HDTenEightyP/NetNews huggingface dataset:
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: How do MtE utilizing viruses detect themselves? (PC)
Date: 14 Jan 93 10:36:56 GMT

Malte_Eppert@f535.n240.z2.fidonet.bad.se (Malte Eppert) writes:

> Can anybody tell me how MtE utilizing viruses detect themselves in an
> infected file?

It depends - the different MtE-based viruses use different methods.
The variants of Dedicated pad the infected files to the next multiple
of 256 when infecting it and do not infect files with size that is an
exact multiple of 256. Pogue puts an 'M' in the first byte of the
infected COM files and uses this as an infection marker. And so on.

Because those viruses to not have an exact MtE-detection mechanism,
this means that they might not infect some infectable files (they will
think that those files are already infected). This is sometimes called
"sparse infection".

> Or do they reinfect the file each time they attack it,
> like old Jerusalem? 

No, they are not -that- stupid... :-)

> Can't an algorithmic scanner use the method used
> by MtE itself to detect it?

Unfortunately - not. The virus author does not care if his virus does
not infect some infectable files, while a producer of an anti-virus
program cannot permit himself to erroneously flag a perfectly valid
file as infected... The only thing that can be done is to use the
infection marker of the virus as an heuristic to sieve out the files
that are obviously not infected. For instance, if you need to detect
only Pogue, you can check if the file is a COM file and its first byte
contains the character 'M'. If it is not or it doesn't, then you know
that it is not infected by Pogue and don't need to spend more time
checking... Only if it looks like a Pogue-infected file, you'll have
to apply your algorithmic detection...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: Amir_Netiv@f120.n9721.z9.virnet.bad.se (Amir Netiv)
Newsgroups: comp.virus
Subject: New Virus (PC)
Date: 17 Jan 93 12:50:00 GMT

Daphne Rosenhouse writes:

 > It looks like a variant of te WHALE, but larger, and
 > harder to remove

Whell, it could be as you say (a variant of the WHALE), but it would
be rather surprising, since the Whale is an old one and from a viral
point of view... an unsuccessful one.

I find it hard to believe that someone will use this as a base virus
for modifications. Did you considered the posibility that you have a
case of several viruses infecting togather or mabe one that infects
files more then once ?

Call me on voice sometime and I'll try to determine the nature of your
virus.

* Amir Netiv. V-CARE, Anti-Virus, Head team. *

- --- FastEcho 1.21
 * Origin: <<< NSE Software >>> Israel (9:9721/120)
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: os2-stuff (OS/2)
Date: 15 Jan 93 06:04:18 GMT

chess@watson.ibm.com (David M. Chess) writes:

> >could infect them by mistake. How are the DLL and DRV files loaded in
> >OS/2? If they are not loaded using any INT 21h/AX=4Bxxh function, then
> >it is rather unlikely that any of the currently known viruses will
> >infect them...

> No, no OS/2 call does an INT 21 at all; that's one of the main
> reasons that no DOS virus runs in native OS/2.  Operating system
> calls in OS/2 are done using Protect Mode constructs like call
> gates (I forget the details again!), not using INTs.       DC

OK, but suppose that the user opens a DOS window. Suppose also that
s/he runs an infected DOS program in this window and the virus becomes
resident. Does OS/2 access some DLLs in order to handle the running of
a DOS program in a DOS window? Are those accesses visible to the
program running in the DOS window? If they are not, then none of the
currently existing viruses will infect a DLL file and there is no need
to scan such files...

Another possibility is a virus like Frodo, which (erroneously)
infects files with different extensions, because it thinks they are
COM or EXE. But Frodo's criteria for executable extension does not
classify "DLL" as such and I don't know other viruses which do the
same stupidity...

So, it seems that there is indeed no need to scan the DLL files,
right? Or am I missing something?

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: Amir_Netiv@f120.n9721.z9.virnet.bad.se (Amir Netiv)
Newsgroups: comp.virus
Subject: False positive in the new PKZIP (PC)
Date: 17 Jan 93 13:12:00 GMT

Vesselin Bontchev writes:

 > What is interesting is that somebody used an out-of-
 > date version of Symantec's Norton Anti-Virus to scan the new archiver.
 > It seems that this version causes a false positive - the program is
 > flagged as infected by Maltese Amoeba.

and

 > all executables in the package are self- compressed with PKLite
 > 1.20. This caused the heuristic scanner of F-Prot to report that those
 > files are suspicious, because they contain a program that modifies

It is obviouse that anyone that uses any old version of any Anti-Virus
product is subject to false alarms, and even more obviouse that if you
use a "Generic" scanner that looks for special kinds of codes whithin
a file (that could imply that a virus is lurking there), you will jump
from your seat many times for nothing !

So, if you are using such products, great, but don't spread panic for
nothing.  Ican easilly supply you with a handfull of "viruses" that do
not exist, to write about.

 > I obtained a copy of the new version of PKZIP,
 > examined it manually with a debugger, and scanned it with about a dozen
 > scanners. The result is that NONE OF THE EXECUTABLE FILES IS INFECTED.

 > So, please done's pay attention to the rumors, if they reach you.

We thank you for your effort.

* Amir Netiv. V-CARE Anti-Virus, Head team.*

- --- FastEcho 1.21
 * Origin: <<< NSE Software >>> Israel (9:9721/120)
From: RADAI@vms.huji.ac.il (Y. Radai)
Newsgroups: comp.virus
Subject: Re: January LAT
Date: 18 Jan 93 16:31:17 GMT


  Bill Lambdin writes:

> I had hoped to test Search & Destroy From Fifth Generation
> Systems, but I haven't received it yet.

My understanding is that Search & Destroy is the same as UTScan + UTRes.
(Fifth Generation's answer to those who want a scanner without an integrity
checker.)

                                     Y. Radai
                                     Hebrew Univ. of Jerusalem, Israel
                                     RADAI@HUJIVMS.BITNET
                                     RADAI@VMS.HUJI.AC.IL
From: elias@sun.uakom.cs (Lubos Elias)
Newsgroups: comp.virus
Subject: TEKILLA virus (PC)
Date: 19 Jan 93 14:40:15 GMT

Hi,

do you know any symptoms of Tekilla virus ?
Thanks in advance,

Lubos.Elias@uakom.cs
From: martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences)
Newsgroups: comp.virus
Subject: Re: Yes, but is it a virus?
Date: 15 Jan 93 23:37:27 GMT

ygoland@edison.SEAS.UCLA.EDU (The Jester) writes:

>If Dr. Cohen is speaking of viruses to other experts in the field
>then his comments regarding Beneficial Viruses and such are
>appropriate and will be understood. I doubt anyone who understands
>his comments would disagree with his assertions.

The interesting point that Dr. Cohen made, though, in his first (?)
article, was that it is precisely those one would expect to understand,
the academics and the anti-virus software writers, who get most
upset with his definitions.  According to Dr. Cohen, his customers,
who are non-experts, are not bothered about whether his protection
software is using viral techniques to install itself on their systems,
as long as the installation works efficiently.

I call this the interesting point because I think (as an academic)
that it is an interesting commentary on the nature of academia
today.

Tim

 -------------------------------------------------------------
  Tim Martin                   *
  Spatial Information Systems  *   These opinions are my own:
  University of Alberta        *      My employer has none!
  martin@cs.ualberta.ca        *
 -------------------------------------------------------------
From: Amir_Netiv@f120.n9721.z9.virnet.bad.se (Amir Netiv)
Newsgroups: comp.virus
Subject: Good and bad viruses (was FC on virus creation)
Date: 17 Jan 93 12:12:00 GMT


 Y. Radai writes in response to Suzana:

 > But it doesn't *have to* become a bad virus.  And if
 > it does become one, then by most people's definitions it probably
 > wasn't really a good virus to begin with.

I think the dabate concerning "goodness" of viruses, has gone out of
hand here... The question should not be if a virus is good or bad
according to our benefit (or losts) caused by it, but: does it's
behaviour and method of propagation comply with certain rules that
will make it hard to detect/clean/ prevent!

For example we concider a good virus as one that:
  - Does not reveal itself "easally" :-).
  - Uses "different" (unusual) stealth techniques.
  - Uses a special (prferably "new") method of hooking a program
(think about DIR-II). etc...

Most of the terms here can be subject to many intensive
philosophical dicussions.

So to my openion the question shold be: What are the rules ?

Regards

* Amir Netiv, V-CARE Anti-Virus, Head team.

- --- FastEcho 1.21
 * Origin: <<< NSE Software >>> Israel (9:9721/120)
From: Amir_Netiv@f120.n9721.z9.virnet.bad.se (Amir Netiv)
Newsgroups: comp.virus
Subject: New way of opeing files??? (PC)
Date: 17 Jan 93 13:34:00 GMT

Hi Chris.

you wrote:

 > I've heard that the NuKE group is starting to use function
 > AX,6C00h/INT 21h to open files...

Why go so far? Did you here of writing to the disk via a port - instead of 
using standard interrupt method to write?
I don't know of any A-V product that can monitor writing to ports, (unless it 
was a debugger that monitors every command that an application performs, and 
believe me: you don't want to use that!).

Regards

* Amir Netiv, V-CARE Anti-Virus, Head team.*

- --- FastEcho 1.21
 * Origin: <<< NSE Software >>> Israel (9:9721/120)
From: robert.heuman@rose.com (robert heuman)
Newsgroups: comp.virus
Subject: Export restrictions on anti-virus software
Date: 14 Jan 93 19:43:47 GMT

Date Entered: 01-14-93 13:33
aryeh@mcafee.com (McAfee Associates) posted part of the material re 
Export controls and then asked a question as follows:

 
> Question: Does "In the public domain" mean a program that is not
> copyrighted, e.g., "free" as in the context of "public domain"
> software, or does it just mean a program is widely available to the
> public, and thus not subject to export controls--even if it is
> shareware, e.g, publicly-available but copyrighted?
 
I asked the bureaucrats this same question, and was told it meant what 
it said, and that they would not define it any further - and would 
interpret it on a case by case basis.... however, they also said that 
something being widely available, or even imported electronically, did 
not mean a thing.... If it had a price attached to it, and was not 
marketed according to the strict interpretation they had for packaged 
software, it came under the rules.  Therefore although I had 
'imported' F-PROT electronically, I could not send it electronically 
to our offshore locations.... That would be a violation of the act.  I 
know it is silly... you know it is silly (and unenforcable)... but 
that is the way THEY intrepret it, and THEY MUST be right, right?

Even sillier was that I then asked that if I did apply for the export 
permit, could I export it electronically once the permit was obtained, 
and was told - NO!  It had to go through Customs, with the permit 
attached, and couldn't if in a communication! (Of course they are 
correct - it can't, but who needs postal delays on time sensitive 
material?)

I do not suggest that any of the rule makes sense - it doesn't in the 
context of either F-PROT or SCAN/CLEAN, etc.  These posts are for 
everyone's information.  However, I do ask if someone could check the 
latest rules for the US and other COCOM countries, and see if they 
have the equivalent. I suspect they do, and wonder how each 
bureaucracy would interpret this same issue.

Bob
- ---
   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
   RoseMail 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: Re: Vshield vs Virstop (PC)
Date: 15 Jan 93 23:39:00 GMT

Quoting from St29701@vm.cc.latech.edu to All About Re: Vshield vs Virstop 
(P on 01-15-93

S> VSHIELD with the /CF option to check for a file validation information
S> will not catch a file infecting virus like INTRUDER (very generic)
S> untill after it has infected.  I would have hoped it could chatch it
S> while the infection was trying to occure.

I may be wrong, but I thought the parameter was /CV. Its been a while 
since I used VShield.
 
Vshield can detect new and unknown viruses except for two types.
 
1. Stealth
2. Companion infectors.
 
When a stealth virus is running, It will disinfect infected files on the 
fly when they are opened for any reason, then re-infect the files when 
they are closed.
 
You could get Vshield to detect a stealth virus, but it would require two 
things.
 
1. a known clean write protected bootable diskette.
2. a known clean copy of Scan. Scan c: /CV. This compares the CRC of the 
   file against the CRC stored in the file.
 
Companion infectors do not infect files. They create small .COM files with 
the virus.
 
DOS always looks for a .COM file first, then goes back, and looks for the 
.EXE file.
 
The small .COM file with the virus is run first, then it loads the 
accompanying .EXE file.
 
Bill

- ---
 * WinQwk 2.0 a#383 * Intel sent Michelangelo on copies of LANSpool
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: Re: How to measure polymorphism
Date: 18 Jan 93 21:03:05 GMT

>From:    Declan Malone <maloned@ul.ie>

>                            Now how do you measure randomness in an
>objective way?  You can't really, and the irony of it is that the more
>you try, and the more objective/detailed your description becomes...

Grep Chaitin has done some excellent work on this (he had a general-
audience paper in a reasonably recent Scientific American, I think),
and has perfectly objective measures of randomness that also seem to
jibe very nicely with intuition.  The basic idea is that you can
measure the randomness of a string of bits by finding the smallest
program for some standard Turing Machine that produces those bits.
For a very random bitstring, of course, the smallest program simply
contains the string itself as data, and prints it out.  For very
non-random strings (0000000...), the corresponding program is
obviously simpler.  (This is a very rough description; if it seems
wrong to you, it probably is, and you're best off finding the original
papers rather than arguing with me about it!)

This agrees rather nicely with Bill Arnold's suggestion that we
measure polymorphism by how many lines of code we have to add to make
a detector...  *8)

DC
From: Nemrod_Kedem@f101.n9721.z9.virnet.bad.se (Nemrod Kedem)
Newsgroups: comp.virus
Subject: New way of opeing files??? (PC)
Date: 17 Jan 93 15:34:00 GMT


 >> I've heard that the NuKE group is starting to use function
 >> AX,6C00h/INT 21h to open files...

 > Why go so far? Did you here of writing to the disk via a port - instead
 > of using standard interrupt method to write?
 > I don't know of any A-V product that can monitor writing to ports,
 > (unless it was a debugger that monitors every command that an
 > application performs, and believe me: you don't want to use that!).

More then that: A product like the one you described will only work on 386,
or higher, in protected mode....

     Regards,
     Rudy.

Nemrod.Kedem@f101.n9721.z9.virnet.bad.se    (Nemrod Kedem)
FidoNet: 2:403/138   VirNet: 9:972/0, 9:9721/0, 9:9721/101
(972)3-966-7562 (14.4K)            (972)3-967-0348 (Voice)
P.O.Box 8394,     Rishon Le-Zion,   Zip 75253,     Israel.

- --- FastEcho 1.21a/Real!
 * Origin: <Rudy's Place - VirNet, Israel> Make Safe Hex! (9:9721/101)
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: Re: Untouchable (PC)
Date: 15 Jan 93 23:44:00 GMT

Quoting from Y. Radai to All About Re: Untouchable (PC) on 01-15-93

YR> This was due to a bug in UTScan.  I'm told it will be fixed in Versio
YR> 27.

This is good to hear. Not that there was a bug, but that you are aware of 
the problem, and at work on a solution.

YR> UTScan (like the rest of the Untouchable package) is, as you probably
YR> know, developed in Israel.  Israeli subscribers automatically get
YR> updates at the beginning of each even-numbered month, so we have had
YR> Ver. 26 for over a month now.  I have no idea when updates reach the
YR> U.S. market, but I presume there's a delay of a week or more.


Yes: I knew that Untouchable was an Israeli product called UnVirus, and 
sold by BRM Technologies, then redistributed in the U.S. by Fifth 
Generation Systems under the name Untouchable.

Bill

- ---
 * WinQwk 2.0 a#383 * FATHER CHRISTMAS activates Dec 19 - Dec 31