HDTenEightyP/NetNews huggingface dataset:
From: rslade@sfu.ca
Newsgroups: comp.virus
Subject: (c) Brain - part 3 (CVP)
Date: 28 Aug 92 23:31:49 GMT

HISVIR8.CVP   920810
 
                        (c) Brain - part 3
 
I have mentioned Alan Solomon's analysis of the Brain family with
regard to the dating of the ashar variant.  Fridrik Skulason
performed a similar analysis of the Ohio and Den Zuk versions, and
has been proven 100% correct in his conclusions.
 
The Ohio and Den Zuk variants contain the Brain identification code,
and so will not be "infected" or overlaid by Brain.  However, Ohio
and Den Zuk identify Brain infections, and will replace Brain
infections with themselves.  Thus, Ohio and Den Zuk may be said to
be agents acting against the Brain virus (at the expense, however,
of having the Ohio and Den Zuk infections).  frisk also found that
the Den Zuk version preferentially overlaid Ohio.  (This "seeking"
activity gives rise to one of Den Zuk's aliases: "Search".  It was
also suspected that "denzuko" might have referred to "the search"
for Brain infections.  This turned out not to be the case.)
 
There is text in both strains which indicates a similarity of
authorship.  Ohio contains an address in Indonesia, both contain a
ham radio licence number issued in Indonesia.  Both contain the
identical bug which overlays FAT and data areas on non-360K format
disks.  Den Zuk has the more sophisticated touches in programming. 
>From all of this, frisk concluded that Ohio was, in fact, an earlier
version of Den Zuk.
 
So it proved to be, in a message from the author.  The author turns
out to have been a college student in Indonesia who, to this day,
sees nothing wrong with what he did.  (On the contrary, he is
inordinately proud of it, and is somewhat peeved that his earlier
creation is "misnamed" Ohio: he's never been there.  The name of
Ohio was given by McAfee in reference to the place of the first
identification of the viral program: Ohio State University.)  Den
Zuko is his nickname, derived from John Travolta's character in the
movie "Grease".
 
Full details of Fridrik's analysis and his contact with the author
are available in Fridrik's article in the Virus Bulletin.
 
copyright Robert M. Slade, 1992   HISVIR8.CVP   920810
 
============= 
Vancouver      ROBERTS@decus.ca         | "The client interface
Institute for  Robert_Slade@sfu.ca      |  is the boundary of
Research into  rslade@cue.bc.ca         |  trustworthiness."
User           p1@CyberStore.ca         |    - Tony Buckland, UBC
Security       Canada V7K 2G6           |
From: suresh@papaya.iss.nus.sg (Suresh Thennarangam - Research Scholar)
Newsgroups: comp.virus
Subject: Virus Armour
Date: 31 Aug 92 13:08:50 GMT

In the Jan 1992 issue of Virus Bulletin,column Virus Anlysis, 
James Beckett writes:

<> Designers realized some time ago that the efficiency of micro-processors
<> can be increased by using the spare bus time to pre-fetch the next few 
<> bytes of instructions. This has the curious corollary that if the 
<> memory is modified a very short distance in front of the current
<> instruction, the processor never sees the change, as it has already 
<> read the relevant bytes ........

While this seems somewhat plausible I wonder if Intel's chip designers
didn't make the 80x86 processors smart enough to detect memory changes
in the vicinity of the current instruction and reload the pre-fetch
queue in response.

Well, if not then this is a hazard for programs that modify themselves
during runtime.
From: Kevin_Haney@nihcr31.bitnet
Newsgroups: comp.virus
Subject: Bug in F-PROT? (PC)
Date: 31 Aug 92 12:28:07 GMT

I was using F-PROT 2.04c from a bootable DOS 5.0 diskette.  After
booting from the A: drive, I wanted to scan another diskette in the A:
drive.  F-PROT produced unintelligible messages, such as "cotaaly
tanmcyng, ico staro%Nnurta...".  Another user here reported the same
phenomenon.  Does anyone have an explanation and/or fix for this
problem?

Kevin Haney
Internet: khv%nihcr31.bitnet@cu.nih.gov
From: cca07@seq1.cc.keele.ac.uk (Tim Simmonds)
Newsgroups: comp.virus
Subject: HELP with partition infector!! (PC)
Date: 28 Aug 92 16:13:14 GMT

I have scanned a PC for virus's using SCANv8.7B95 and it reported
that the Partition table was infected with the Cansu[Can] virus.
	And the CLEAN-UP program reported that the virus could not be
	removed safely....Is there anything else that can be donee
	and how can you get a copy of the Partition Boot Record.

	The PC is a IBMPC 386 running DOS 5.

Please help...

		  Tim Simmonds
		  Computer Centre
		  Keele University
		  Staffs
		  England
From: CCTR132@csc.canterbury.ac.nz (Nick FitzGerald)
Newsgroups: comp.virus
Subject: Any info on Gobbler-II a-v sw or Comrac (its publisher) ? (PC)
Date: 2 Sep 92 06:12:32 GMT

This morning I received a "beta evaluation copy" of Gobbler-II version
2.99B in the mail from Comrac - a Dutch software producer.  From the
way the accompanying letter was addressed, Comrac clearly got my name
and address from the net (only my sig says "PC Applications
Consultant" - my business card says "Consultant (PC Support)" and on
forms and things like electoral rolls I put my occupation as "Computer
Consultant").

Can anyone give me some more background on Comrac?  Have other regular
(?) posters to Virus-L/comp.virus also been sent one of these
diskettes (I haven't had time to look at it yet - looks like something
for tomorrow now).  Interestingly, whilst they got their original
contact with me via Email, the letter didn't mention an email address
to contact them.

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 Nick FitzGerald, PC Applications Consultant, CSC, Uni of Canterbury, N.Z.
 n.fitzgerald@csc.canterbury.ac.nz  (64)(3)  364-2337 Voice,  364-2332 FAX
From: HAYES@urvax.urich.edu
Newsgroups: comp.virus
Subject: is there a SCAN95? (PC)
Date: 23 Aug 92 12:38:06 GMT

Hi.

On a local BBS, a file called SCAN95.ZIP was uploaded, with the claim
it was fetched from McAfee Associates BBS - as well as some other
files.  The upload was reported to me by the SYSOP of the
above-mentionned BBS.

What are these files (beside SCAN their names escape me)?  Alpha
versions?  Up- dates?

I do not mind getting the files and making them available on the net,
but I'd like to be sure first...

Thanks in advance, Claude.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Claude Bersano-Hayes     HAYES @ URVAX                 (Vanilla BITNET)
University of Richmond   hayes@urvax.urich.edu     (Bitnet or Internet)
Richmond, VA  23173
From: rslade@cue.bc.ca (Robert Slade)
Newsgroups: comp.virus
Subject: New "Vengeance" virus on Fidonet (PC)
Date: 21 Aug 92 02:35:00 GMT

In a message in the Fidonet VIRUS_INFO discussion area, a poster
identified as "Richard Head" from 1:105/609.0 included a virus he
identifies as "Vengeance".  It was sent as a "DEBUG script"; a set of
commands which will instruct the DEBUG program shipped with every copy
of MS-DOS to make a copy of the virus.  The fact that it was published
on Fidonet means that many "virus-writer-wannabes" around the world
will be able to make copies and release them locally.
 
The poster states that SCAN version 86 is unable to find it: F-PROT
2.04B identifies it as a Vienna variant, SCAN 95 identifies it as
"Parasite", TBscan 4.1 identifies it as suspect through the
"heuristic" analysis.  (HTScan 1.18 with VSIG9207 and VIRx 2.3 do
not identify it.)  Those who do not have these scanners can check
programs with a file viewer for the words "Vengeance" and
"SKISM/Phalcon" near the end of the file.
 
The poster claims that it is a "hardware damaging" virus, but the
"author's notes" accompanying it indicate that it will only "format"
the first 32 tracks of the C: and D: drives, thus erasing the system
data.  The strings "*** Vengeance is ours! ***", "$ SKISM/Phalcon
'92 $" and "PATH=*.COM" can be found unencrypted in the body of the
virus which is appended to the infected file.  The name of the
infected file is also found, but this does not transfer to
subsequently infected files.  Infection is by "direct action": one
.COM file will be infected each time the virus is invoked. 
Activation date is on the 20th of each month.
 
==============
Vancouver      ROBERTS@decus.ca         | "It says 'Hit any
Institute for  Robert_Slade@sfu.ca      | key to continue.'
Research into  rslade@cue.bc.ca         | I can't find the
User           p1@CyberStore.ca         | 'Any' key on my
Security       Canada V7K 2G6           | keyboard."
From: tneuhaus@uwspmail.uwsp.edu
Newsgroups: comp.virus
Subject: V-SIGN virus (PC)
Date: 21 Aug 92 19:37:46 GMT

Need info. on "V-Sign" boot sector virus.

F-prot 2.04c recognizes but does not remove this virus.

Would appreciate receiving any informaiton on this virus, tools, and
tips for removal of this virus.

Regards,

   Tom
 -------------------------------------------------------------------
|  Tom Neuhauser                    |  tneuhaus@uwspmail.uwsp.edu   |
|  Information Technology, LRC 26   |  attmail!tneuhaus             |
|  University of Wisconsin          |                               |
|  Stevens Point, WI 54481          |  "He who hesitates, waits..." |
|  715-346-3058                     |                               |
 -------------------------------------------------------------------
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Amiga Anti-viral archive sites last changed 17 August 1992
Date: 1 Sep 92 18:55:09 GMT

Amiga Anti-viral archive sites		last changed 17 August 1992

eugene.utmb.edu
	John Perry <perry@phil.utmb.edu>
	This site can be reached through anonymous ftp.
	The Amiga anti-viral archives can be found in the
	directory /pub/virus-software/amiga.  The IP address is 129.109.1.21.
	A backup site is maintained at beach.utmb.edu,
	IP address 129.109.1.207.  Look in [ANONYMOUS.PUB.VIRUS.AMIGA].

ms.uky.edu
        Sean Casey <sean@ms.uky.edu>
        Access is through anonymous ftp.
        The Amiga anti-viral archives can be found in /pub/amiga/Antivirus.
        The IP address is 128.163.128.6.

uk.ac.hensa.micros
	HENSA/micros Managers <hensa@uk.ac.hensa.micros>
	Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
	NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
	FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
	Software archive for UK higher education sector. Anti-Viral stuff
	is not collected into a distinct area. Hostname is in UK format.
	(This site previously known as uk.ac.lancs.pdsoft.)
From: sapao@dcc.ufmg.br
Newsgroups: comp.virus
Subject: new virus found (PC)
Date: 19 Aug 92 19:59:31 GMT

A new virus not detected by McAfee's Scan93 nor Virx version 2.3 was
found in Brazil. F-prot said it's a new variant of jerusalem.  This
virus is a file infector for both .com and .exe files, including
command.com. Infected files grow of 1870 bytes (.com) or a variable
lenght of 1870 to 1885 bytes (.exe). Command.com grows 77 bytes, the
virus seems to overwrite some portion of it.

It can be found using the following string: (hex)
 56 56 56 00 00 00 43 4f 4d 4d 41 4e 44 2e 43 4f 4d 00 2a 2e 43 4f 4d
but this string is not much secure, because the virus was not
disassembled yet.  Samples were sent to well known virus researchers.

Lucas de Carvalho Ferreira
 Computer Science Student - UFMG - Brazil
 Internet Adress: Sapao@dcc.ufmg.br
From: mcampbel@nyx.cs.du.edu (Matthew Campbell 'The Fire Fox')
Newsgroups: comp.virus
Subject: Strange event when scanning. (PC)
Date: 30 Aug 92 01:33:54 GMT

What happened here?

C:\SCAN> SCAN C: @SCAN.DAT

SCAN 8.5V91 Copyright 1989-92 by McAfee Associates.  (408) 988-3832
Scaning for memory resident viruses.
Scanning for known viruses.
Scaning Volume: System
Scaning C:\NORTON\DISKMON.EXE

Sorry, an impossible internal error occurred.
The error code is: 8105


SCAN 8.5V91 Copyright 1989-92 by McAfee Associates.  (408) 988-3832

     This progrm may not be used in a business, corporation, organization,
     government or agency environment without a negotiated site license.


C:\SCAN> TYPE SCAN.DAT
/a /bell /chkhi /m /nobreak /sub

C:\SCAN> 

Programs active:   C = loaded in Config.Sys    A = loaded in Autoexec.Bat

C  Himem.Sys
C  DmDrvr.Bin (Disk Manager 5.0)
C  Ansi.Sys
C  Emm386.Exe (V4.44)  (devicehigh=c:\windows\emm386.exe on 1024 h=100)
A  Mark.Com   (Memory Mark utility)
A  DiskMon.Exe (Disk Monitor, protecting system areas on drive C:, Norton 6.01)
   Win.Com    (Windows 3.1)
   Win386.Exe
   Command.Com (Dos Shell running under Windows 3.1)

I know I have a virus, I'm just not sure what it is.  The scanners can't detect
it, but CRC checking does.  Command.Com has been renamed to Security.Cli.
The computer will boot fine, but I must reassign the COMSPEC to e:\command.com
as soon as possible.  E: is a write protected partition.

- --
Matthew Campbell     'The Fire Fox'
Internet:  MatthewCal@Ids.Net     MCampbel@Nyx.Cs.Du.Edu
           Ugcsmc0084%Mtvms2.Dnet@Terra.Oscs.Montana.Edu
A thought to remember: "The only way to God is through his son Jesus Christ."
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Unix security archive sites last changed 21 August 1992
Date: 1 Sep 92 18:58:14 GMT

Unix security archive sites		last changed 21 August 1992

cert.org
	Ken van Wyk <krvw@cert.org>
	Accessible through anonymous ftp, IP number 192.88.209.5
	A number of directories can be found in ~ftp/pub/tools.

funic.funet.fi
        Jyrki Kuoppala <jkp@cs.hut.fi>
        Accessible through anonymous ftp, IP number 128.214.6.100.
        Directory pub/unix/security contains programs to help in
        security, pub/doc/security contains various documents about
        security in general and unix security (like the worm
        documents)

wuarchive.wustl.edu
        Chris Myers <chris@wugate.wustl.edu>
        Accessible through anonymous ftp, IP number 128.252.135.4.
        A number of directories can be found in ~ftp/usenet/comp.virus/*.
From: gary@sci34hub.sci.com (Gary Heston)
Newsgroups: comp.virus
Subject: Re: McAfee's 95 series (PC)
Date: 2 Sep 92 14:50:10 GMT

HAYES@urvax.urich.edu writes:

>In reply to my query about the authenticity of McAfee Associates "95"
>serie of programs i got a message from a Belgian user who mentionned
>that the files were on the GARBO server.  It seemed to me that US
>programs should also been made available from a US site <grin>, so I
>fetched the files which are now available from us too.

They're also on uunet, along with F-Prot 2.05:

~/systems/msdos/simtel20/trojan-pro/fp-205.zip
~/systems/msdos/simtel20/trojan-pro/clean95c.zip
~/systems/msdos/simtel20/trojan-pro/netsc95b.zip
~/systems/msdos/simtel20/trojan-pro/scanv95b.zip
~/systems/msdos/simtel20/trojan-pro/vshld95c.zip

Available via FTP or anonymous 900-number uucp. Unless, of course,
you have an account with uunet.....   :-)

- -- 
Gary Heston    SCI Systems, Inc.  gary@sci34hub.sci.com   site admin
The Chairman of the Board and the CFO speak for SCI. I'm neither.
    The most dangerous person in the world is Jessica Fletcher.
        Everywhere she goes, people die.
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: CMOS "viruses" (PC)
Date: 1 Sep 92 02:36:55 GMT

>Kevin Haney Internet: khv%nihcr31.bitnet@cu.nih.gov

>About the possibility of a CMOS virus, as far as I know, the CMOS
>memory is not in the address range of 80x86 processors, so a program
>usually cannot access this memory directly or change it.  

Not quite true: a PC canot *execute* a program in the CMOS memory but
it can be read and written to with proper assembly language
statements.  Consequently, CMOS can be corrupted by a PC virus that is
executing (Azusa is the most common example).

Since PC and XT class machines did not come with any CMOS memory and
the amount of CMOS memory can be as little as 32 bytes, nearly all of
which is used, and different BIOSes use the CMOS memory differently,
it is not even a good place for a virus to store data.

For the hysterically minded, CMOS memory (actually battery backed RAM)
is a byproduct of the Motorola MC146818 (or eq.) Real Time Clock chip.
Back in pre-AT times, people had to set the clock every time the
system booted (even DOS 5.0 will ask if you want to set it if no
AUTOEXEC.BAT if found on boot). Consequently, one of the first
peripheral cards was a clock/calendar containing this chip.

So that an accurate date could be maintained, the clock had to
continue to run and the date/time stored even though the computer was
turned off.  Consequently, these cards also contained a battery to
keep the clock running. Since the chip was constantly powered it also
contained a small amount of RAM for storing the date. So that the
clock could be read and set it contained read/write logic accessable
from the CPU.

The name, CMOS, stands for Complementary Metal Oxide Semiconductor - a
chip manufcturing process that runs on exceptionally low power,
necessary for the original batteries to have a decent life - today
most batteries are rechargable lithium units that can last for several
years so long as the PC is used regularly.

Quickly, manufacturers found out that only a small part of the RAM was
needed for the clock (10 bytes) leaving quite a bit for "other"
activities.  First exploited by the IBM AT (Advanced Technology) it
can be used for many things. Just not viruses.

		More than you ever wanted to know about penguins,

						Padgett
From: gscobie@castle.edinburgh.ac.uk (G J Scobie)
Newsgroups: comp.virus
Subject: VACSINA Information Wanted (PC)
Date: 26 Aug 92 10:24:20 GMT

I have found the VACSINA virus on a student laptop which came in for
repairs. Using the following software produced these results:

Bates Anti-Virus Utilities v3.37

TREE.COM	Found Vacsina - TP05 <1206>
MEM.EXE		Found Vacsina - TP05 <1206>

F-PROT v2.04

TREE.COM	Infection: Vacsina (TP-5)
MEM.EXE		Infection: Vacsina (TP-5)
CHKDSK.EXE	Infection: Vacsina-loader

I am interested in the result of F-PROT indicating CHKDSK. Is this
file infected - probably but to what extent? Is it important that one
utility recognised CHKDSK while the other did not?

As always thanks in advance.

Garry Scobie
Senior Computing Officer
Edinburgh University Computing Services
Scotland
e-mail: g.j.scobie@uk.ac.edinburgh
From: rslade@sfu.ca
Newsgroups: comp.virus
Subject: On daily scanning (general)
Date: 1 Sep 92 19:36:43 GMT

In the ongoing debate concerning scanning versus other types of antiviral
protection, a thought.

Scanning has been denigrated not only for its inability to deal with "new"
viral programs, but also due to time consumption.  David Stang, in his
seminars, stresses that a five minute scan every day adds up to a full
20 hours, half a working week, over the course of a year.

However, in doing some work on a fairly average machine this week (386/25,
80 meg HD with 75 meg of files, 350 executable out of 2400 files), I noted
that Thunderbyte Scan took only 22 seconds to scan the entire thing.  (I
didn't time any of the others, but none of them took five minutes.)

Not necessarily as *reason* to scan on a daily basis, but less reason *not*
to.
 
==============                      ______________________  
Vancouver      ROBERTS@decus.ca    |    |     /\     |    | swiped
Institute for  Robert_Slade@sfu.ca |    | __ |  | __ |    | from
Research into  rslade@cue.bc.ca    |    | \ \    / / |    | Mike
User           p1@CyberStore.ca    |    | /________\ |    | Church
Security       Canada V7K 2G6      |____|_____][_____|____| @sfu.ca
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: Unix servers and DOS viruses (PC) (UNIX)
Date: 26 Aug 92 13:04:41 GMT

>From:    cohen@fitmail.fit.qut.edu.au (Mr Fred Cohen)
>
>	Which brings me to one last point.  I got a lot of complaints,
>but only one person wanted to perform similar experiments to confirm
>our results.  

Next week if all goes well and the crik don't rise, we will be setting
up a Novell 3.11 LAN (Netware - Intel based) for some testing &
validation.  Suggestions for experiments (please be explicit),
uuencoded cracker programs (or name & archive site), as well as
general encouragement would be welcome.  To keep the bandwidth down,
please reply to padgett@tccslr.dnet.mmc.com (I'net) and not Virus-L.

					Breezily,

						Padgett
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Apple II Anti-viral archive sites last changed 07 July 1992
Date: 1 Sep 92 18:55:40 GMT

Apple II Anti-viral archive sites	last changed 07 July 1992

brownvm.bitnet
        Chris Chung <chris@brownvm.bitnet>
        Access is through LISTSERV, using SEND, TELL and MAIL commands.
        Files are stored as
                apple2-l xx-xxxxx
        where the x's are the file number.

uk.ac.hensa.micros
        HENSA/micros Managers <hensa@uk.ac.hensa.micros>
        Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
        NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
        FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
        Software archive for UK higher education sector. Anti-Viral stuff
        is not collected into a distinct area. Hostname is in UK format.
        (This site previously known as uk.ac.lancs.pdsoft.)
From: guest@dhhalden.no (.GJEST)
Newsgroups: comp.virus
Subject: Re: Anyone for a Feist ??? (PC)
Date: 27 Aug 92 11:45:08 GMT

ISB202REID@redgum.qut.edu.au (Did somebody say Coffee ??????) writes:

>A few days ago I came across a machine absolutely
>covered by the feist virus..

>Clean 93 wouldn't remove it, although it was in F-Prot 2.04a's
>database, wouldn't even recoginise it !!

>Can someone tell what it does and _can_ it be removed...

Have you tried Integrity Master. It have solved all my problems!!!
From: beaurega@ireq.hydro.qc.ca (Denis Beauregard)
Newsgroups: comp.virus
Subject: Auto-detecting virus (PC)
Date: 2 Sep 92 17:52:27 GMT

I would like to write a program that will check if it is per se
holder of a virus.  The method I have in view :

Compile the program.
Compute the checksum of the program.
Put the checksum in the program.
When starting the program : Stop the program if the checksum has been altered.

Advantages :
1- User can not modify the program to remove the copyright notice
   (whic I can code anyway)
2- Virus modifying hte program would be catched immediately so that
   my programs will be reputed for being virus-safe

Inconvenients :
1- This won't work on older DOS versions (since the file name is not available)
2- This will slow down the program loading, but by a small amount

I would like to get feedback (I will keep subscription for that group
for one month as I usually subscribe only to a group when I have a 
specific interest).

Also, I never saw a self-protected program.  Even an anti-virus program
has as instructions : use the included diskette if infection is known.
I think this is because DOS can be infected, but I feel these programs
are not self-immunated (but I can be wrong).

Would it be safer to use a 32 bit checksum (I understand a 16 bit
checksum would mean if something if wrong, odd are 1 to 65536 not to
find it).  A 32 bit machine will just count faster a 32 bit sum.
So I would use 32 bit for speed reason instead of security (while
changing the checksum will be harder if 32 bit, and still more if
instead of adding 32 bits, I mask some bits and add them twice).

- -- 
  \_\    Denis Beauregard  *  internet:beaurega@ireq.hydro.qc.ca
 /   \   Genealogiste officiel : Beauregard/Jarret/Jarest/Vincent
J   __>  Un Quebec renouvele dans une Amerique renovee
\_.-===                                                  Opinions ? Et pis non 
!