Nematode

A Nematode is a computer virus or worm that attempts to remove another virus. Nematodes have existed as long as viruses and worms themselves have. The idea is extremely controversial with most in the antivirus industry being strongly against it.

History

The first nematode named Reaper was created to combat the first worm, Creeper, which made its run through the ARPANET (the precursor to the Internet) in the early 1970's. Brain, the first IBM-compatible virus would be attacked by the Denzuko and Pentagon virus. In the era of Word macro viruses (mid to late 1990's), the Ethan virus deleted a file important to the Class virus, essentially neutralizing it.

In the era of mass mailer worms, a worm named All3gro attacked Sircam, Badtrans and Prettypark. Some variants of the Klez worm kill the processes of Codered and Nimda. Whether or not this worm can be considered a nematode is uncertain, as it also ends antivirus processes and drops the Elkern virus which seems to have no beneficial value. The coder Gigabyte coded Yahasux, which destroys a few variants of Yaha after one of them launched a denial of service attack on her website. Later that year, Welchia attacked the Blaster worm and attempted to download the patches that would prevent both worms from spreading. The Netsky and Sasser worms were created for the purpose of killing the dangerous information-stealing Beagle and Mydoom worms. This eventually escalated into a "worm war" with the two factions developing ways to thwart each other.

Controversy

Over time, viruses became synonymous with evil to the point that everything that could go wrong with a computer is sometimes ascribed to a virus. To some, the idea of a beneficial virus is an oxymoron. The antivirus industry is strongly against the idea that viruses or worms could ever be beneficial.

There are many reasons why a nematode or other kind of beneficial virus or worm may be a bad idea. Viruses and worms spread to some degree on their own accord, which means there is little control over them. The lack of control is itself a main cause of many of the other problems with the beneficial virus. Viruses and worms spread chaotically, and good system administration which could prevent the need for beneficial viruses, is orderly. In addition, a program that does not replicate itself can do anything a beneficial virus could do, and probably better.

A moderately useful beneficial self-replicator would consume a lot of resources. Even today (Mid-2012 at the time of this writing) a beneficial self-replicating program would have to be kept down in size to the point that it can do very little beyond attacking a select few malicious viruses. A full-featured antivirus program that sits on a hard drive or even flash drive can afford to be several hundred megabytes because hard drive (and to a certain extent, flash drive) space is plentiful and cheap. Thousands of them getting up and transporting themselves across the internet to other systems would mean a major slowdown.

There are also legal and ethical issues to consider. The beneficial virus or worm idea takes user consent out of the equation and assumes there are things that should be on every computer whether the user wants them or not. Sometimes warranties or support for software are voided when they are modified by a virus or worm.

In practice, nematodes have caused as many problems as other types of viruses and worms. Yui Kee, a Hong Kong-based security firm, noted that at some sites Welchia caused more disruption than Blaster, which it was created to destroy. It forced machines to shut down after downloading and installing the necessary patches, causing service interruptions. In spreading it strained network resources to send out its pings to find new systems.

Sources

Vesselin Bontchev. University of Hamburg, Virus Test Center, Are “Good” Computer Viruses Still a Bad Idea?

Yui Kee, Fools Rush In: W32/Welchia a Practical Demonstration in Stupidity. 2003.08.19

SecurityFocus. The Register, Good worms back on the agenda. 2006.01.30

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License