🚀 go-pugleaf

 Read alt.hackers 
 There was a long article by Joe Dellinger claiming to have invented the
 first virus on an Apple II.  

 Please post any other good references you find! 

 - Steve Majewski / UVA Physiology 

In article <BAKER2.90A...@husc9.harvard.edu> bak...@husc9.harvard.edu
(James Baker) writes: 
   I am interested in finding sources on the history of viruses, Trojan
   horses, worms, and the like, especially conceptual history.  I would
   like to know, for example, the answers to questions like when were
   these terms introduced (I understand Cohen introduced the term
   ``computer virus'') or how have they evolved -- that sort of thing.

I believe the use of the term "Trojan Horse" in conjunction with computer
security was coined by Dan Edwards when he was with the National Computer
Security Center. If you are doing research in this area, you might try
contacting the center, or sending a message to misc.security (which is ready
by many NCSC personnel)

Daniel 

--
[W]:The Aerospace Corp M1/055 * POB 92957 * LA, CA 90009-2957 * 213/336-8228
[H]:9758 Natick Avenue * Sepulveda CA 91343 * 818/892-8555  | If you turn it
[Em]:fai...@aerospace.aero.org * Fai...@dockmaster.ncsc.mil | over and don't
[Vmail]:213/336-5454 Box#3149            | let it go, you end up upside down

In article <4...@helens.Stanford.EDU> ne...@helens.Stanford.EDU (news) writes:
>In article <BAKER2.90A...@husc9.harvard.edu> bak...@husc9.harvard.edu (James Baker) writes:

>PS: Although there are still a fair number of people out there with DOS 3.3
>disks, I just can't seem to get people excited enough to bother looking for
>my old virus. I've only heard back from TWO people! ...

He he... Single-host viruses dies out when their host dies out.
Will this be the first COMPUTER virus destined for extinction?
Why isn't the WWF doing anything!!??

(Alright, already! I know the Appe ][ isn't dead. Yet :-))

(It's no use, I have a CO2 extinguisher nearby!)


-- 
Per Lindberg (The Mad Programmer)  !      __!__
Front Capital Systems              !  _____(_)_____  Ceci n'est pas une Piper
Linneg 5, 11447 Stockholm, Sweden  !     !  !  !

In article <10...@front.se> p...@front.se (Per Lindberg) writes:
>He he... Single-host viruses dies out when their host dies out.
>Will this be the first COMPUTER virus destined for extinction?
>Why isn't the WWF doing anything!!??

Well, there is an interesting point here: Macintoshes and IBM PC's seem to
be CRAWLING with many strains of viruses. One person on comp.virus reported
a single file infected with three viruses simultaneously! On the other hand,
it seems viruses on Apple ]['s were pretty rare. A few existed, including
mine, but none of them ever seems to have reached anywhere near epidemic
proportions. Most Apple ][ users I've heard back from report NEVER
encountering _any_ viruses.

What's the difference? An Apple ][ was an ideal machine to write a virus
for. There was massive copying of software. There's been plenty of
time for viruses to have become entrenched. Why didn't they? My guess is that
the proliferation of non-standard DOS's (I never realized there were so many
DOS variants in common use out there. Dozens of them. Wow!) and the LACK of
standard methods of interfacing with the OS (such as it was) are responsible.
Most viruses are _extremely_ host-specific, where "host" means both the
hardware AND the OS.

Can we infer the general rule that a heterogeneous software population is the
best deterrent to runaway infection? (After all, people have a large number
of different HLa types. Why? Smallpox is much deadlier for people with blood
type "A" than "O". Why are there any people with bloodtype "A" still around?)
Our computer's non-standard "fingd" did not fall prey to Morris' internet
worm, even though it works fine as a "fingd". My point is that worms and
viruses usually depend on a lot of things being exactly a certain way.
Good network programs, on the other hand, can only assume the bare minimum
protocols defined in the RFCs. There may be some escape hatch like Berkeley
sendmail's "debug" option, but only ONE "genotype" of sendmail program fell
prey to that attack.
\    /\    /\    /\/\/\/\/\/\/\.-.-.-.-.......___________
 \  /  \  /  \  /Dept of Geophysics, Stanford University \/\/\.-.-....___
  \/    \/    \/Joe Dellinger j...@hanauma.stanford.edu  apple!hanauma!joe\/\.-._
************** Drive Friendly, Y'all! ******************************************

In article <4...@helens.Stanford.EDU> j...@hanauma.stanford.edu (Joe Dellinger) writes:
>What's the difference? An Apple ][ was an ideal machine to write a virus
>for. There was massive copying of software. There's been plenty of
>time for viruses to have become entrenched. Why didn't they? My guess is that
>the proliferation of non-standard DOS's (I never realized there were so many
>DOS variants in common use out there. Dozens of them. Wow!) and the LACK of
>standard methods of interfacing with the OS (such as it was) are responsible.
>Most viruses are _extremely_ host-specific, where "host" means both the
>hardware AND the OS.
>

There is a difference.  The Apple ][ was rebooted each time that a new program
was started.  A PC, you load DOS once, and then use it until you power down the 
system, or it crashes.  For this reason, a IBM virus will be *FAR* more 
dangerous than an Apple ][ virus.  The same that is true for PC's is also true
for Macs.


------------------------------------------------------------------------
| Jochen Fritz            | For though we live in the world, we do not |
| joef...@pawl.rpi.edu   | wage war as the world does.-- 2 Cor. 10:3  |      
| usergk2s@rpitsmts.bitnet| You have heard it said, Love your neighbor |
| Noah [the peace monger] | and hate your enemy.  But I tell you: Love |
|                         | your enemies.  Matt. 5:43-44               |
------------------------------------------------------------------------

In article <2^S#*^+@rpi.edu> joef...@pawl.rpi.edu (Jochen M. Fritz) writes:
>There is a difference.  The Apple ][ was rebooted each time that a new program
>was started.  A PC, you load DOS once, and then use it until you power down the 
>system, or it crashes.  For this reason, a IBM virus will be *FAR* more 
>dangerous than an Apple ][ virus.  The same that is true for PC's is also true
>for Macs.

At least you said "was" and not "is."  You normally rebooted DOS 3.3, but
ProDOS had a way of changing habits--especially with a hard disk around.  Even
without one (I only have two 5.25" drives on my IIe), I'd rather jump into
Bird's Better Bye than blow a whole five seconds rebooting ProDOS.  You'd think
that the Apple II today would be as much a petri dish as the Macintosh, but
fortunately for II users, that hasn't been the case.  There are only a couple
known Apple II viruses (CyberAIDS and Festering Hate come to mind), but I've
never seen either one.

Scott Alfter-------------------------------------------------------------------
Internet: saa3...@uxa.cso.uiuc.edu   _/_  Apple II: the power to be your best!
          alfter@mrcnext.cso.uiuc.edu/ v \
          cs1...@ux1.cso.uiuc.edu  (    (              A keyboard--how quaint!
  Bitnet: free0066@uiucvmd.bitnet    \_^_/                     --M. Scott, STIV

	I've posted my virus story to the net. Now it's your turn.

1) When did you FIRST hear of a "computer virus"? What was your reaction
to the idea?

2) When did you FIRST encounter a living, breathing virus? What did it do?
What machine was it on? What did you do about it?

	If anybody out there can answer "YES" to either question pre-1986,
say, then speak up! This is the group for it!

	[A visiting Russian scholar in our research group tells me of a
PDP-11-clone (I think?) virus running amock in the archaic computers in
Moscow that his research group created for fun. This was written after PC
viruses were already common in the US, but there's no reason such a thing
couldn't have existed in the US much earlier, say in the 70's. Any folklore?]
\    /\    /\    /\/\/\/\/\/\/\.-.-.-.-.......___________
 \  /  \  /  \  /Dept of Geophysics, Stanford University \/\/\.-.-....___
  \/    \/    \/Joe Dellinger j...@hanauma.stanford.edu  apple!hanauma!joe\/\.-._
************** Drive Friendly, Y'all! ******************************************

joef...@pawl.rpi.edu (Jochen M. Fritz) writes:
>The Apple ][ was rebooted each time that a new program
>was started.

You're confused.  CP/M did a warm boot every time a program ended.
You generally rebooted an Apple when you crashed the machine or if you
had to run a copy-protected program.

>A PC, you load DOS once, and then use it until you power down the 
>system, or it crashes.  For this reason, a IBM virus will be *FAR* more 
>dangerous than an Apple ][ virus.

Nope, the reason is that that machine has a hell of a lot more
resources than the Apple ][ had.  You can write far more sophisticated
viruses.

Apologies that this isn't folklore.

jim frost
saber software
ji...@saber.com

In article <71...@ucdavis.ucdavis.edu>, saa3...@uxa.cso.uiuc.edu (Scott Alfter)
says:
>At least you said "was" and not "is."  You normally rebooted DOS 3.3, but
>ProDOS had a way of changing habits--especially with a hard disk around.  Even
>without one (I only have two 5.25" drives on my IIe), I'd rather jump into
>Bird's Better Bye than blow a whole five seconds rebooting ProDOS.

DOS 3.3 doesn't need rebooting any more than ProDOS does.  In fact, I
usually don't reboot DOS 3.3 but I do reboot ProDOS.  The reason for this
is that my DOS 3.3 disks are all old, or copies I've made from old disks.
So I'm pretty sure they don't have any viruses.  But many of my ProDOS
disks are newer, so I'm more careful with them.  And even so, my ProDOS
disks frequently fail; track 0 often gets errors after only a couple weeks
of use.  I don't know if that's because of a virus or because of a hardware
problem.  (ProDOS uses track 0 far more often than DOS 3.3 does.)
-------
Dean Hickerson,  Dept. of Math., Penn State Univ., University Park, PA 16802
h...@psuvm.psu.edu

The second virus I heard about was the infamous "cookie monster".
Someone at the University managed to infect the op sys on the
Burroughs (a large mainframe offering time-share and botch services).

At unpredictable intervals, the system would stop doing useful work,
and type out a message on the console: "I want a cookie".  Each time,
the system would have to be re-booted.

After a few such stoppages, the powers that were got tired of this.
They also had a pretty good idea who was to blame; the next time the
system stopped for a cookie break, the offender was called to explain
what he had done, and what he proposed to do about it.

He went over to the console, and typed in the correct magic:
	"HAVE A COOKIE"
after which the operating system appears to have returned to
its normal virginal self.
-- 
...!{bikini.cis.ufl.edu allegra bpa uunet!cdin-1}!ki4pv!tanner

In article <4...@helens.Stanford.EDU> j...@hanauma.stanford.edu (Joe Dellinger) writes:

} 	I've posted my virus story to the net. Now it's your turn.

} 1) When did you FIRST hear of a "computer virus"?

...

} 	If anybody out there can answer "YES" to either question pre-1986,
} say, then speak up! This is the group for it!

I have in front of me:
    Notes on the "Worm" programs --- some early experience with a distributed
    computation
       John Shoch and Jon Hupp, May 1980, Revised Sept 1980
       copyright Xerox (a preprint of a paper it is claimed "to be presented
       at the {\it Workshop on Fundamental Issues in Distributed Computing},
       ACM/SIGOPS and ACM/SIGPLAN, Pala Mesa Resort, December 1980.

Abstact:  The "Worm" programs were an experniment in the development of
distributed computations --- programs that would span machine boundaries and
also replicate themselves in idle machines.  A "worm" is composed of multiple
"segments" each running on a different machine.  The underlying worm
maintenance mechanisms were responsible for maintainint the worm --- finding
free machines when needed, and replicating the program for each additional
segment.  The worm control procedures require some careful design, but this
mechanism made each worm a very dynamic and robust program.

   __
  /  )                              Bernie Cosell
 /--<  _  __  __   o _              BBN Sys & Tech, Cambridge, MA 02138
/___/_(<_/ (_/) )_(_(<_             cos...@bbn.com

In article <4...@helens.Stanford.EDU> j...@hanauma.stanford.edu (Joe Dellinger) writes:
>
>	I've posted my virus story to the net. Now it's your turn.
>
>1) When did you FIRST hear of a "computer virus"? What was your reaction
>to the idea?

I had heard about it almost as soon as I got into computers, back in the
early 80s.  Don't recall exactly when, but at that time viruses were more
theoretical threats to computing than actual.

>2) When did you FIRST encounter a living, breathing virus? What did it do?
>What machine was it on? What did you do about it?

Well, it wasn't REALLY a virus, more like a Trojan horse, but nowadays you
can get away with calling just about anything a virus.  My first (and
fortunately so far the only) experience with this scourge was with ARC 5.13.
As many of you know, SEA's ARC program was the compression program of choice
back in the mid-80s for BBS files on PCs.  (Now it's ZIP)  In spring of 1986
the latest version of ARC was 5.12.  All of a sudden, a new version appeared
called 5.13.  Since status is important on BBSes, this "new" version spread
like wildfire.  And since most BBS users use ARC frequently, even though it
was not a virus, it was very effective.  I downloaded it, stuck it in my
\DOS directory, and started to use it.  At this time I was a very active
downloader.  A couple of weeks later I took my IBM AT into school to
demonstrate part of a Biology Science Project I was doing.  Shortly after I
brought the computer back home, the Hard Disk started getting errors galore.
Since I had a real AT with the infamous CMI Hard Disks, and had just
transported it to school, I figured the Hard Disk was finally dying.  But
never giving up hope, I did a low-level format, and brought the disk back to
life.  Numerous tests made it appear as if everything was working fine.  So
I took out my backup floppies (I actually had backed up my hard drive just
days befeore!) and restored them to the Hard Disk.  Again, everything worked
fine for a couple of weeks, and then all of a sudden, everything was
breaking.  Fortunately, by this time the story had gotten out about ARC 5.13
being a Trojan Horse, so I got rid of it, reformatted everything, and went
back to business.  Since then I have not been hit by any such programs on
IBM compatible systems, even though I now check regularly for infections.
On the other hand, my roommate has had his Mac infected several times just
in the last few months.

Jim Lick                  | Internet: j...@piggy.ucsb.edu
775 Camino Del Sur #A11   | UUCP: ...uunet!piggy.ucsb.edu!jim
Isla Vista, CA 93117-4410 | 
(805) 968-0189 (eve)      | Because when you learn,    
(805) 961-4113 (day)      | You'll know what makes the world turn.

In article <00001BP@ki4pv.UUCP> tanner@ki4pv.UUCP (Dr. T. Andrews) writes:
>The second virus I heard about was the infamous "cookie monster".
>Someone at the University managed to infect the op sys on the
>Burroughs (a large mainframe offering time-share and botch services).
>
Interesting.

Just this weekend, I was talking with a reliable authority about viruses 
(get a life, Mitch! Don't talk computers on the weekend!), and he told 
me the Cookie Monster was an urban myth; he could never find anyone 
who was actually infected by it...

And now I see this.

Anybody out there have actual first-hand experience with the Cookie Monster?

(This is not a flame; just curious).

-- 
Mitch                                                   wagner@utoday.UUCP

"I was gratified to be able to answer promptly, and I did. I said I didn't
know."                            ---Mark Twain, "Life on the Mississippi"

In article <1589@utoday.UUCP>, wagner@utoday.UUCP (Mitch Wagner) writes...
^In article <00001BP@ki4pv.UUCP> tanner@ki4pv.UUCP (Dr. T. Andrews) writes:
^>The second virus I heard about was the infamous "cookie monster".
^>Someone at the University managed to infect the op sys on the
^>Burroughs (a large mainframe offering time-share and botch services).
^>
^Interesting.
^ 
^Just this weekend, I was talking with a reliable authority about viruses 
^(get a life, Mitch! Don't talk computers on the weekend!), and he told 
^me the Cookie Monster was an urban myth; he could never find anyone 
^who was actually infected by it...
^ 
^And now I see this.
^ 
^Anybody out there have actual first-hand experience with the Cookie Monster?
^ 
^(This is not a flame; just curious).
^ 
^-- 
^Mitch                                                   wagner@utoday.UUCP
^ 
^"I was gratified to be able to answer promptly, and I did. I said I didn't
^know."                            ---Mark Twain, "Life on the Mississippi"

I'm not sure what the Cookie Monster is in your post.  We did have a trojan
at UMD that emulated the IBM and asked for cookies.  Cute but it did screw up
some of the newer users.  The consultants could break out of it easily.

Session ran something like this:

>LOGOFF
"No...You can't LOGOFF until you give me a cookie!"
>STOP
"I wanna a cookie!  You can STOP later."
>QUIT
"Gimme a cookie or you'll be sorry!"
>COOKIE
"Gimme another cookie!"
>OREO COOKIE
"I don't want a fancy oreo cookie...just gimme a COOKIE!"

ad nauseum

I recall that if you did give it enough cookies it let you go.  Then again if
you dropped into CP you could IPL out of it.  Eventually I think there was
version that remapped the CP key to something else.  I'm not sure but if you
told it to fuck off I think it did something nasty but it's been a real long
time.  Maybe Jo Brooks remembers enough of it...(r u there?)

NT

--------------------------------------------------------------------------------
   // | Nigel Tzeng - STX Inc - NASA/GSFC COBE Project
 \X/  | xr...@amarna.gsfc.nasa.gov
      | 
Amiga | Standard Disclaimer Applies:  The opinions expressed are my own. 
--------------------------------------------------------------------------------

In article <1589@utoday.UUCP> wagner@.UUCP (Mitch Wagner) writes:
|In article <00001BP@ki4pv.UUCP> tanner@ki4pv.UUCP (Dr. T. Andrews) writes:
|>The second virus I heard about was the infamous "cookie monster".
|>Someone at the University managed to infect the op sys on the
|>Burroughs (a large mainframe offering time-share and botch services).
|Just this weekend, I was talking with a reliable authority about viruses 
|(get a life, Mitch! Don't talk computers on the weekend!), and he told 
|me the Cookie Monster was an urban myth; he could never find anyone 
|who was actually infected by it...
|
|Anybody out there have actual first-hand experience with the Cookie Monster?

I haven't, but I believe in its existence and I'll tell you why:

It is consistently reported to have "infested" the ITS (Incompatible
Time Sharing) PDP-6 and -10 systems at MIT.  While I didn't see the
Cookie Monster, I have a small(*) acquaintance with the ITS machines
and I can see how a daemon/background/detached process (not virus!)
could behave that way; further, since ITS was ONLY at MIT, that is the
only place it could have been found.  No one who was not actually
there at the time could have experienced it first hand.

	/JBL

(*)Very small -- I used to connect and "login" (sort of) and poke
around with the help of DDT once in a while.
=
Nets: le...@bbn.com  |  "There were sweetheart roses on Yancey Wilmerding's
 or {...}!bbn!levin  |  bureau that morning.  Wide-eyed and distraught, she
POTS: (617)873-3463  |  stood with all her faculties rooted to the floor."

[]

	"I was talking with a reliable authority about viruses ... and
	he told me the Cookie Monster was an urban myth ..."

In 1975, somebody published a look-alike to Time magazine about
Honeywell computers.  (They said they had permission from Time.)  I
wish I could remember who published it, or how I got a copy, but these
brittle organic memories have faded.  It was probably published by
Honeywell in an act of self-congratulation, and it was probably
enclosed with a trade rag.

This magazine included an article on a cookie monster program which ran
on a Honeywell machine and wouldn't leave the user alone until they had
keyed the magic word.  The described program was a daemon, not a virus
-- a single background job would awaken at random times, haunt the user
until satisfied, then go back to sleep.

I was an unprincipled teenager at the time, and I was inspired to
create such a monster for my employer's PDP-10.  It lived within a
utility.  I performed the "infection" manually; the program had no
reproductive capability, so it was not a virus.

  -=- Andrew Klossner   (uunet!tektronix!frip.WV.TEK!andrew)    [UUCP]
                        (andrew%frip...@relay.cs.net)   [ARPA]

In article <54...@bbn.COM> le...@BBN.COM (Joel B Levin) writes:
>In article <1589@utoday.UUCP> wagner@.UUCP (Mitch Wagner) writes:
>|Anybody out there have actual first-hand experience with the Cookie Monster?
>
>I haven't, but I believe in its existence and I'll tell you why:
>
>It is consistently reported to have "infested" the ITS (Incompatible
>Time Sharing) PDP-6 and -10 systems at MIT.

Yes.  The major variants were Cookie Bear, Susan Ford (wanting a date),
and Richard Nixon (wanting a pardon).

>since ITS was ONLY at MIT, that is the
>only place it could have been found.  No one who was not actually
>there at the time could have experienced it first hand.

Wrong on several points:
. Cookie Bear was also implemented for TOPS-10 at Stevens Tech.  There was
  the simple version and the TimeSharing Cookie Bear (TSCB) version.  TSCB
  could fill up a volume of folklore...
. I wrote a Cookie Bear for TOPS-20.
. ITS systems exist at other than MIT, albeit as more or less PC's.

Disclaimer: I have had nothing to do with Cookie Bear programs in over 12
years!!!

 _____   | ____ ___|___   /__   Mark Crispin           Atheist & Proud
 _|_|_  -|- ||   __|__   /  /   6158 Lariat Loop NE    R90/6 pilot
|_|_|_|  |\-++-  |===|  /  /    Bainbridge Island, WA  "Gaijin! Gaijin!"
 --|--  /| ||||  |___|    /\    USA  98110-2098        "Gaijin ha doko ka?"
  /|\    | |/\| _______  /  \   +1 (206) 842-2385      "Niichan ha gaijin."
 / | \   | |__|  /   \  /    \  m...@CAC.Washington.EDU "Chigau. Gaijin ja nai.
kisha no kisha ga kisha de kisha-shita                  Omae ha gaijin darou."
sumomo mo momo, momo mo momo, momo ni mo iroiro aru    "Iie, boku ha nihonjin."
uraniwa ni wa niwa, niwa ni wa niwa niwatori ga iru    "Souka. Yappari gaijin!"

cos...@bbn.com (Bernie Cosell) writes:
>} 1) When did you FIRST hear of a "computer virus"?
>} 	If anybody out there can answer "YES" to either question pre-1986,
>I have in front of me:
>    Notes on the "Worm" programs --- some early experience with a distributed
>    computation
>       John Shoch and Jon Hupp, May 1980, Revised Sept 1980
>Abstact:  The "Worm" programs were an experniment in the development of
>distributed computations --- programs that would span machine boundaries and
>also replicate themselves in idle machines.  A "worm" is composed of multiple
>"segments" each running on a different machine.

The fictional account "The Adolescence of P-1," Thomas J. Ryan, 1977,
gives a remarkable description of such a beast.  The hardware is
out-of-date and he skips a lot of details, but it's worth reading.  It
may have been this book that gave me the idea of creating a
self-replicating program ("virus" nowadays) back in 1984 when I
experimented with one on the Apple ][.

Among the most interesting things about the book is the total
disregard of other hardware types than the IBM/360 series.

Happy hacking,

jim frost
saber software
ji...@saber.com

wagner@utoday.UUCP (Mitch Wagner) writes:

>Anybody out there have actual first-hand experience with the Cookie Monster?

One of the system programmers (Face, do you read this newsgroup?)
at the University of Arizona Computer Center back in the mid-70's
had a "cookie" program on the Center's DEC-10 (running under TOPS-10).
When run by a privileged user (operator), it would every once in a
while type out "COOKIE?" on a terminal.  If you didn't respond by typing
"cookie" back at at, it would eventually do something evil to you job.
This was done as good-natured fun....the perpetrator would only do
it to fellow system programmers, or other fair game.

Steve Jay
s...@ultra.com  ...ames!ultra!shj
Ultra Network Technologies / 101 Dagget Drive / San Jose, CA 95134 / USA
(408) 922-0100 x130	"Home of the 1 Gigabit/Second network"

    John Brunner, in _Shockwave Rider_, describes worms designed to spread
through a data net connecting pretty much everything, with functions ranging
from deleting all traces of an old identity and creating a new one, to gathering
government/corporate documents concealing government/corporate mischief and
publicizing them. I remember reading it in high school, which dates it to 
86 or earlier.  I think it's a 70s-era book...Brunner's best work dates from
65-73 or so, judging from my collection.  I thought I had a copy.  If I
find it, I'll post the date.  (And it is recommended, although not as 
highly as Stand on Zanzibar, or The Sheep Look Up (recommended for Earth Day :-)
))
                                                            Aaron |><>

In article <66...@blake.acs.washington.edu> m...@Tomobiki-Cho.CAC.Washington.EDU (Mark Crispin) writes:
>In article <54...@bbn.COM> le...@BBN.COM (Joel B Levin) writes:
>>In article <1589@utoday.UUCP> wagner@.UUCP (Mitch Wagner) writes:
>>>Anybody out there have actual first-hand experience with the Cookie Monster?
>
>>since ITS was ONLY at MIT, that is the
>>only place it could have been found.  No one who was not actually
>>there at the time could have experienced it first hand.
>
>Wrong on several points:
>. Cookie Bear was also implemented for TOPS-10 at Stevens Tech.  There was

It was also ported to Honeywell Multics machines.  Not surprising since
Multics was (co-)developed at MIT.  It was to be found on at least 6
Multices in the world to my certain knowledge, since I had accounts on
them and so could check.  (On one, the one we had at Bristol from about
79-88, it lived in my hierarchy.)  I suspect it was on pretty much all
of them.

-- 
Paul Smee, Computing Service, University of Bristol, Bristol BS8 1UD, UK
 P.S...@bristol.ac.uk - ..!uunet!ukc!bsmail!p.smee - Tel +44 272 303132

In article <68...@orca.wv.tek.com> and...@frip.wv.tek.com writes:
>[]
>
>	"I was talking with a reliable authority about viruses ... and
>	he told me the Cookie Monster was an urban myth ..."
>
>In 1975, somebody published a look-alike to Time magazine about
>Honeywell computers.  (They said they had permission from Time.)  I
> [...]
>This magazine included an article on a cookie monster program which ran
>on a Honeywell machine and wouldn't leave the user alone until they had
>keyed the magic word.

I didn't see that article, but in late 1974 I had such a program running
occasionally on Multics, which of course was running on a Honeywell 6180.
It was another weapon in the MIT "terminal wars" -- you could unleash
the Cookie Monster on someone else's terminal.

>The described program was a daemon, not a virus
>-- a single background job would awaken at random times, haunt the user
>until satisfied, then go back to sleep.

Exactly.  It would sleep for a random interval, then ask for a cookie:
   I want a cookie.
The interval would get shorter and shorter, with the demands getting
stronger and more insistent:
   I said, I want a cookie!
   ...
   Give me a cookie!!
   ...
   I WANT A COOKIE!!!!
   ...
and so on.  Eventually, the victim's terminal (almost always an IBM
2741) would be spending all its time printing these messages, which
degenerated into punctuation (swearing).  It was just waiting for
the user to run the "cookie" command, which was done by typing the
name of the command:
   cookie
which would communicate that fact to the Cookie Monster.  Once they did,
the Monster said:
   Thanks!  Yum, yum!!
and the user's terminal was back to normal.

The "interesting" feature was that the [half-duplex] 2741 keyboard
locks when the computer is sending output, so by this time the user
couldn't very well do anything but hang up his dataset (modem) and
log back in.

Not a virus, not a trojan horse (well, I guess the "cookie" was, in
manner of speaking, since it was a program which was inadvertently
executed by the user when he thought he was doing something else),
not a worm, but still pretty rude.

I have no idea if the Time article was talking about my program or
someone else's.  However, this first-hand testimony that the Cookie Monster
was not just Urban Myth.

-Eric

-- 
Eric Black	"Garbage in, Gospel out"
Atherton Technology, 1333 Bordeaux Dr., Sunnyvale, CA, 94089
  Email: er...@Atherton.COM     Voice: +1 408 734 9822

In article <00001BP@ki4pv.UUCP> tanner@ki4pv.UUCP (Dr. T. Andrews) writes:
>The second virus I heard about was the infamous "cookie monster".
>Someone at the University managed to infect the op sys on the
>Burroughs (a large mainframe offering time-share and botch services).
>

Hopefully you folks have a sense of humor that is similar to mine....

I almost died laughing at the obvious (I think) typo.  And then concluded that
you really can't beat an I(nferior) B(ut) M(arketable) machine for BOTCH
services.  Sorry about the interruption, couldn't help myself, hairy toads from
Neptune made me do it, etc.

Walt K.

koz...@halibut.nosc.mil (Walter A. Koziarz) writes:
>In article <00001BP@ki4pv.UUCP> tanner@ki4pv.UUCP (Dr. T. Andrews) writes:
>>The second virus I heard about was the infamous "cookie monster".
>>Someone at the University managed to infect the op sys on the
>>Burroughs (a large mainframe offering time-share and botch services).

>Hopefully you folks have a sense of humor that is similar to mine....
>I almost died laughing at the obvious (I think) typo.  And then concluded that
>you really can't beat an I(nferior) B(ut) M(arketable) machine for BOTCH
>services.  Sorry about the interruption, couldn't help myself, hairy toads from
>Neptune made me do it, etc.

That's OK - the first time I read it, I thought it said "...managed to infect
the sysop on the Burroughs..."  You know, the system operator him/herself.

>Walt K.

-- 
Kevin Martin  |||  si...@pawl.rpi.edu  |||  usergkj1@RPITSMTS.BITNET
"And tonight, on Spot Your Lucky Warts..." - Alien Sex Fiend