Blue Coat Systems - Exhibit 1010 Part 2 of 3
`
`

`
`EEFTEI1-'|flER F995 * Ii-5
`|i'IR,|..|£.'£-l..|'I..LE'.|'l.|'~i|
`
`
`e Wlist happens siitlt tiles in £'F'i*s tnettted via 51'.:iIi'lT'.'iI.'.'.li'.|i'. etc!
`
`The eeneept can lie eitiended ee such s-ei1.m-um tee -tisniigii 3».-eu‘-i have tu eell upan the tieeiea
`diiirertlust manages that drive tn ]:Ierliaru1 disit I.-‘CI- That is a negative paint.‘ it makes the’: volume
`s-uLI:u:rsh1e.T
`
`e '1-"I-"LII -Iilfditlt tt'lili'lii:eL"
`
`Dish: utliities ii:Hi=il1'-ISl=L"l"-lI'.=[ZI-"HIi etc]: shnuld wudtjtist fine. This is because. at any given
`instsmne, sut npplinntinn sees nnly the hest drive [the DE]. It-lease et'T.t':e eitetttitshle -eniriti wnuld be
`visible at a secret level,
`
`n
`
`‘ll:-"inst tiddes-eln-|:-slt envirulfl-eltlt?
`
`Frngmms under deueieptuent slieuld he kept in Ihe DI until yr-eu're dune with them.
`
`-
`
`‘What aleteentllslee with rust-useeutnlile estelslum?
`
`Eiati habit «and had manners! It is time in clause
`
`a wntut‘ D115 tiles residing an : Nelwnre server?
`
`[ see I1i:I reaeu urhjrthe Se-gregstien prineip-is nennnt he enipinyed at the server le1.re]_
`
`e ‘iii-'I.itt-af wlndune?
`
`‘flkss! You get me then: I’m ne eat at Wiminws prngrsnmting. Sun I ee.n’t ensu-er this ehe. But
`seine educated guesses...
`
`'i‘i'iI:ule-we 3-1] - with 32 hit fiieaueese - us hay is thin going tn wet]-ti But perltape a "i-'sD -emulcl.
`Semeene tteiiiis te espiere this fi.iI'l'IIeI' ‘iii'ilII.'1ti1i|.-‘s "95 - 11:1.’ we're tELLh'.I.'I:I,g I:ifSet:1ll'iI1_Ig DUE here!
`Rieinemher I said that it may run DDS qips, ‘nut it still ain't DDS. It ain't - the file 5351 is
`:1ifi‘sieni. which is what we’1e die-:ussiI'-2 here.
`
`In
`
`‘ii’-"Iii! -uitargetefl lltlults quiet tih |:I1etI'Iti-d1‘
`
`'I'i1e enetgmtiuntdecrnitieu efthe 52 date sliuuld he srarieliie. Sn sheuid tiie nsnie uni‘the file which
`setuaiijr heids the SF‘:-', and the nmie ef the drit-'ertlm iniplents it.
`
`The |.']|'i‘-'l1'5I'H:|tlI|:i he almost I5-41-1'. [en disk}. This prevents it finm being int-‘eete=:l by e devise driver
`l:|_fei:t»:r1'. Tn ssfegistd it against E. pun-ssiislie iiirure dew.-ine drive: infiectat. i1 ah-eultl as-nld having
`rep-wtedse-quennes ef bytes {nu large uninitaliztti |.'e.Lt'TtI‘a]I.
`
`F'et|1n1::sthedtiirei' itseifsheuid he pelzrmerphle - '-'-'i'fJ'| 3FH3ri*3'EiEfi 1'3 4"-ifill. Vtfiifliifl 45 F|'1EiJ'iifi ii“ 1111
`pni'l-'u::u_1m* praise] — I Imp-e die}; dI:in‘t strangle me the‘ stiggttating this. Elli this 1'Ie~tI1.lI:Jt=E1!|'l& |:II2ifi£iI:IiI:ii'].'
`unfit targeted nttneit.
`
`e is the ruetlud safe?
`
`I've been an .-Iisseinhler pee-grsmrruer iizu-sis lung in I use remeniher. And iiespite the feet fut my
`prugisms may have the deelsrnti-eli:
`
`‘assunie es:eeuie. ds:eede
`
`n-lust precedes this is a Ieininder te my-selfwhicli
`
`‘;; ; lsslme NEITHIHG
`
`‘titleelle EuE1ru’s ilret law ufprugratlntngj.
`
`Tn be quite hI:u1est.1he metha-:l tleeui-iI:iei:1 rnahes a let efessumptiens. it assumes that the
`deeuineiitatien ef the l'~let1enii-: Redireutut lntr-Ifanae ia aI:I:LtrItt:{1t is ttltutali ti} bI= Uflflnfiflmfifltu‘-=1
`even 1.-'|:tI1.ir1 Mieresdflti. its ihr esalnple, meet efthe iiifunnatitrii en the Netwutit Rediteutnr is In
`he fntnnd in the hault. 'L=miee.m1entee nus’. Cine teuuld tend t-D ta.l::e this lnliun:uatie:n at fatie
`value. Beware — Iiiistal-Les dun neetir. Case in pe-'mt - Seliulman states that hint-ell uses the iteiilseeter
`
`
`
`_
`EDD.‘ Dflessiussnsmsrssiessetseisss 1i1ruI Iiieth LiiLi11i1e ti1nflr-:1.eH:eI-1.D1rurdIt1ri.tZr!iI-i11'“5-E-IiI_-l-
`mmzussssuessmistuapflusmnqmmpeummuismiiummanwnidiushmnflwhrn
`1.I.'L'ili:ui.pIe'rtI:'m:i:tn1I:I:|'|J'i:Ipu'h|'u]'i-ell
`
`

`
`55 + 54_|I[_5ul.fi.-l_- 5ECURJ'H'I5 E305
`
`
`in versions 4 and above uffletwan. A-r:l.'I.Ia}|J3. it slartafl wilh. Vmainn 3.12! We also aaalune that
`]'u!|1'n:ru5I:I-ft w1'11nn~t -diflngt the data strLu:tI.u'E.'a mramighr. All these ass-umpticnns make me a war: bit
`nervm-us...
`
`,Efl:.r: Hum :13 I said |,'b.q:,I'bI'e. gjfsameane carries [Ira bu:n'.|'_,I"n:Im .I'Ie.r's, and makes the Segffigflflflfl ‘II-"1-|1I:'Ji:'1'E -I‘-5| I'i|'5
`Er:rgr-mi conciuafan. flaepup-av‘ ‘-+1'!.? Jiaw: aah'1'a'-a‘ if-E pwfidaa.
`
`CDHELUSIHN
`
`In th-burg.-', the Segre-gatinn |:IriI:L:':ip1a may settle best way ufa:-calling aaamtahla fi|E.EL 'I'|1&achEIr.'LEi5
`hes: us:-fl if‘ implanmtt-e::| 1:I.rit|:.i.:1 the DE itself. Haurav-at, as n1-entianad, at all time: must axacutahlaa I!Lt'l-I1
`nun-eaaunahles appeartu lie an the same w:r1uma.T‘ha annual juniinn. must he danaata la!-rel lnwer
`than the GS‘: file [FD AFT.
`
`The mathudcan {E-an it'?}1:as imp-1-cmtntcd witl1.i.I1 any DE. hi}; only regr-at is that I thclugllt af Ihis mathad
`M’ senrnlrirg DDS when DDS finally seems tn but on its way nut‘.
`
`A.E‘I-i.['AT'CI‘|r‘lu-"I..E.Il-|I}EI'I-IE['*3|"I‘.‘E':
`
`I wcnuid lily: I-a Ihnnl-: the falln-wing panple far providing i-TIP‘l.|Tl w|1ir.'J: directly or in-diftctlj.-' Dfltltribll-tfld In
`this phacaaz
`
`Dr. Man Sn-lurnszan - finr dimuasicrns an 1.rjru5a-5 whim -alrlan-dadtfl[tha wee hours aftha n14:I1'11inE.
`
`‘I.-rassulin B-nI1tu:|1e*t - WI]-DE-E suggestiun that I mhmit a paper llIE|iEtI'fB pusaibla.
`
`E1hetan‘u“ard&an:1Jhanka1'5i:1l1fi'umbacl:hum:-fizrrflunkingalauglinaaaslrrnlzy as I
`
`:11).
`
`FURTHER REABING
`
`fi.d1.-'a.nI::-ad HEDGE - by Ray Dmhnan
`This hunk gives an aI::-curata daacriprfifin bf‘ l|1I: Ih'I3-D133 film‘: systcin-
`
`Unda-+:uJm.'n1=d DCI3 - by Andruw Schullruaun
`Fm desnzriptcinna ufth: Hetwn-1'11 Raadiractur and 1-'aI:"u:Ius slnlcnlraa aLIs:h as lb: CD3. EDA. EFT!-. att-
`
`
`
`CID
`
` £IUflfl' flI9Hr5¥Uhflhl&fl 'HIIlIIflIrlI.-fi.5:F|.f-Un.Dl=EII'|iilI1u0K1-53'E'3u[rI|IIH-
`gugmssmmuup-turuapthmnmmghmpudmamuamamawaynmauumunadhuyfiumnéumtlhpin
`1.’:-I'ii-nu]:-u'n&.I:II:I:Id'Il|l]!|flv'."'rll1'::.
`
`

`
`FHLH EL|'IJ.ETl'H CDHFEREPJCE §EF'TE|'I-IIBEFL I995 - 6?
`
`
`MDDERN NIETHDDE DF DETECTING AND ERADICATING
`
`KNGWN AND UHKNBWN VIRUSE 5
`
`Br. L"'mi'i.Ij|.-' .Hioso:=rn-::;r
`
`Ilielemuesnieone. I.n::. Computing; Center ofthe Emmn Aeadens of Sciences. 4!?! Vavilow Street.
`Moscow lIT915'.-E Russia.
`
`Tel +'? IE5 13-‘? -III-15-I} ' F11 ‘Ir? I395 933 2930- E.—1:I:La.1'l elm-ssI.“@d:inIs.m:ILsLI:
`
`ABSTRACT
`
`Viruses are growing in HI!.£I'If.E'-'£!.I"_,I'i1.‘rI':I':I my is day. so it is mam me: soon‘ ::m'J—1.rirs.s programs like NAP’
`.::-.r- M3,] I«'1.1.=;'£'.|‘.rpm: bequife ¢,I_'Ecm:-Ions. I&a1ej|"o.r1e, we seorsedolssjgnisg or program rho: wou£.:1':1m1'J‘.Fr.r'RIa'.e
`not Ea-:.sfr'-.Is1'::sf injectors. but Iohrses in gersemi, regoreflees .::_r1|'u-hether E vines is hiowr: or rm‘. or whether
`it is aid‘ fir .I'o=_|'1-1»'.
`
`The firs: ou.n-some ofam gfom in him diracfidn. .=.L[!|1'a-g,|"f D.I'si:fn_.FeseopeJ'. is ojbrscosllag cs-.r:oer
`whieh e.I‘e1-is the uses!‘ in ecfb-once H»-M: grew‘. .I-1-.=4'.'r'a::rI::'.!':'I:|-' about the intrusion ofvims-Es". ens-1 HITHERTU
`unknown i-I1,;|'ees;Irs 4-is disfinetfmm on‘ other ofiero turner,-,-rflj-' chmoas. .-LB.-'nj':'n.1.'_o.sa:rs :1 disk by scanning
`Hus ss::.ro.r's oreeoyorne 1-is o':'.-em addressing ofBI-E15’ H-Ethos: Lfieosoismrms ofrfls op-erom-lg system area‘
`mm wide?’ chess oh‘ vfreipares 55.!"-Fmuriar ::'i5'.i". To em-:Iesuofl -:1!fi.s:i‘fo.r:: Ioorios ifs e.!‘ms::.r fmmsfbée
`
`siflfrfeierts the user he Home doom‘ vireo? fnmmhnre and neseores :'nj'ect‘-us'.I' boo! seniors. How is nem:-ne the
`Infeseedfifes eHi‘oo'um'cs.E{1r? Der PEI! step was to prodseee -E enerirg mmpofifefl E0 rifl-|'J'I_i7 THE -*lE'I1'f-9:11.
`siflfnfflsre Moofirolie. dqzu-fog.-s .1 none! .EJ‘.I"I!i|'.liEE].-'. Fomdusissfir. irI.r'.r:e'I:L-' sel-EJepe:'ee.r:.I‘ ofthe 1-.r'rusen'.r1 om-
`soifecrionfaif under afew standard grasps .Er_1r1&s muse oj".I‘:-;,r‘.e1:.:rIo.I-I seerhocie. New 1-1':-:L5'm' ore-as a rule
`ciesigrnsd on one oj'"r.fis.ss summon rII'.p.I"eeni:-I.-1 prfnetefies time‘.
`-I'&e-I"e3.I'E|-"E. .e‘.DI'hfCI¢re Mlfleie ‘-#3-|'4' be flbflflf
`9?‘?-E sfliciarr in iupscformosss aka Er: Ihejiemre
`
`..=I£IJ:‘n-:_.I".oa-:::'..-!E|I:'.rg_I""IZ'a.r.r=e Mo-:i'u£e orspnnns offlmrapesefeece anti-virus Ie'!- file mesrpepufer rim!-vine‘
`in Russia.
`
`I|"'v|'TEGEI'I'1' G
`
`The Ionic classes of a1:1ti-r.-1'rI.Ie programs are well |Lno1:Im. They a:esearIJrers.I're1n:Pi'-H's. Jill-DI'I'lIEr1E. and
`vooclnes. I won.'n1-|:1[iI:eto discuss the clevalopmml of programs to which. in my opinion. B‘I.‘:1i—".-"i:l'lJ3
`designers y page Jirtle oitention. 1111': eleee of anti-1.-in.u: programs is known as '
`eheeh:e1-s’. although the name does not fully characterise the programs’ poliey whiolt we describe helew.
`This is the only class ot‘p1.u-::i3.r 5ufl'n1I11.-. a:nfi-1rit1.Il: 11¢:-teu:tlon, which p-e1111.ite she -1:1-erection ofkno-zen and
`
`
`
`UDD1
`
`L:ssc.'1..:.E:'.IJr1:'L1Ir-:.=£.e.sI'-'r:.e I!-1H5 Hlnnndhmui. :I'n1=:;r-I-r..-I-I-as-.01!-room:-.t;1Eso1 H5. E-sh-l
`+eI{I]-12:-Issaezaa. HeflnflWIipd£|1l.Enmaybunp:uIlfl.flwflMlEfl'|.flILfiMflH.Wtlfl'T”-Nd 'u1I:=urI=rre'-*'flfeIoIh=nI':'-::r
`'I.I.1-ru::np|:|:11I:ll.I::|:-|:u‘i'|:|:|:|:uJ:n|.|d'|.Is.
`
`

`
`:53 - -|'lI'|Ii.‘.|El"v|'.'.|"r|'i.'2t'I'.'i'«I1Il3|D.EF|r|"ul' :'r'|El"H'Dfl5 'I5|F HHD Eltrllrtlli-lIr'ITll"l'lZr'f€H'Ill|1r'r"l"l'.ll-r‘IJI Uflifl-'tZ|WH '|r'TF'.'L|‘$E$
`
`
`unltneete rriruses tr.-ilir reliability errpreeelrine Itltti-tend ersdieetien up te 9'.‘-'“.-i ef file tefeeters. ih-eluding
`l1r'iJ'rr£rl:rh Leileres-n viruses.
`
`The eperstien ef integrityeheelters is h-esed en :1 simple feet‘. es therrgh it is inrpessilsle In itltttrtvt-I‘ all
`infh-rrestierr she-urpetentielly irrflnitetturtthet‘ ef trirllsts. it is quite pessihlete stere e finite yelume ef
`i_n;[-‘en-netien si:-e-L11 eseh Iegieel drit-'e in the dial: and 1+: deleet vine infeetlen fem the changes taken phase
`in fil and system erea efthe disk. as already riientierred. tire rrmsre ‘irrten-;r‘r'|:_'.-' checker‘ title‘-S nttt fill]:-'
`refteetthe 5;-aeeee eftlrese pregrsnrs. lnfeetien teshniqrifi are net restrieted te e sitttrtrlt etedifleetien sf
`me pr-egrarn eede. Elrlier pstlet fer inthetien either already exist ersreslse puesilzlle. Fer essrttpit.
`eempenjnn 1.:-in-nee: [1]. A diet: rein lzneeerrep-ted by restrlreturirrg the direetery tree. say. ‘try renaming the
`djrgetufiee and rareuijjg :|:|.-errr direeteriee, and by ether suelr msnipriisttierss- Eeesequeetly. tepretride
`reliable pi-eteerri-en, l-ernegrity eheelters nnrst tel-re eere effer mere parameters fltet the mere eltttltgts iii the
`311.: and 53.1: -effllrss as is eleneh-y meet 1:r11:r-g;I'l.rtI3 efthls elIss.'I'|1us. mesterbeet reeerd -[MiE|EtJI and
`‘tree: neuter: eflegieal strives; a list efhad elusteis; riireetery tree structure; free rnemery size; -EEC eflttt
`13h handler in BIDS; srrd even the Hslrd Disk Feren1ett:rTelt1es I'I'It.'rst be under the eentrel efi.1:rte:grity
`eheelzers- Changes inthe size and ERIE ef files. erestien efnesr files ersi dlrezteties antlretlttt-1'31 ttf ttltl
`files and direet-eries ere ehyieusly elsjeels fer slsiet eenh'eL A -designer efen. int-tmity etreeker must be
`me step ahmrl efI.'irI.1s designers and Isle-elr. eyery pessihle leephele fer parasite inlrusien.
`
`Despite t]1r3' large erneurtt efeentrelled irritrrmstien, sn integrity ehe-elter must eersetheless he riser-
`friendly, simple in usage, and qniel: in elrer:lt.Ir1gdisl'.s. It hunt in the arse three he user‘-eustereisslrle E
`regards the Ietrels ef messages displayed en the ettsrtyies eseurred in the disk and he sepehle ei’
`eenidrreting e prelimirssry mslysis ef the etrenges, pertisI.1le1'l'_I.rtE1e sI:e1:rieieus Inetlifi-eetittltts see]: as:
`
`e ehsnges in size and EEC.‘ effil wit.hI:rr.tt erry ehenie in thtestemp
`
`- illegal trslues efheurs.rn.is1I.Ir-.s erseeentis intiredsteemrnpefinfestedfileefferexsruple. I31
`eeeendsj
`
`e yesrgreuerthsntheermerrtyesrfeerrnin yirnsesnzlsrlt ftlf-EfiEdfilB3l:I].f1Tl|:{lfl5tiJlfi'.TJ1tt]p'l!=fll'tJf
`ereefiee by lljrtl yess:|'_s. rrrhleheennet be detected -rrlsuelly beestne ‘dir‘ eemmsnd errly displays the
`Iestte-re figines efdte ya-
`
`.
`
`I
`
`-
`
`any eheegee in files spe:-flied in the ‘stab-|e' list
`
`change in ntssrerheet reeerd erheet setter
`
`eppeerenee efrrew lseri -elusters enthe disltend ethers.
`
`Let us new disersss the ntein prelzllenrs fer:-ed by a designer si"inteirity eheel:ers'. First. There is tits
`declging ehillty efyinnee timed en stealth-rnelzlrsrrisrns. Integrity eheslrets that rely on epersting system
`reels: in their ereurnieg; iniseien ere thee-lutely helpless egsinst this elm ef rrirlsses. 'I'I'I.eylI.sye stintultrted
`the eeeelepmeee efee ieregr-‘try elreeleu-tlini elieeles rlislee I:ry1-ending: rhe seeters 1.-ie dlreet addressing
`thnenglt BIDS. Etertltlr "-'i.1.'1.1EEE eerrrtet hide the ehenfiee i.11e.u infiti file size: en the -tettttet'l-',.liIJtI1t1'
`surtha seenning technique the steelth-nseelrenisre hetrerys the presenee efleietlrrr end hitltette n.1:.iI:I1+:wI-'11
`stealth -.ri.rn_r.es threegh 1l1e riitstre]:-rlnr:'_r' between the infennetlen given me by BIDS end the lnfemrstien
`ehteined by reetlirrg yin BIDS. Suelt elgesithrns have been ettsstetl end E|.l|-'.'rE=EfiJ”_‘_F detect the lppsslflflse
`efsteelth-eirrrses.
`
`Seenning e tlisl-thy ending the seeters by client erldreseitrg ef E-IDS lure ette mere itstpettertt t:I1tt1'iI which
`is eften r:-tnerlele-i:eri_ lfa eeesnuter is infeeted by e sen-eelled ‘test le.fieeter* [1]. r,'i.e.. e trims that infects
`fi_L-:3 nee ernly when they are .5lru't1:r;i., but else when e]:eeed}_ e-eel: en integrity eheelter will net spread the
`Leieerlentrzl-sllfilesinthe dist. Ir-et:errseitdeesr:Iete.‘ell eddressrhe epetetltrgsystemftrrreedingedisk
`vie seeterssnd trsaen isdeprerrderrtfile epeI:IiJJgs3.'ste1:e,]:|re'r'eIIl'ir:Igtlre rlirrrs frere gearing any eeetreL
`
`
`
`flfl &ETfi EI!E '|rI'lrn-.rlflethl.I:l,i1 I'he[l-1:-Intrtrlliller-r.Ehf-dsihi-e.tJI1-l3'!'5.'[tflI1.l.
`:'fl]11!5Eil3D.HuFInnEl:iFl.tE-iu1mlybeq:I'eri.IIal.!1.m'hi tnennierulsynuir. re'n-e:ee:Irtr:dii1I'Iyl|rr'rr1tI-ilrnutthettit:-r
`
`

`
`t'|'fiL[$Bii.n'1'.iE1THEiJ'HFEHEHl§E.EEFTE'r1BERl5'9‘5*«59'
`
`
`Firrailv. an ilttaglitv elreelrerrrtiiicingdirert reading ufseeters is twiee as fast at clte-citing a disir than arr_v
`ether 1:-regrarrr that relies an the eperatiltg s1.rstemtan1s.. became it dies: seen algerititru can he created that
`reads each seeter enl"_v ertee and up-timim the head mevereerrts.
`
`Disir harldling; via BIDS has its etvn hurdles. The fa-rernrlst preblent is theeecepatisiiityrv.-'it]1lha large
`number el‘ diverse hardware and seitware, including dislr camp-aeters Ijirraelrer. Deuhiefipace}, specialised
`drivers fer aeeessing large disirs [Disk hieneireti. SE51 disl: drivers etc. Furtherrnrlmthere are many
`HIS-DES camp-arihie epuerathrg s1.-‘stems that have iatpereegiiibie but quite intpnrtant features in
`psnitiening Id-gieal drives. Integrity ehmirers must pay due Ittentietn te these fine fieters.
`
`‘VIRUS REMflV!r.L TECHNIQUES
`
`Mudern integrity checkers an: usefirl net e-nigv in detecting infeetien. but are also eupalsie ef retrieving
`viruses iutnsediataly with the help efthe infennatien they retrieve frtl-m an t.1.n'IrIfer:te:d machine at the
`time efiustaiiatldrt. An integrit_v eheeltertrait Jclil ltuea-‘u virus a vveii as the viruses which were
`unl-:|mv.1:1 at the time at‘ creation cfthe integdty eheeker.
`
`Hevr this is dune? Ivi-e-st nhvierte are the melJ:re-dc i-‘er rem:-ving viruses frem the master heat 1-eeenzl and
`beat aeeters. An integrity checker stares images ef rminfeered beet seeters in its tables and in ease ef
`damage can instantly resrere them- The easy restriction is that the reste-mtien must else he efleeted via
`direct addressing uffllflfi and ether resteratlun, the system must be rebeeted inahediareiv In erder re
`prevent the active virus flu-rn reinjeetihg ittmlien vrhiie accessing the disk via ]I'~l'T 13h.
`
`Remuvill ef file viruses is based en a m.1-11.'r1'ieb1.g feet,
`rramelJ.',' despite the van numberef diverse viruses, rhereare
`enijr a few techniques by tivhicha virus is iitjecterl int-ea file.
`Here Ive anlv brieflgr evtlirte the flie restnraticn str.ste_g.r.
`Figure 1 sh-utvs a sche1:na.t're diagrant e|"a tflltal E1-"CE file-
`
`Fur each tile. the integrity eheeherire-rue a header {area I}.
`r-elucatien table [arm 2) and the ee-dear the Ellllj-' paint (area
`4]. Strings {area 3 and area 5: are vital beea1:se they are the
`heart he identifying the rntmni ieestietts efvarleus areas iu
`at infested file when a virus v.-rites its tail. net at the tile
`end. but at the File beginning nr inthe file hudy {aflerthe
`relc-eatien tdala u-r atthe eittlj.-' paint}. in an infected file,
`after determining the ereatbat euineidas wihthe imaged
`area in the table. the rfnplaeeinertt efa blflekifer ettample.
`the hleelr i'urarea3 hegins attire end efarfli anti enm at
`the heginning efthe area 4]: can be idaruifietl but string 3-
`pesitierr and thus rneved laaet In its erigirrai Iecatiuu.
`Ia1age+1fereaIitairesa1reut3—4I-tihandisasentialia
`rerrevering afiie cnrrupted by virtues which danmge the
`debrsg infismraiien and everias-rs inthe eeurse efdelhetive
`lI1fE!:IliJI'I.
`
`1
`
`2
`
`3
`
`cf.
`
`5
`
`6
`
`E}iE-hearier
`
`Hahcafinn table
`
`Cede
`
`Entry paint
`
`Debug infuwnathn gr
`gugrfgyrg
`
`Fig J-
`
`Tilrrs. a file is reeevered by reinstating its cnriginai status.
`u-verv.-rriti:ag the image efits sttttettire stared in integrit_I.r checker tables err an lttlbeted file. Ennsenuentlv,
`a l.'.rIev.r1edge as tea which virus: infected lite file is net IIII1I'L-:1aIeI1-F.
`
`
`
`EDD.‘ H
`
`ssvirrs-re.-:::r:.r.t.r.s.niv;s.n:.5'ei1esavaua-Ieii-1i:r.:r nuuiuaru-ir.a|u:eu.tI1rnHta-enxusvs.nn;hnr.
`L-amagravseesue. Hupmue1i'-pumlieesenmnvhereureeerem-nraehmehmiaumunuifiaad Ieelsfisll-ithvvtlherliar
`uuictmpn-misiat1ef‘fl'I-epubhlslra.
`
`

`
`Fl? H"!-'I|:|'5T|3"|I'3|'J"|".' MDDERNMEH-Hlflfi vE|F EIE.|'E|E|"if".|?|5fi.|"q‘£|' E|Fi:||i.IJiC.|i.Tin"i'i.Ti'CiH'lI|'1I'-"f'J'.I'lI'i'-|.'.' U|'1|K.|"ifl'WN 1.I'i|'flL|'EE5
`
`
`Tables nunlsining infermatien ne:eess.a1':..rfe1' reeesering files take sheet 1|3||J-450 Kb far we In-gi::al+:L1'iI.-'e.
`Thetable size can be but -den-n te ilfl lib. ifs IEEE decides net 1:: save the raluealiun iniitrnnalien and this
`
`has ne perbeptible iizlfluanee en the que|!iI.}r ef reeevergr in Ines: cases.
`
`EDNCLUSIHN
`
`:11: ml preside a panacea agalnfl -enmputer viruses. Unf:I:tI.I:IeII=|:r. there
`leteglitg.-I eheeisers I.u1I:l-e4.Ibrt-sail}.-'
`is no such panacea, Iinreailthere be flllfl. E-Ii‘! fine}? are quite reliable ]:Imt-eetim: I.|tii.ities which must be
`med jcniiilig.-' 1.I.-'i1‘h ether classes efsnti-I-irusteuis. The highlights e-fintegrlijr ehe::'.i::ess des:::11'bed abenre
`are all tnnplented in Miiinf psbgsam, use must pi:-pulsr itegrirgr cheeks" in Russia It is also knew in
`Cresmanjs wliere it is dislfibiited en CD-RIEIM as s be-mp-eI1e11 efthe Dialeguefireienes Pm.ti—‘i-I'ii'u.E Hie ]t
`eheelesa flisleby reading its seetels use by but directly ednirming BIUS, easiljrtzlsps aeiisre steelith
`viruses by eeniparing the iI'nf:nm1atiu-IL obtained through Ei]I'.'.‘rS smzl DDS. It iIss'I:an:|1.r rester-es up In 9??-‘i {If
`files eenuptefl by kruewu end unk:m:m-11 1.Ii.ms-es.
`
`REFERENCES
`
`[1]
`
`[2]
`
`"i-'fis:e].in E-enbshev. Pessible "-.-'iIns Atteel-:e Ageing: Eaeegriry Pr-egrans And Hew Te P'1'E"I"fl1'I1Z
`Them, Pmc. Essa‘ Ira‘.
`l"'inr.s H::I:I‘i'-es'i.I': C'm5I'i., Sqstembler I992, pp. 131-1“.
`
`iuleeteveyr I}. ‘In, A Metheuzl of Detesthigsud Ersuiieating Know: and Unknusm i-’in1s.IFIP
`Tmnsnscsians. A43. S-eeuritjr 5-. Came] e-flllfe-Inlatien Tesllnblbizr in Seeietzs. Fsbnzars. 1994,
`pp. lb?-1 I I.
`
`
`
`‘i-"|me=Bu.|IIrI.n I.-IIITII-T|II |.'l'lI=I-II-I'III'-|'t.-‘I-'|I'H|d-'Il.'C'IFI1l'*vlIH.I'«l~. D114 31%. ml?“-
`{I1-1Ii-5$I3il'.T«Juee:1-efaieeimietfleiinuylbesepnihsai. nu-aiiururia-.ru] u.aI.n:,e4-1nueu':u-d{ns|n:'Ihrn'IIiIiInuIIi:erIiuI
`urimlnpluiiiseitmefthspablilhut
`
`

`
`‘i|'i.F.U‘5HUtLEflH{Ilhfl‘EREHCE.5EFIE.fl'IBER I95‘!-Ii‘
`
`EVALUATING DISTRIBUTED VIRUS PRflTEC']'IflN PRDIJUCTS
`
`.5:x:rrt-‘.3a.re1!::«.I:
`
`hienfeensseehtes. 2? 113! Waisli mrenue. Suite am. Santa Elena. CA. 9505!. USA
`
`Tet-W1#0393333]:-Fa1flfl14flE9?flW2’?-Eniei|'?'?311.1'T54I@.em;n1s:nre.eu:m
`
`Preseryirig the i:nteg,1'i.ty, ennfideiitillity and eeeem’I:i1'liI.y Dfillffllmltiflfil reenzrilttes euntitruaes 1:: pmeentnew
`ehallengee teihe cleiesee-urity nfileer, IS department, netwerkedministmnarentt end user. In the midst ef
`1:ii:i:'rJpIuti:.:|"1.:|p9,I':Lil'g.i:IIi:I-'iIirri.5i:'l1g and
`the:-is]-: ufnnrpnrate iniezmaeeneeeeueiien, metiifleetien
`and diaelu-sireis iuereasiiig. The elassie +:euiIa1iz.I:i:l made] irrfpesswnrds aridpltysieel guards emdifikulita
`qaply widtina yasi1yi:1i91'1]1uter]:en1.'ir4:inII:-st:ii1fg:I;I1.Iring. mnying and ehenging werksiatiuit and eeryet
`teehticilegles. The een:Iputer 1'.tiiiI.:sir_I.-I iswell aitrare that tune ufthe must setieus enrl -rlangsrnus semmty
`threa.1s1:iJtits1:rurgtacin'trigtnia::1‘i!-mniputeraitd netwertem-1'3'em11etitislhe~.in1s.i2empuiervinJea are
`ha1:u~di:-us e11'ci'ciee~.=.-l1iu:l1requii‘e eenfinume i:I’I|1I.5-1l]."'-|'ifl:i1£t1.I3I!! in Innuefdeieciien, cerflzainnweniend
`reenlufien. Alfltuugh wtifliell thepu|J|leitygeneIais::|byeei11pi:t:ryirum~. Uuenfight eetimweflnt lb:
`markeqslneeis well equipped andesndismifi the ti1i:ILig]1ts.I:rt‘e]:IiI:|.-s1'i1iII: I2=flI1tElEiIIHii.fln.T1!i5i$~1J-C'Ul1-'$i3lEi=-
`
`["NES.Fi_‘.I1'irus imgsetsimfey sheweil little smtisfieal
`A I994 Pitztienai C-r.i.uipiii=e:"
`change since its original Daiaqueatreaeareh ei‘1'i'5r2. amen; U.S.eu:+i1:-erahe reependenfi. WE 513'-"+5 Slill I113
`that adequately trntlpln-y anti-virus seinritnrtitill-n]3,.'3E'?-‘Er efeaerpereie IIBIIE-EDIE-iHEI1t|}'fl}l]:|']y' fl
`anti-tri1'us|:rmdu4:Is.TIiis eeI1II'i'|:IlltE:s iii-iJ:Ie feettiislrnere than 40'!-‘B efsll tietw-nrl-is I'II'FE ‘|Fil'!l.15|.‘.'-‘.'?l-!.H. t'niijiIi‘t't;|i'
`nfin.fia:linnsareirIIcIfluusiiiJt:iciDi:Dfl1.fb1.'Emp|Dyt~t:5. Clean up can be veryco-sIiy,arIdreirtf=ctica1 uncles
`within anayerage periizid sf?-[II days. In I994. irit'uses-stist American business epprflxinnieiy $2.? '|:r|'|Iinn.
`I3‘.-::s.eare|1ersiire ii'aeu-yering netytrituees etarlienfmere thentwn d.-nzeittrirtisi‘:-s-"slI'=Iin5 e!'I‘u:-11'fJL. ‘Hills, |‘J'IE
`iimeetns data security willheururse before itg-em It-etI.'-er.Asp1'ese1'1t. there issitheunfiel firewflt el’
`pi;i13r1:nua-phje 'I..'i11.13 irI:1'i:It'.'n'I3.. ‘ii-'nuli:l-he-writerean ehntejn, and learn to Create, g.ene1'iu: yirumsfitim ‘haw-tin“
`boasts, uixus H13, its imerziei, bulletin bee:-it and event ED-RUM. Since the threat efseei-dental and
`iiit-enii-zine] yirueduriage tn the eerperate e:I1'LI:iru:rarurI-enI,irInI:iI1-:|i::I.g efl"—eite dam isstrflng, fltflre are 5E'|-Feral
`eun:npeu'.u.g issues which irnistbeedilr-eseed. Thispeperunfl esplure the eritetiii in: wlainh mfltemum mty
`hesetheireheieas uf'ai1t'H'i1'I1s pmrnetiin.
`
`TI-[E"i’Ifl'.U5 ‘fi"I‘JEI..Il
`
`A eempuier 1n'.1'I.Is ‘ea apmgram iiniehreplieetes itself. meliesilsell-‘te etherpree.en:1pe1-fume
`uusnliizited, inn-t rriafleieris, anthem Cerrputeryimses are prederrIiI1a.nI:|y yirritteit fer IE||5'u'l*i3I.':I'I'I:[:IiiI.I':I3:r1i: and
`It-'[iiI:i11t-iii-"I1 eperefingsyflemsThetwnfi1nd::nenIaltIir1teeategnries:re '|:i-nut‘ and. ‘fi.li:‘ ir:'ru:aeeiuehes
`Term‘ and ‘Yankee Beadle‘. Be-et viruses, Ii:ernestiepnI'tedty'1:e.erepre;a:an1swi1i:h benefit: ecfivenn
`system start-up.T|1ey iiiirell within lhebnet esel:-nr e-fa sysien1’s iitfeetsd floppy er 1'i.i.t'i:1+:l'E1:.I'-‘II-'.IIai~t
`-ei;nmmnnI3.r_ the hunt yinis isprefluit heeemes ri:ierm:iry rueddent, replicates and sits-|:]:teseI1t-n nther
`
`
`
`EDD.‘
`
`LIEBLI1LE1'IUCE'h'FEE-BEE-I!fiVE‘i'BIfl-flHtLId,J111nl;hIlrlI-I,.i!i.lI1.ii:iIIIt.l'JtI1'ir&iI-i'It.'C||5'E1-l3'1I"5;. Ennis-ml.
`-I~I-vl[ii]1.E5HEl39. '.'~I'e nemJi‘H1|:i.l.'iisei:'enu1rytIe re|1i1e11.Ieed.:h:IeiI in ritie-‘II r_I.I1I'.un.eT I'IIa=I:iIlIi1itII!Iji'|7I1I11!I'I~'fliI!HlI‘Ihit1!II'I€If
`wrirhsnpeirniiaiintnfiietnh-liihml
`
`

`
`E ‘ ECHDUNJEVHLIMHFII DHTETHJTED '1'l'fl-LL‘: mflEEHDH
`
`
`available legienl dike. File 1.-irueee areprnglnm.-1 which bee-eme aefive eel;-rwhen exeeneiedrmeae include
`.E‘_!|-5E, _-I11‘-D}.-II, .DLL and ether e.-1-:eeu't£!I]e:f'I:|e1L The Elle uiree spread: en exeeufinn H it I}-piediy heeemee
`mam-ur_I,-'residIJ1t, replicates and efI:ic:]'u£1J:H;r1i1:1' exeeulahle gee-gn:an1s. I-.r1'ulfi1:n.1'1ilu ate: lg.-'pe eh-inae
`which hnveheth file and hemvhm ehareeleriefies. .I"I."n'i]'|.l.'El3l'II]F memit-er ferauiflerevmneeenipuflr
`eenditlen wlieheauaea ape3.rI-eed tehe deli»-e1'e:T..h |:l.j-"iI!1=m1I1il}|"1-"iB.I'j.|' fI'em an ‘erI1.ua.1'ng‘ meeeege.
`uiismpliun ufecunputer pr-I:-came: I:rr:'1I:&ded1'I.b:rI:'e:e, ta Ihe 11:51:!-I: lelhnl 1.'_'_n";|:Ie,i.I1-:a:Il'fi:II'lIE«1.1[1I.I.1 fl.I:l:i".-"L13" and
`minutednte darnegeqarend -'..'-refi km: per'L-ede eftinee
`
`‘|fi?4;:1-I::I1.I.r1'd-e incident flpu-[I5 1'.1J.cHIat¢-1J1:1tliL-e n1a_jarit1-,ref1.aitaeeaat'ei11n'edueed inneeenfly eeflae eerpuzlnte
`em-'irenn1en1fi'emuneLI-epeeling elm-leg.-'eee hn'1:I§'i:1: virileeefiemfli-eirhnlrleecntqelfler ereiefl-'hel'= eiltei-lie
`the eHi:e,erIl1r-eugh.eMh'enie d'ulri|:I-utien meh nel:u.:J.Ietin bennl 53-'ehmeL "v'in-1e aulhnm fl1I!:1=I:|-9'-*1‘-+E=E'-1'H.1:.gI=
`:rv:.a.ll}' in ternuufage, haekgrmmdaed iate:n.1. Alan, meirebiiity mdeeigll and test flleirpregmm givu
`:1ri.d::ne: In-TJ1-I: u;1:l1.ren';u't;n.-I uf‘-.-lr1.1s perfiannnneearndprnpagafium Many virus: require ideeieelrdiliene fer
`preper meutien. end indeed. many fail Ie-up-erase. er never execute an all. Cenainvirusea are mere
`prenaiem ineaep-art ef1tLeH.H:Ie'1d man u: n1:|:IeI3."'-"irI:n neeeareherajudae the meet cememeprewfling
`wrirueee ae 1heee which ennalelenfljr endeueefiefiflljr execute and replieme under un'nreI'5BJ eendilienal endfer
`an-.~auh:.1a;11ja]I3.rel:s::r1reu:1ia Ii1e eanqaauler :::a111mueit:,r_']']:Lenun hundred mesteemrnen 1'iI1.Ieea{w|1ieh range
`betnreen nee Ilelfend I:h1Iee }'fi.IE]flD¢fl1.lI1T.f1I the I11ejerit_'r efieieetlerts. Fmtemieg 3.-'en.1r e'_I.-ate11'1 fiem these
`eemmee wires-.2: any nfiierauffieiem pr-nteetiurl, he-eaueeflle 1i1I:eLi.hne-d efhifeefienhyenetees virus is quite
`slim, S.|i||_uu‘.|1Ele1l1ere1'.s neatandardnamieg eeevendnn 'mdue11'_I.- reeeuellerehave defined mere |:l1en'Ii1ree
`thousand *I:1eeurne1:ted' virus:
`
`VIRUS C{}UI"Tl'ER.d.E1'IflN-DP'lTflN$
`
`MnII}r1dnfl£}'l1:pIfl-:I'm ere n4:rtea.-silgr diaiin-gI.|iel1ebie until en-'er.t demnge heel:-een dent. Ufltit. the flI1lj:*=H-1'11-'
`irniiamian my be Ihat .1e~a1'e{:runer iaru.nnin3. eiewlyer metep|'egra.1'r.I deee1:1’teeeeutI: eerreulirr. Elm‘-eniigr.
`mg.-1-:an:fi:u1: teehniqueatu demetdteeempuler 1.rima: imegritjreheekzing, ]l1E|11EI1"_|p' deaeefien, interrupt
`menlmring end signamre 3-eE:1.T!IirI;g.. TheiI1|:e1e'il'yI:hetki1lgmHhM r1eterminesifapm3I'am‘5flIe size has
`increased dueenrtruaatuelned-eede Thememeugr eeaeetleniredte-ereee;aeimee'.The lucefienenfleufle nfa
`given deeueeented I.rh'1Ia-while in mam-I:I1'j.'.The in1e1'rIJ;rtmeni1Je1:1':1g. meI£1-eel el:-eenreeillpregram I!-'5-':Bh'.rI1
`e.a[I5{'t.e. D1215 I1Ell1Ih'I1i.I:iuI’II1Ei!:linfl1B‘a1'|:EIII]]11‘;1EI1E|Jg[l aeequenee efeellawhieh may ieclicete I-r'Ll'Il5 e::I:i1ril:r.
`Th: 5igT|at|.|r:5::a.1:.11i|1g1'|3|1:th[:n4:1.rvI:.*].i::EI:|-I1 idantifj.ri.e§; aunique Etfllfil-EIIfl.I:i.Bl:iEltB1lJDEi-E, t.h-e1I'i:I1e'- Eignatune,
`which wima leaves 1.-ritlain an inhtecl file. M am.-i—~.rirue preduele use veriatims nfaune eralleffllese
`vflmaeetmtemeiienteehniqllee.
`
`Tnre dI1I:I:Iinm1E1.ri'n.15 eleeaes. sieellh aI'te1[:re13.-'n'I:rI1:rhie.I:rffe1'additi:meI dermndenn lhe anti-ville:
`eemlmmity. JiI.5ll=fli.Iil‘|.|'iI'l.15,iI||l:|li]pH.'id-'i.1u|'|: and active. elealer. in eefl'flI|5.1i1IE In:-.IlLing1'I diflieultte deteet. A
`puaiee eeeallh virus might rnahlteiu e pm-gre.11:L‘e preinfeetedfiie uiaeie elder tehide the hlflflild pI'1!|gI‘am"5
`eetuel EI1-::e'eaee=u.'1 file eiee. 'I'he1'efiJ1'e, itnreuldewde rnelet inle-mt:-' checkers. F111 eefive etfilih ‘-'iI1lE Jilighl
`target and eiininete fl1et1ele:tieI1fuee'tieeaJiI§,rnfaeeIr1n1en:iel enli-1.-i1uepreduet.111erneetn:1il‘lieu1tty1::e ef
`viruete detect he 1-i1'r.m.Itenut:IiJ15 afmutatien -E-'I'IEiee' vuhiehprednceaa 'ri1'u.5. 111111 mndemiy
`ehangee iusignanereen eereiin replieatieue. Te deteetn p-I:I|:rn're1'phie virus. eeiemeireeeamaingengiee
`nuetanalyaeet efaentming rules. lfapre-fluerulilieee the eigrnmre scanning leehniqee {end an Eea-ding
`winders due}, it meat aeli-n.-n:1;.r update its vine n',g11an.1re file [an enerypted file which eentaineinlmm 1-rims
`signuuuea I.|.-zed by the acmnar} as wall as nlaintain Ihe 3::an11iI1g mgine iese|i'{1A-laeee n.Ilee 1111.31 he refined}.
`Depmdirugenthe in1pInen1en'te.1'Len, ell efd1eehe1re-melifienedeemtemeliennlmhucheanbeflnplwed an
`hethehewen-ka1aI:len ereen=er,aI:a:1 either in real-1;Ee:u-.-er em.
`
`‘i.-'h11aeeu:en-aefienteehnelegyia net witheul deficiencies, and effenetivenue den: wry b§I'|i1I:iIH]J|!IlieItiI:rn-
`I|1|;egrit§.rr:]1acking involves applgdnga eaIueulali::11:aIgn1'ith.mt1:| afile in erderee prndmeeeheeksulnvalue.
`Theenduaerreglateraa file, and an later eeeemien, theenti-'I.rirue 3}-ntemeuh:n1e1:ieaJJ:rn'ieetm'1e'heI111ifle if
`1:he1'11e bee been altered. The dewn-aide lethieteehneieggr in-elude.e:regia'I;eringi.e;Fee1edfI|ee. mining
`
`
`_
`flfl L-u£m fim '|r'irIu-Ihil-nItn1.II1-.1I Tlllvlir--dr--t.JLb|rIndnn.Ddhrd-I-‘in-I. D-'|'-l_l3‘1'5.I-rI11|IIfH|-
`1201113556513-9. He elrteflia whlineen rn-:r'n=-rqnte-me. em-Iinnnn-in-n1=.v.-:eame.erIrn:1errIifl1-in en:-I Ihen mflleutfietrmr
`'n':'i:I:IuI1;:eI:n:in'n11nE"|]'re;I:l.Ih|i:'fl1'1
`
`

`
`'|n|'I'Fh|..|3 Bl1.I'.|..|.I';'|'Tl"-.|'«C|DJ"-II-"E!"-IE!‘-'I'EE EEFTEMIEH !H5- 1"]
`
`
`flflflllilll trirueee, flagging se-1f—medifl.IiI1g exeeutahl-es, and rnanegiagtlae eheeletura deleheee 1"-'IeIt'I:trjr
`deteetieu teehJ1e1egyma3,.rie'q1eee reeeureerequirementsetIde‘eett11etPC eperafieee. interrupt rrtenilering.
`whirh finde the vines aflerertte-:1II:iI:HL eften fiaeevelid 5!r'li'flH'I‘.l ealle. eltdhaehad Eimit-ed eueeeea egainalelt
`1-inn t:.m.Sig1'tel'|.:e'e eeeenieg is enly aegaed aehewreeentflteainmmre Eleietlpndetedralheit, rm-at
`aigtratt-are fi1eeee11IaineJleea'nmen virus eigmttuee. %elin1ee the signature 5I.‘:et:IIIrI:1‘1:'I'-Itt'_':-' iII1E:|1'|!i.flta
`signature 1:.-'it]:Li11 at-ralid file fifeleepeeitive deteeIien}.De1:nendingee hewdeteiledlhe rule eetefe hI:I.n'i5lie5-
`heeedeeanning engine, pelynterphie iterelieu rm‘,-ght else znruid deter.-lien. The eemhined ueeefelltheee
`tee1:11e¥e3ieer.uggnee-reamere Ihereugh metlted eftrinle ebetreeden Aeflze number efvineee eenfinueite
`inerea.-3:. virus eetmterezliunmmtnlenfllttire.
`
`E'WLLUa9a'I'IflN CRITERIA. FDR THE DISTRIBUTED .II.I*WIIilI'.|II"tII'4-lE.I"i|'1"
`
`Te eheeee from lmeugdle leading erttl-1-true Herder, Iheheet anti-virus data prenelien eetueien fete
`mectfie elwirenlrent. eeetefperdeent neheheneritfiumeflflrflhfi iliil.‘-115|1ifiEt|?U'I'Ifl|1JFfl5lIEElZ|li|Z!Il.‘!», erhielt
`at fiI'Et£t1'fi'EI.'I eeeend Eleme eeeI:t'Iert.te1'al faetere. pre1.re:,.wI'IHt fi.1rd1e1'ea:pIe-I'ali:t'I, te Izvemlelee-ding. We
`will fire: dieeualrh-eat: reeetelwietueriteriaand I:IteI1 suggest an u-ptimal list efdelnnttieing fletere.
`
`L; the pm-duetwlri:-.he|ai::1e Ituealehthe meet nu.mber ef'I.riru5I:51he best‘? Net Ilflflwralilfit. Eirleflflle nI.I.m1:Iei'
`eftrirueeeirrerea.-tee eaeh rmnth, eaeh*.'ender'e:leeurruented1ri1'ua deteelien retewill change I'I'l2tl:||:hl].T. In
`Hdditielt, this deteelien rate relies ee thew.-aitahilitgr efthe pre-d1.1et'e updetesmnemeatiitie fltetie faete
`etaetderd fer eignature files. A I‘;-']]I]'|:II4.'-tl:]J1:ri1Il‘t:I'ltlv|:lI2I5i!.I[Ell'£I'}I' efvinreee dtreegh e:Ie|1preduet‘5
`eemtemteemreeendeilhereetmteflle aumberefdeteetienaerdeelemeee dmtiellperle-e11ta5;e.|.'.I|'lIteini|1g
`epprepliiatevinueef-era ti:-rary ran|:IeetJr:I;:nJieate:|.,e1'nee treudmeearmetelttitell:-r:u'fl iuthe dtsnibufien ef
`1.I'inIeee."l‘he reeulte efthis 'ueet'a.Ii]1 vent eignifleanfly due te: Ihe depth eflhe 'I.r'LrI.|a |:|'|:rren.r [hew meuyere
`1:|.|:|:|i:d'a'] and huwzrnny nfwhatgrpe I:tf'1ri1'u5 u[i_e. pebenntplfie}, IhE:1:|-l.'lI'il'j|' £tflh£]1iI1|I‘fl.I'j' {ettizr virueefl},
`the naming eeru.-eetiene u1iI.1':eed I:I.IrI"L’fi:Irrn']"”]-. the rneeteureerttupdateiurhen was the teem. and erlretlterthe
`teeter rna.:in:I.izeea.I:Ir nermaH:ee:e eaeh predeefeeeunter-meeauree. he p-revi-nualy dine-eased, thetteehundred
`meet -eemmcln 1-ireeee aeeeunt en the vast n:tajer':'|:_-.-' efinfeetieu. Thetefere. ell filrlib-'-I invesreafieer it ‘u
`apparent tI1a.t:it may-r'ee ef little euneeqmernee thercrae preduetdeteeu enl;-refew mere-uiruaeatlunmtether.
`
`Is the 1;:-eduer which elainte te perfennthe faeteetandwitlt the leaerreemuee mflimflenie Ihe |:«eet'i"I~Iet
`nereeearfly. E1.-'a|uateIem:.utevere,ge multiple test nmefer beth 1.I.r-e:rk.etal'.iene flTIIi'.'itE1"'-"=1-"-"u- in I!II‘t|H' ti!
`precluee aetaudard eel: efwduee. Being that servers, by narnre,p-erfernr arulli-t:e1ria.g.4:u1e eheuld nut
`eeet.unee]:re:luet‘e aenrer mem-erg.r requirernenteereenrerthread tmgemefieet perfiarnunee. Typical
`experiments will send alih