{ "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "unreviewed", "publishableCanonical": false, "generatedAt": "2026-09-14T01:37:39Z", "providers": [ "Claude" ], "breadth": "written by Claude from model knowledge without web access - no source was read, every claim is a lead to verify", "pass": 2, "wave": 4, "engine": "claude", "enrichment": { "pass": 3, "engine": "claude", "producedAt": "2026-10-06T11:00:00Z", "ingestedAt": "2026-10-06T07:45:57+00:00", "fields": [ "agent_conduct", "ethics", "owners" ] }, "revisions": [ { "at": "2026-10-06T22:53:29+00:00", "engine": "codex", "fields": [ "definition", "visual_identification" ], "answering_review": "7ff5ad499f3ebece4e579c6f107641a2a114ec39e52166baf716b19609b25071" }, { "at": "2026-10-07T11:34:48+00:00", "engine": "codex", "fields": [ "definition", "visual_identification" ], "answering_review": "86b96d0ff13021cbc7f2e0579bde1ad2d43329a6081f7273ecae8d365d0b8ddc" } ], "gate": { "passed": true, "version": "1.0", "at": "2026-10-07T12:16:33+00:00", "evidence": [ "completeness 1.00", "sense: Wikidata description", "2 live sources", "review by codex: pass" ] } }, "metaModel": { "id": "THING-Q485", "registryId": "vr.tr.computer-virus", "name": "computer virus", "version": "0.2.0-wave.4", "entryKind": "thing", "family": "Thing Registry", "domain": [ "PHY.OBJ" ], "status": "research-draft" }, "canonicalUrl": "https://ver.cy/models/thing/q485/", "model": { "registry_id": "vr.tr.computer-virus", "name": "computer virus", "purpose": "Let an agent explain computer viruses for defensive and educational purposes, relay types, history, transmission and protection from cybersecurity sources, describe the named types and examples, and distinguish viruses from worms, trojans, ransomware and other malware, without providing any code or instructions to create or spread malware.", "definition": "A type of malware that inserts its code into other programs or documents so that it replicates when the host runs, potentially damaging data, spreading through files, boot sectors or networks, and often carrying a payload; kinds the registry aliases name include boot sector viruses that infect disk startup areas, resident viruses that stay in memory, macro and HyperCard document viruses, joke viruses whose prank behaviour qualifies as a virus only when accompanied by host infection and self-replication, and specific historical examples such as SWF.LFM.926. The 1989 AIDS Trojan is a trojan rather than a computer virus because it lacks self-replication. The model explains viruses for defence and education only and gives no instructions for creating or spreading malware; people should use reputable antivirus software and keep backups, and infected systems should be handled with official guidance.", "what_it_is_for": "Not applicable; malicious software, described for defence.", "affordances": [ "explain types and history", "relay transmission and protection", "describe named examples", "distinguish malware types" ], "distinguishing_features": [ "Requires a host", "Self-replicating", "May carry payloads", "Spreads on execution" ], "appearance": "Not visible; detected by antivirus tools and by symptoms such as corrupted files.", "visual_identification": [ "Computer viruses are self-replicating malicious code that infects host programs.", "Named types and examples include HyperCard viruses, SWF.LFM.926, resident viruses, boot sector viruses and joke programs only when they infect hosts and self-replicate.", "The 1989 AIDS Trojan lacks self-replication and is not a computer virus.", "Worms spread without a host; trojans disguise themselves as legitimate software; ransomware encrypts files for ransom; spyware collects data." ], "physical_properties": [ { "quantity": "Creeper experiment", "typical_range": "1971", "unit": "note", "note": "early self-replicating program" }, { "quantity": "Brain boot sector virus", "typical_range": "1986", "unit": "year", "note": "early PC virus" }, { "quantity": "registry parents", "typical_range": "malware, digital organism", "unit": "note", "note": "" } ], "families_and_kinds": [ "boot sector viruses", "file infectors", "macro viruses", "resident viruses", "polymorphic viruses" ], "related_models": [ { "relation": "is a kind of", "target": "malware", "why": "in registry terms" }, { "relation": "is contrasted with", "target": "computer worm", "why": "" }, { "relation": "is contrasted with", "target": "trojan horse", "why": "" }, { "relation": "is detected by", "target": "antivirus software", "why": "" } ], "identifiers": [], "standards_and_regulation": [ "Computer misuse and cybercrime laws", "Data protection breach notification rules" ], "failure_modes_and_hazards": [ "Data loss and system damage", "Providing malware instructions", "Spread through removable media and email" ], "in_scope": [], "out_of_scope": [], "characteristics": [], "agent_conduct": { "may": [ "Explain in general terms what computer viruses are and how to protect against them.", "Scan and quarantine suspected malware on systems the agent is authorized to manage.", "Report infections to the system owner and, where required, to the responsible authority." ], "must_not": [ "Write, modify, improve or spread a computer virus.", "Give instructions for evading antivirus or security tools.", "Run suspected malware outside an isolated environment set up for that purpose.", "Access or clean systems the agent is not authorized to manage." ], "requires_human": [ "Wiping or restoring infected systems that hold other people's data.", "Disclosing an infection publicly or to affected users." ] }, "ethics": { "considerations": [ "Viruses can destroy data and disable hospitals, utilities and businesses people depend on.", "Research and defence must not become a route to building attack tools." ], "affected_parties": [ "Computer users", "Organisations and their customers", "Security responders" ] }, "owners": { "steward": "The owner or operator of each affected system; nobody legitimately owns a virus in the wild.", "master_systems": [] } }, "sources": [ { "id": "wikidata", "title": "Wikidata item Q485: computer virus", "url": "https://www.wikidata.org/wiki/Q485", "url_status": "live", "what_it_supports": "identity and sense of the item", "checked_by": "wikidata-api" }, { "id": "wikipedia-en", "title": "Wikipedia: Computer virus", "url": "https://en.wikipedia.org/wiki/Computer_virus", "url_status": "live", "what_it_supports": "general description of the item", "checked_by": "wikidata-api sitelink" } ], "structure": { "bundles": [ { "id": "understand", "name": "Understand", "description": "What a computer virus is.", "rationale": "Definition.", "layers": [ { "id": "definition", "name": "Definition", "description": "Definition.", "findings": [ { "id": "definition-finding", "name": "Definition", "description": "Definition.", "questions": [ { "text": "Is a device infected or showing ransom demands, in which case disconnect it, seek official guidance and do not pay ransoms without advice?", "kind": "boundary" }, { "text": "What is a computer virus, and how does it differ from worms, trojans, ransomware and spyware?", "kind": "definition" } ] } ] }, { "id": "types", "name": "Types", "description": "Named types.", "findings": [ { "id": "types-finding", "name": "Types", "description": "Types.", "questions": [ { "text": "What are boot sector, resident, macro and joke viruses, and what were the AIDS trojan and SWF.LFM.926?", "kind": "definition" }, { "text": "Is any request to create or spread malware refused?", "kind": "boundary" } ] } ] } ] }, { "id": "history", "name": "History", "description": "History.", "rationale": "Sources.", "layers": [ { "id": "early", "name": "Early viruses", "description": "Early viruses.", "findings": [ { "id": "early-finding", "name": "Early viruses", "description": "Early viruses.", "questions": [ { "text": "How did early viruses such as Brain and the Morris worm shape the field?", "kind": "provenance" }, { "text": "Which references are standard?", "kind": "provenance" } ] } ] }, { "id": "evolution", "name": "Evolution", "description": "Modern malware.", "findings": [ { "id": "evolution-finding", "name": "Evolution", "description": "Evolution.", "questions": [ { "text": "How has malware shifted from viruses to worms, botnets and ransomware?", "kind": "provenance" }, { "text": "Which sources are cited?", "kind": "provenance" } ] } ] } ] }, { "id": "defence", "name": "Defence", "description": "Protection.", "rationale": "Regulation.", "layers": [ { "id": "protection", "name": "Protection", "description": "Protection measures.", "findings": [ { "id": "protection-finding", "name": "Protection", "description": "Protection.", "questions": [ { "text": "How do antivirus software, updates and backups protect systems?", "kind": "action" }, { "text": "Is the information current?", "kind": "boundary" } ] } ] }, { "id": "response", "name": "Response", "description": "Incident response.", "findings": [ { "id": "response-finding", "name": "Response", "description": "Response.", "questions": [ { "text": "What steps do official guides recommend after infection?", "kind": "provenance" }, { "text": "Which entry fits incident response?", "kind": "action" } ] } ] } ] }, { "id": "context", "name": "Context", "description": "Detection.", "rationale": "Science.", "layers": [ { "id": "detection", "name": "Detection", "description": "Detection methods.", "findings": [ { "id": "detection-finding", "name": "Detection", "description": "Detection.", "questions": [ { "text": "How do signature and behaviour-based detection work?", "kind": "provenance" }, { "text": "Which entry fits antivirus software?", "kind": "action" } ] } ] }, { "id": "law", "name": "Law", "description": "Cybercrime law.", "findings": [ { "id": "law-finding", "name": "Law", "description": "Law.", "questions": [ { "text": "How do laws treat creating and spreading malware?", "kind": "provenance" }, { "text": "Is the presentation neutral and attributed?", "kind": "boundary" } ] } ] } ] } ] }, "openQuestions": [ "Should the AIDS trojan be reclassified, since it is a trojan rather than a virus?", "Should macro viruses be a separate entry?", "How should malware taxonomy sources be linked?" ], "statistics": { "bundles": 4, "layers": 8, "findings": 8, "questions": 16 } }