak of Cascade at the Lehulpe site, and found itself in the embarrassing position of having to inform its customers that they might have become infected there. In fact, there was no real problem, but from this point on, IBM took viruses very seriously indeed, and the High Integrity Computing Laboratory in Yorktown was given responsibility for the IBM research effort in this field.
1988 saw a few scattered, sporadic outbreaks of Brain, Italian, Stoned, Cascade and Jerusalem. It also saw the final arguments about whether viruses existed or not. Peter Norton, in an interview, said that they were an urban legend, like the crocodiles in the New York sewers, and one UK expert claimed that he had a proof that viruses were a figment of the imagination. In 1988, the real virus experts would debate with such people; after that year, real virus experts would simply walk away from anyone who had such absurd beliefs.
Each outbreak of a virus was dealt with on a case-by-case basis. One American claimed that he had a fully equipped mobile home for dealing with virus outbreaks (and another one extrapolated to the notion that soon there would be many such mobile units). Existing software was used to detect boot sector viruses (by inspecting the boot sector), and one-off software was written for dealing with outbreaks of Cascade and Jerusalem.
In 1988, a virus that is called “Virus-B” was written. This is another virus that doesn’t go memory resident, and it is a modification of another virus that deletes files on Friday 13th. When this virus is run, it displays “WARNING!!!! THIS PROGRAM IS INFECTED WITH VIRUS-B! IT WILL INFECT EVERY .COM FILE IN THE CURRENT SUBDIRECTORY!”. A virus that is as obvious as that, was clearly not written to spread. It was obviously written as a demonstration virus. Virus researchers are often asked for “harmless viruses” or “viruses for demonstration”; most researchers offer some alternative, such as an overhead foil, or a non-virus program that does a falling letters display. But it looks as if VIRUS-B was written with the intention of giving it away as a demonstration virus – hence the warning. And, indeed, we find that an American company was offering it to “large corporations, universities and research organizations” on a special access basis.
At the end of 1988, a few things happened almost at once. The first was a big outbreak of Jerusalem at a large financial institution, which meant that dozens of people were tied up in doing a big clean-up for several days. The second was that a company called S&S did the first ever Virus Seminar that actually explained what a virus was and how they worked. The third was Friday 13th. [S&S became what was known as Dr. Solomon Software, which has subsequently been purchased by Network Associates.]
It was clear that we couldn’t go out and help everyone with a virus, even if we bought a mobile home and equipped it (with what)? It was also clear that the financial institution, and the academic site, could easily handle a virus outbreak, but they didn’t have the tools to do the job. All they needed was a decent virus detector, which was not available. So we wrote one, added some other tools that experience said might be useful, and created the first Anti-Virus Toolkit.
In 1989, the first Friday 13th was in January. At the end of 1988, it was clear that Jerusalem was in Spain and the UK, at least, and was in academic as well as commercial sites. Because of the destructive payload in the virus, we felt that if we failed to send out some sort of warning, we would be negligent. But the media grabbed the ball and ran with it; the predictability of the trigger day, together with the feature of it being Friday 13th, caught their imagination, and the first virus media circus was under way.
On the 13th of January, we had dozens of phone calls, mostly from the media wanting to know if the world had ended yet. But we also had calls from a large corporate site, a small vendor of PC hardware, and a couple of single users. We were invaded by TV cameras in droves, and had to schedule them carefully to avoid them tripping over each other. In the middle of all this, the PC Support person from the infected corporation arrived. The TV people wanted nothing better than a victim to film, but the corporate person wanted anonymity. We pretended that he was just one of our staff. Also, at that time, British Rail contacted us; they also had an outbreak of Jerusalem, and they went public on it. Later, they regretted that decision, because for a long time afterwards, their PC Support person was badgered by the media seeking interviews.
The information in this section was provided by and used with permission of Dr. Solomon Software. Please do not further use the material without obtaining your own permission to use it.
 Dr Solomon History |
|
 |
 |
| 1986-1987 The Prologue | 1989 Datacrime |