HDTenEightyP/NetNews huggingface dataset:
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Untouchable (PC)
Date: 11 Dec 92 21:39:13 GMT

@fuug.fi:kari.laine@compart.fi (Kari Laine) writes:

> If you look at the adds they are bolstering you don't have actually
> anything to worry. But if you have a look under the hood ....

As always, the adds are overstating the features of the product and do
not mention some of its drawbacks. Of course, it is possible to write
viruses that the product will not stop (and will even not detect). Of
course, its restoring engine cannot disinfect all kinds of viruses.
Nevertheless, the product is -very- good, especially the integrity
checking part of it.

> I personally think the claims they make are rubbish. I am sure it
> finds couple of viruses but to trust on it, well i won't

This is an unfounded understatement... The product can deal
successfully with WHOLE CLASSES of unknown viruses and is able to
detect ALMOST ALL types of known viruses.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: tgee@alfred.ccs.carleton.ca (Travis Gee)
Newsgroups: comp.virus
Subject: capture.com false positive? (PC)
Date: 11 Dec 92 19:27:03 GMT

In the analyse.doc that comes with f-prot v. 2.06a, it says that

>Currently the following programs are known to cause a false positive:
>
>DIR1.COM
>GBXIBMEL.EXE
>GRAPHICS.COM
>PC-CACHE.COM
>WORD.COM     (Microsoft Word)
>XTPRO.COM

I got one for graphics.com , alright, but also for qdcolor.com (a qdos
file), and capture.com (a Word5 file). The qdcolor.com warning says
that it contains code to search for other executable files: no
kidding! It's an installation device for the qdos user interface.
capture.com, however, 'modifies itself in a highly suspicious way...'
This wasn't my machine and I don't know Word5, so I don't have any
hunches about it.  Two more Type I's for the record, though!
From: amichiel@mailbox.syr.edu (Allen J Michielsen)
Newsgroups: comp.virus
Subject: 1575 (15xx) virus, info request (PC)
Date: 10 Dec 92 03:24:42 GMT

I've just finished cleaning up an outbreak of the 1575 (15xx) virus.
I understand this is a fairly old virus, and while it was a new
breakout here, it seems to have been a delayed outbreak from another
educational site.

Anyway, by what mechanism is this virus spread.  I found compressed
(lzexe) files which were infected, and tons of executeables.  However,
I have yet to find anything which I could identify as the original
source.

Information in this regards would be of help.  Thanks
al
From: nathan@remus.rutgers.edu (Nathaniel Schiffman)
Newsgroups: comp.virus
Subject: List of Trojan Virus Doctors? (PC)
Date: 9 Dec 92 18:04:11 GMT


 Sorry if this is answered in some FAQ that I haven't seen, but I think it
would be a great service to all if someone from the McAffee company, or
anyone who happens to have this information, would post a list of the
"skipped" Virus Doctors.
 That is, the version numbers of Virus Doctors that are unused due to people
finding Trojan Horse code in those copies.
 I mean, it's nice for the Virus Dr. people to skip those numbers when
putting out official versions of the program, but if they don't tell us
which are the ones they've skipped, it doesn't help much!
 Thanks.
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: F-PROT & CLEAN won't remove this one !!! (PC)
Date: 11 Dec 92 09:32:48 GMT

overberger@gw.wmich.edu writes:

>We may have found a new variety of STONED on our campus. It seems to
>infect the partition table of infected DOS machines, disabling both
>the COM: ports as well as doing some unusual things to the root
>directory. F-Prot 2.06a identified it as a STONED virus but refused to
>remove it. Ditto with the latest version of CLEAN. After mailing Frisk
>and receiving a response indicating he believed it was not a virus
>(basically a blow off)

Well, unless I'm wrong, the description I got seemed to indicate an
old problem - the message "Possibly a new variant of stoned" happens
quite often on disks that have once been infected with stoned, and
improperly disinfected by a program that just overwites a part of the
boot sector with valid code, leaving a part of the virus, so my
program only gets a partial match.  That happens much more frequently
than new virus variants, so I just thought it was the case here too -
I apologize if I was wrong, but you see, without a copy of the boot
sector it is practically impossible to tell exactly what is going on.

- -frisk
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Does anyone have info on DAME? (PC)
Date: 17 Dec 92 14:47:59 GMT

MICKLE@csmcmvax.bitnet (Dave Mickle x5205) writes:

> We've got a PC which is displaying a message to the effect it's
> infected by the "DAME" virus.  Don't know what symptoms there are in
> addition to the message.  We're going to do a low level format, but
> would like to know what we've contracted.

Please read the FAQ for a description how to report such cases. In
particular, you should state the name and the version of the program
that reported the virus.

"DAME" is the name that SCAN gives to all MtE-based viruses. However,
a few other scanners use it too... The MtE detector in SCAN versions
before 99 is not good enough and might sometimes report false
positives. Did you get a report only about one infected file or about
several files?

It is not possible to tell you "what the DAME virus does", because
there is no such thing as "the DAME virus". There are several
different viruses, which are using the MtE for polymorphism and they
do different things. All of them are reported as DAME by SCAN (except
some of the unencrypted replicants, but this is irrelevant).

At last, a low level format is never necessary. Just delete all
infected files and replace them with clear originals.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: leveret@warren.demon.co.uk (Nick Leverton)
Newsgroups: comp.virus
Subject: Re: Dangerous bug in CHKDSK that comes with MS-DOS 5.0 (PC)
Date: 15 Dec 92 22:10:29 GMT

pd@nwavbbs.demon.co.uk (Peter Duffield) writes:
>mramey@u.washington.edu writes:
>
>>How can you tell if you have MS-DOS version 5.00a or not ?
..
>There is an undocumented switch to the "ver" command...  If you type 
>"ver /r" it will give you not only the version number but the revision
>as well. Mine gives the following response...
> 
>    C:\>ver /r
>
>    MS-DOS Version 5.00
>    Revision A

Unfortunately the 04/09/91 version of MS-DOS 5 *also* claims to be
Version 5.00 Revision A. I know: I still use it :-( This seems to
reduce its utility in detecting which version of DOS5 you have.

Nick.
From: Malte_Eppert@f6002.n491.z9.virnet.bad.se (Malte Eppert)
Newsgroups: comp.virus
Subject: Re: Is this a real virus? (PC)
Date: 13 Dec 92 13:17:00 GMT

Hello Gary,

 > The virus began in Sector 0, and wrote variations of ASCII 0-255
 > all the way through the boot sector and the FAT table.  (Or so it seemed
 > to me from using Norton Utilities in Maint mode...)  Luckily, it
 > stopped before it actually hit the data area, and we were able to
 > quickly restore the machine to working condition without loss of data.

Whoww! How did you manage to get your data straight with a scrambled
FAT? Do you have a tool for it?

cu!
eppi

- --- Via SCANTOSS V 1.37
 * Origin: No Point for viruses - The EpiCentre! (9:491/6002)
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: Dangerous bug in CHKDSK that comes with MS-DOS 5.0 (PC) (fwd)
Date: 10 Dec 92 07:48:08 GMT

Hi Mike,

mramey@u.washington.edu (Mike Ramey) writes:
>How can you tell if you have MS-DOS version 5.00a or not ?

[...your comments on calling Microsoft and Vesselin's re-posting of
a message about the CHKDSK problem deleted for brevity...]

Another way to check the revision of the DOS version is to make use of
the undocumented /R switch in the VER command.  This returns the
version and revision of DOS loaded as well as whether or not DOS is
loaded high.

For example, shelling out to DOS and typing "VER /R" reveals:

  D:\PCPLUS> VER /R

  The Operating System/2 Version is 2.00 
  Revision 6.427
  DOS is not in HMA

Heh heh.. Oops.  Looks like that is also supported by OS/2's DOS emulator.
Let me take another try at that:

  D:\PCPLUS> VER /R

  MS-DOS Version 5.00
  Revision A
  DOS is in low memory

There we go.  As you can see, MS-DOS Version 5.00 Revision A is present.

Regards,

Aryeh Goretsky
Technical Support

PS:  I received your postal mail on Monday.  Thanks.
- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: halgrim@diku.dk (Maz H. Spork)
Newsgroups: comp.virus
Subject: OS/2 2.0 Viruses (OS/2)
Date: 16 Dec 92 15:25:56 GMT

If you've come about a virus, suspected or real, using OS/2 2.0, I'd
like to hear about it.

Maz Spork
halgrim@diku.dk
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: capture.com false positive? (PC)
Date: 16 Dec 92 12:40:39 GMT

tgee@alfred.ccs.carleton.ca (Travis Gee) writes:

> In the analyse.doc that comes with f-prot v. 2.06a, it says that

> >Currently the following programs are known to cause a false positive:

You should read the documentation more carefully. The programs listed
by you do not cause a false positive; they are known to trigger the
heuristic warnings.

> file), and capture.com (a Word5 file). The qdcolor.com warning says
> that it contains code to search for other executable files: no
> kidding! It's an installation device for the qdos user interface.
> capture.com, however, 'modifies itself in a highly suspicious way...'

Have you actually looked at the program with a debugger? I bet that it
indeed does what F-Prot warns you about.

> hunches about it.  Two more Type I's for the record, though!

One more user who either has not read the documentation carefully, or
does not understand the abilities and the limitations of the heuristic
scanning.

The heuristics cannot tell you whether the program contains a virus or
not. They can only tell you whether the program does some strange
things that are usually used by viruses. Even this cannot be always
discovered! If the heuristics do not report a file as suspicious, this
means NOTHING, except that they have been unable to find anything
suspicious in it... It might contain a virus, nevertheless...

Conversely, if they tell you that a program does suspicious things,
this means ONLY that the program indeed does so - it doesn't mean that
it is infected. Of course, the infected programs cause such warnings
with a greater probability.

If you don't understand the above deeply, you should not use the
heuristic scanning.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Jerusalem varient which crashes a novell network? (PC)
Date: 15 Dec 92 12:26:53 GMT

dab6@po.CWRU.Edu (Douglas A. Bell) writes:

> Recently at CWRU we had files on a novell 3.11 server get infected 
> with a varient of the Jerusalem virus.

> What is strange was that if a user ran an infected file on the network,
> it would crash the file server.

> Has anyone seen this kind of behavior before?

Yes, the standard Jerusalem (huh? what standard? Well, I mean
Jerusalem.1808.Standard <grin>) always crashes the network, because of
some conflicts between the undocumented DOS function calls that it
installs and uses for "Are you there?" questions and memory
installation. At least, it has always crashed in our tests. There are
variants of it that are using other undocumented function calls, that
do not cause a conflict.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: TBAV 5.01 (PC)
Date: 15 Dec 92 12:34:14 GMT

Malte_Eppert@f6002.n491.z9.virnet.bad.se (Malte Eppert) writes:

>  > BTW, the integrity checking seemed -very- weak to me, but I have
>  > not tested it completely...

> By default TBCHECK checks only the entry point of an executed file.
> (You can set it to check the whole file's CRC, but that's documented
> to be real slow.)  That's what I think to be the weakness, but could
> you explain why?

It is a security problem, indeed, and a major one. Checking only the
entry point of the files is -very- insecure, because it is possible to
infect a file, without modifying any of the following: size, date,
time, attributes, entry point.

However, I was thinking about other security problems. TbCheck uses a
CRC with a fixed generator, and this can be easily subverted. It
doesn't know about PATH companions. It doesn't know about the DOS file
fragmentation attack. And so on...

I would strongly suggest to any aspiring authors of integrity checking
packages to take a careful look at my paper "Possible Attacks Against
Integrity Checking Programs And How to Prevent Them". The paper has
been published in the proceedings of the 2nd International Anti-Virus
Conference, organized by Virus Bulletin, September 1992, in Edinburgh.
An improved version of the paper has been published in the proceedings
of the 2nd EICAR conference in Munich, December 1992. The improved
version of the paper is available for anonymous ftp from our site as

ftp.informatik.uni-hamburg.de:/pub/virus/texts/viruses/attacks.zip

The archive contains the paper in both LaTeX and ASCII format.

> Are there many link viruses (guess that's what
> TBCHECK is written for) which don't touch the entry point at infection
> time?

I can think about at least two - LeapFrog and Emmie. The point is that
it -is- possible to do it, there -are- viruses that are doing it,
therefore, the integrity checkers -must- take into account this
possibility.

> BTW: I managed to have Armageddon infect a file after I allowed the
> virus to go TSR, though I've activated the whole product palette.
> What's that - a special way to put its code into a file, which TB
> doesn't recognize?

I'm afraid that I do not understand the question... There's nothing
special with Armagedon - it just prepends itself to the COM files -
like the Jerusalem virus does...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: sb@next.neuro.emory.edu (Stephen O. Berger)
Newsgroups: comp.virus
Subject: Virus that removes comand.com, config.sys, autoexec.bat (PC)
Date: 9 Dec 92 17:30:43 GMT


  Hi,

    We've had 3 machines here within the past two weeks when we try and
  boot them come up and say missing or bad command interpreter.  When
  we booted from floppy, we discovered that command.com was indeed
  missing.  The autoexec.bat and config.sys files were also gone from
  the system.

    Does anyone know of any viruses which might cause this and have
  any advice as to how we should proceed ?  I have already run
  the Macafee virus scan program and it doesn't find anything.

    Please respond by email if possible.

  Steve Berger (sb@onripx.neuro.emory.edu)
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Is this a DOS virus? (PC)
Date: 11 Dec 92 08:05:10 GMT

echrstmn@lab4.smcm.edu (Evan Christman) writes:


>	On one of our PC's we are observing some odd behaviour of our
>DOS files.  The symptoms are: certain DOS files, share, dosshell and a
>few others report that their size has been altered when I run a
>CHKDSK. 

Infection by a stealth virus is a possibility, but simply regular FAT
corruption is a much more likely explanation.  Do the following:

    reboot from a clean diskette

    rerun CHKDSK

    if it reports that the file sizes are wrong, you just have regular
    FAT corruption.  In that case you can try to run CHKDSK /F and
    then replace the damaged files, just to be 100% safe :-)

- -frisk
From: RPH0470@tntech.bitnet (Richard Hosker)
Newsgroups: comp.virus
Subject: Re: DOS CHKDSK bug (PC)
Date: 10 Dec 92 23:32:10 GMT

Mike Ramey <mramey@u.washington.edu> writes:

> How can you tell if you have MS-DOS version 5.00a or not ?
>
> I called Microsoft and requested the updated version for my computer
> labs, even tho' we have not encountered the failure conditions yet.  I
> was told that in MS-DOS version 5.0a, the date on COMMAND.COM is
> 11-11-91.  I have not yet received the updated version, so I cannot
> confirm that.  (My current DOS-5 COMMAND.COM date is 4-09-91.)  If I
> learn anything different, I will post it.

I don't have a definitve answer to the question Mike posed, but I can report
one way you *can't* tell which version you have... :-/

The VER/R command returns the following for **both** versions:

        DOS 5.00
        Revision A
        DOS in <low,high> memory

(The wording may not be exact here, but the Revision A part is correct.)
I have tested this on both versions, dates 04-09-91 and 11-11-91.

Since the "Revision A" message appears regardless of version, this is *NOT*
a reliable way to determine which version you have.  To be safe, check the
date.

BTW, by my reckoning, the 65280-cluster limit represents a partition of
about 130 MB.  No small bug, this... :-(

Hope this heads off any confusion or false security...

==============================================================================
Richard Hosker          : ttttttttt  Tennessee Technological University
rph0470@tntech.edu      :   t u t u  Cookeville, TN
PO Box 6083 TTU         :   t u t u
Cookeville, TN 38505    :   t uuuuu  "Home of the Golden Eagles"
==============================================================================
Disclaimer: After this many years of college, these opinions are among the
few things Tech *hasn't* taken from me yet.  ;-)
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: Re: Does anyone have info on DAME? (PC)
Date: 16 Dec 92 20:31:42 GMT

David Mickle writes:
>We've got a PC which is displaying a message to the effect it's
>infected by the "DAME" virus.  Don't know what symptoms there are in
>addition to the message.  We're going to do a low level format, but
>would like to know what we've contracted.

If it's only one file, or is not a COM or EXE file, or is less than
2K, you most probably have a false id.  DAME=Dark Avenger Mutation
Engine.  It's what everyone else is calling MtE.  I believe only
McAfee calls it DAME.

If indeed you are using McAfee, they'll probably want a copy of the
reported file to investigate.

Jimmy Kuo                                       cjkuo@ccmail.norton.com
Norton AntiVirus Research
From: masjol@dou.dk (J|rgen Olsen)
Newsgroups: comp.virus
Subject: RE:Your missing command.com, config.sys & autoexec.bat (PC)
Date: 14 Dec 92 20:26:36 GMT

Are you sure you do not have a joker or a joke-program that does it??

It does not sound like a virus to me - anybody else who believe
that I am wrong ??

We had one clown that build such things into a program he released (a Trojan
Horse).

He is no more!

Happy X-mas & hunting

J Olsen
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: Integrity Management
Date: 10 Dec 92 00:42:38 GMT

>From:    "Ross M. Greenberg" <72461.3212@CompuServe.COM>

>C'mon now, Padgett: my own Virex-PC code has had this ability for
>something like two years.  Heck, even Flu_Shot+ has had that since Day
>One (well, since version 1.1, at least) which means that it's been
>available for about four years by this time...
 
Was deliberately avoiding mentioning names since there had been talk about
"commercialization" of the net. In truth there are quite a few that have
been around for even longer, but to see which ones I use you are going to 
have to look up back issues since I am not going to mention Dr. Panda or 
Enigma-Logic either & Aryeh already announced VSHIELD's /CF switch 8*).
Fred can make his own announcement just like Tarkan and Yisreal did (and
would be pleasently surprised if it was as informative).

IMNSHO, the proper goal of a vendor should be to educate the public to the
point at which the superiority of their product will be evident. Sure there
are going to be "trade secrets", but they should be confined to *how* a
product does things, not *what* it is doing. If a product achieves
speed by checking only the first five (ten, twenty) bytes of a .COM file, it
is not going to be secret for long from anyone who checks. 

I really do not care what anti-viral program people use as long as it is
*something*. Sheer diversity is the hardest thing for a virus writer to
surmount and most of the front line offerings are "good enough" and all
are "getting better". Sure everything misses something and certainly
Fred or I or Frisk or Vess could write something that no present scanner
would pick up. As said before, my concern today is directed attacks
against a known target. They have the same vulnerabilties as assasination
targets, are not as mobile, and the attacker need not be concerned
about excape.
					Chilly isn't it ?

						Padgett
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Need Info about INVOLVE virus (PC)
Date: 11 Dec 92 19:38:23 GMT

mcafee@netcom.com (McAfee Associates) writes:

> >> hello, I am new here. I hope someone could give me some information
> >> about the INVOLVE virus.  I know that it changes the date on the files
> [...deleted..]
> >Hmmm... Which version of SCAN? SCAN 99 never reports such name when
> >run on our virus collection. Also, no such name is listed in
> >VIRLIST.TXT. On the top of that, I have never heard about a virus with
> >this name... Maybe Aryeh can comment?

> The Invol (Involuntary) virus is a memory-resident .EXE and .SYS file
> infector about 1,400 bytes in length.  It has a little message embedded in 
> it thanking users for involuntarily spreading the virus.  Please let me
> know if you don't have a copy.

I do have a copy of both variants of Involuntary, but the original
posting was asking about the INVOLVE (not INVOL) virus and that has
misleaded me. I have done a full search in my report files, instead of
a fuzzy one... :-)

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany