HDTenEightyP/NetNews huggingface dataset:
From: dmarcher@acsu.buffalo.edu (Dave Archer)
Newsgroups: comp.virus
Subject: Vlad the Inhaler? (Win 3.1 upgrade) (PC)
Date: 10 Apr 92 21:08:10 GMT


  I upgraded to Windows 3.1, and had an interesting problem.  My D:
drive got semi-trashed and I saw that a task with the title "Vlad the
Inhaler" was running.  (Saw Vlad while using Alt-Tab to switch
windows, trying to bring it up gave me the problems accessing D: that
I started having.)

  While the D: problem is perhaps a problem with Win 3.1, Stacker, a
SCSI drive with an ST-02 interface, and the new SmartDrive, this Vlad
the Inhaler thing is a bit odd.

  I was thinking that it might be some screensaver that comes with Win
3.1, but I looked at the screen savers, and it's not one of them.

  I don't know what it is, so I ask, anybody know?  At this time I
don't think it's a virus, but until I find out what it is, it's a
possibility.

Thanks, Dave
- ---
  Dave Archer  |  Internet: dmarcher@acsu.buffalo.edu
               |    Bitnet: V116KZND@UBVMS
               |     GEnie: D.ARCHER
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Post March 6 Michelangelo Infections (PC)
Date: 9 Apr 92 20:30:37 GMT

RCTE4@Jetson.UH.EDU writes:

> look at it (I know, curiosity felled the feline.....).  Took it home, booted
> my pc, put the infected diskette in the A: drive (my b: drive is wrong size
> for this disk), did a Dir, deleted the student's assignment files, then ran
> F-Prot on the A drive.  I had previously confirmed the infection at school
> with F-prot.  F-prot said "The Stoned virus search pattern has been found
> in memory..."

Sigh... It's called a ghost false positive. The reason is that the
infected boot sector is read in the DOS buffers during the DIR command
and F-Prot detect the scan string in the buffer... Frisk, I thought
that F-Prot uses a more intelligent approach... Why are you looking
for a Stoned variant in the low memory?

>       Is this something as simple as Dir copying the boot sector and FAT into
> memory and F-prot finding it there, or is there a risk of infection from
> (this version of) Michelangelo even after booting?  I also re-booted from

Don't worry, you are not infected. Simply reading the infected boot
sector put the virus in memory, but it has not been activated. The
only way to activate it is to actually execute it (that is, to try to
boot from that diskette). F-Prot got fooled (and it shouldn't).

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: CHESS@YKTVMV.BITNET (David.M.Chess)
Newsgroups: comp.virus
Subject: re: OMICROM virus (PC)
Date: 2 Apr 92 20:57:20 GMT
Organization: Lehigh University

From:    Antonio Joao Nunes Cardoso <MANTONIO@PTEARN.BITNET>
>A friend of mine asked me to ask this : How to remove the NEW OMICROM
>virus reported by CPAv ?
>
>He used CPAV to remove it and he couldn't remove that properly.

"OMICRON" is (perhaps among other things!) another name for the
viruses that we call "FLIP".  There are two that are reasonably common
in the world: the 2153 and 2343 strains.  They infect both files and
master boot records of hard disks.  The most reliable removal is to
erase and replace the infected files, and use some MBR-fixing utility
(see previous traffic in this list about the /MBR option of FDISK) to
fix the hard disk master boot records.  Or you could get some other
anti-virus package that can do it automagically, although that's not
as reliable.  (Or he could call CP and ask them if they have an update
to CPAV that will do it.)

The 2343 strain (the rarer of the two) also patches COMMAND.COM, so
your friend might want to replace that, too, just in case (it doesn't
make it viral, it just makes it lie about some file lengths and/or not
work at all).

>Another thing is that someone told him that the OMICROM virus is a
>mutating virus wich can be traced as FRODO or 4096.

Nope!  Not unless someone is using "OMICRON" to refer to some other
virus besides the FLIPs...

- - -- -
David M. Chess                                          mI' jIHbe' jay'!
High Integrity Computing Lab                            loD tlhab jIH!
IBM Watson Research                                          -- qama''e'
From: IPBR400@INDYCMS.BITNET (Pat Ralston)
Newsgroups: comp.virus
Subject: re: Intel LANProtect (PC)
Date: 10 Apr 92 14:21:18 GMT

Yes,
There is a product called LANProtect by Intel.  I have a brochure on
it and I also would like and assessment of it.  Does anyone else know
of it or better yet has any one used it?  There is an 800 phone number
listed on the brochure --- 1 - 800- 538-3373

The brochure claims to be "Novell Labs Tested and Approved" ...is
there and Novell literature on this product?

Pat Ralston
IUPUI
Indiana University - Purdue University at Indianapolis
From: WALKER@aedc-vax.af.mil (William Walker C60223 x4570)
Newsgroups: comp.virus
Subject: Re: Stoned, No-Int, and SCANV86B (PC)
Date: 8 Apr 92 14:55:00 GMT

To Ken and VIRUS-L readers,

  I apologize for the duplicate message about "Stoned" and "No-Int."  I
never received acknowledgement that the first message was received, so
I incorrectly assumed that the list server never received the message,
and sent it again (bad choice).  Sorry.

[Moderator's note: It's at least partially my fault for not noticing
the duplicates...  (Sigh.)  I do get a lot of duplicates -
particularly from comp.virus readers who post to the newsgroup
multiple times when their message does not appear in the group
immediately - and I spot _most_ of them, but occasionally, they slip
through.]

 - - - - - - - - - - - -
In reply to Padgett Peterson's "walks and sounds like a duck" message:
How does one determine if a virus is actually a "strain" of another
virus, and not just distantly related to it?  The code for
"Michelangelo" does not look to me very much like "Stoned," though I
can see that they function similarly (except for the payload).  There
are some major differences, such as the structure of the data area and
the fact that "Stoned" (and closely-related viri) have two consecutive
jumps which start the code, while "Michelangelo" has just one.
Something like "Azusa," on the other hand, is obviously a strain of
"Stoned," as several sections of the code are not only the same as
those in "Stoned," but are also in the same location, and it also has
the two consecutive jumps.  I would think that a "virus strain" should
have a code-level resemblance to the virus of which it is a strain,
while a virus that is just "related" to another should have just a
functional resemblance to its counterpart.

I guess that this is what the AMC's Identification/Classification
committee is set up to decide.

Bill Walker ( WALKER@AEDC-VAX.AF.MIL ) |
OAO Corporation                        |   "... but as we say on Earth,
Arnold Engineering Development Center  |          c'est la vie."
M.S. 120                               |        - James T. Kirk
Arnold Air Force Base, TN  37389-9998  |
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: polymorph virus questions (PC)
Date: 2 Apr 92 16:03:56 GMT
Organization: Lehigh University

In Message 26 Mar 92 14:41:09 GMT,
  bontchev@fbihh.informatik.uni-hamburg.de (Vesselin writes:

>First, it is "polymorphic", not "polymorph". Second, it doesn't need
>to be self-encrypting (although all of the current ones are).

Uh, how could you get polymorphism without self-encryption - moving
blocks around, maybe, but that might also qualify as a primitive
encryption...

Or were you thinking of something else ?

>The polymorphic viruses are to the scanners what the stealth viruses
>are to the integrity checkers. They "attack" the particular kind of
>anti-virus software by making it more difficult to be maintained or
>used.

Of course, one program that is (usually) effective against polymorphic
viruses (at least the self-encrypting ones) is heuristic analysis :-)

[this is what...the 4th message today where I mention it...?...sorry]

- -frisk
From: MIN@rulcri.LeidenUniv.nl
Newsgroups: comp.virus
Subject: some research subjects, info wanted
Date: 2 Apr 92 08:06:00 GMT
Organization: Lehigh University

Hello,

As from this week I am doing research into the following issues:
- - how to determine from a virus program which soft- and hardware the author
 has
  used for developing the virus (well at least how to make a good guess)
- - whether or not it is possible to prove that a certain virus is the result of
  a certain previous version (with previous version I mean an _unfinished_
  virus program)
- - if there is much room for improvement in the "heuristical" search method,
 and
  if it will eventually become the standard method for virus detection

I would very much appreciate a response concerning:
- - how far current research into these issues has developed
- - suggestions where to look for more information, apart from this list

Thanks in advance,

Patrick Min
Leiden university
department of Computer Science
min@rulcri.leidenuniv.nl
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: home made anti-virus tricks and questions (PC)
Date: 13 Apr 92 11:12:10 GMT

cosc15yc@rosie.uh.edu (92S10711) writes:

> 	1.  If I set the attribute of all files on disk to read only,  would
>        that trip any known/popular virus that trying to infect say command.co
m

Most viruses will continue to infect happily. For more information,
read the FAQ.

>     	2.  Can virus infect  any file extension or just .com and .exe?

Yes, most viruses can infect any file that is executed, regardless of
its name.

> 	3.  Can virus infect( not destroy)  a disk with no .com and .exe
>         files and no bad sector

Yes, some (not all) boot sector infectors will infect (and spread
from) such diskettes. And any virus (in fact any program) can damage
them, of course.

> 	4.  Can virus infect a nonbootable floppy with only .zip file with no
>         bad sector ?

This is equivalent to question 3. So is the answer.

>   Did you ever del the command.com in the root directory?   Take 3 weeks

Yep! And it's no more there! :-) Jokes aside, recently a silly
anti-virus program tried to find the file C:\COMMAND.COM.
Unfortunately for it, my command interpretter is called 4DOS, is an
EXE file, resides in the \DOS subdirectory and all this on drive D:...
:-)

> to find/learn that only dos 3.3 or above can access 40meg partition HD
> when I first buy a computer.

Hm, DOS 3.3 cannot access a primary DOS partition larger than 32
megs... You either mean version 3.31 or an extended partition.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Stoned/SBC (PC)
Date: 8 Apr 92 09:42:55 GMT

In Message 30 Mar 92 14:17:57 GMT,
  d246@uni05.larc.nasa.gov (Braden Glen) writes:

>positive and reran F-PROT.  It reported SBC again, on the same
>program.

This is indded a false alarm, as you suspected - Version 2.02 of F-PROT
did produce some false alarms:

      "Possibly a new variant of Sylvia" in TUTOR.COM (Word Perfect 4.2)
      "Shirley" (Quick Scan), in DIET 1.10A overlay-mode compressed files.
      "SBC" in several small EXE files.
      "Yaunch" (Quick Scan) in a few programs.
      "AIDS" in a few programs from Personal Bibliographic Software

The reason was basically that in 2.02 I rewrote my scanning "engine"
completely from scratch, and a few problems slipped in...they were all
corrected, and no false alarms have been reported from users of the
current version (2.03a)

- -frisk
From: SESTRAUSS@a1.stthomas.edu (Sharon Strauss 5244)
Newsgroups: comp.virus
Subject: Re: Measuring Michelangelo (PC)
Date: 7 Apr 92 17:00:00 GMT

Frisk writes,

>However, in my opinion the real danger is elsewhere - some companies
>distributed Michelangelo-specific detection programs free of charge -
>many people may have received them, found that they did not have
>Michelangleo and belive their machines are "clean"....but in reality
>they may be infected with "Stoned" or any other (common) virus.

This is my experience. Michelangelo generated lots of interest in
virus protection here. Thanks to Frisk's F-Prot, we could easily
afford to give virus checkers to all PC users here. In the few weeks
before March 6 we found plenty of Stoned, Yankee Doodle and Forms
viruses--but no Michelangelo. We even found a number of other critical
problems (no working floppy drive, corrupted DOS programs, general
confusion about PC fundamentals) which we were able to identify and
fix. (Well, I'm sure there is still plenty of confusion about the PC.)

Thanks to the publicity about Michelangelo we raised general awareness
about viruses here--at least for now. However, if people had used
programs which only detect Michelangelo (and some probably did) we
would not have found the real virus and other problems our PC users
face.
From: yates@eff.org (yates)
Newsgroups: comp.virus
Subject: Does anyone know what are companies doing about viruses?
Date: 6 Apr 92 15:57:41 GMT

Hi, I am writing a paper about the virus scare. In particular I would
like to get information on:

1) past trends: a general history of where viruses came from
2) current: who's creating viruses now (a friend told me Bulgaria !)
3) what are corporations doing to protect themselves
4) and finally, what should corporations be doing?

I realize it may be hard to explain, but I am very interested in what
steps companies take to prevent spreading a virus through their
products.

Does anyone have answers to the above questions, or have any
suggestions on where to find answers for them?

I would like to give credit where it is due, so all suggestions unless
accompanied by an anonymity request, will be properly cited to
whomever responds.

Responses can be to me via e-mail (preferred since it will make it
easier for me to track who said what) or through this group.

Thanks very much in advance...

					-Steve Yates
					yates@eff.org
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Heuristic scanner flaws (PC)
Date: 9 Apr 92 07:35:08 GMT

In Message 1 Apr 92 18:44:00 GMT,
  CSCRDW%CURIE@epavax.rtpnc.epa.gov (Ron Whittle) writes:

>>for speed - first determine if a program is "suspicious", then try to
>>identify a specific signature if something is questionable. The text of
>>the message indicates that F-Prot has found "suspicious" behaviour (which
>>it has) that does not match any of the known signatures (which it does not)
>>but has warned the user that it is similar to that used by MBR "droppers"
>>(which it is).

I guess I should clarify this.  My heuristic search does not find
anything suspicious in the programs in question - which is how it
should be - they are not viruses...

The program responsible for creating the message

    Possibly a dropper program for a new variant of Stoned

is my regular scanner.  It picks up one of the "Stoned" signature
strings in the file, but

   ..as it is not a boot sector, the program does not say "Infection"

   ..as it is not a boot sector dump (image) file, it is not identified
     as such.

   therefore my program assumes it is a dropper - intended to place some
   code on the boot sector.  However - it does not contain the
   "Stoned" virus -> therefore "possibly a new variant.

The problem is really that a piece of the code (used to write to the
MBR) is exactly like the code used by Stoned, and it is also the piece
of code I happened to use in my signature.

>  This posting shows that the heuristic analysis is already flawed,
>and most people haven't even implemented it yet.  If you can write a
>program that will overwrite the MBR and F-Prot 2.02d heuristic scanner
>doesn't trip on it, then a virus could use the same code that you are
>using.

No, this is incorrect.  A virus by definition has to replicate itself -
just writing to the MBR or the boot sector is not sufficient.

- -frisk
From: W.BOXALL@qut.edu.au
Newsgroups: comp.virus
Subject: LAN PROTECT by Intel?? (PC)
Date: 8 Apr 92 04:11:00 GMT

Is there a product called LAN PROTECT by Intel??

Any information would be appreciated.

Wayne Boxall
COMPUTER VIRUS INFORMATION GROUP
BRISBANE AUSTRALIA
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Re: home made anti-virus tricks and questions (PC)
Date: 10 Apr 92 23:08:35 GMT

Well, it seems we have the first major test of the FAQ.

[Moderator's note: Just a reminder that the FAQ is available by
anonymous FTP on cert.org (192.88.209.5) in pub/virus-l/FAQ.virus-l]

cosc15yc@rosie.uh.edu (92S10711) writes:
>1.  If I set the attribute of all files on disk to read only,  would
>    that trip any known/popular virus that trying to infect say command.com
>
>        (i. e. dos would say *.com readonly    message alert me to
>       	virus present).

See FAQ D4.

>    	2.  Can virus infect  any file extension or just .com and .exe?

See FAQ E3.

>	3.  Can virus infect( not destroy)  a disk with no .com and .exe
>        files and no bad sector

See FAQ E1.

>	4.  Can virus infect a nonbootable floppy with only .zip file with no
>        bad sector ?

See FAQ E1.

I'd say the FAQ passes with flying colours.

=============
Vancouver                               | Life is
Institute for  Robert_Slade@sfu.ca      | unpredictable:
Research into  rslade@cue.bc.ca         | eat dessert
User           CyberStore Dpac 85301030 | first.
Security       Canada V7K 2G6           |
From: PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics)
Newsgroups: comp.virus
Subject: Re: home made anti-virus tricks and questions (PC)
Date: 10 Apr 92 03:27:00 GMT

cosc15yc@rosie.uh.edu (92S10711) writes:
> 	Please answer these questions for a new computer owner.

Ah ha! Where's a copy of that FAQ?

> 	1.  If I set the attribute of all files on disk to read only,  would
>      that trip any known/popular virus that trying to infect say command.com

It is hardly worth it, most viruses by-pass the attribute protection
one way or another, and you don't get a nice warning anyway. It is a
bit more worthwhile using the DR-DOS password protection system, but
there is no substitute for good virus-proof measures - especially
hardware protection with some sort of loud bell.

>     	2.  Can virus infect  any file extension or just .com and .exe?

Yes, but mostly .com & .exe.

> 	3.  Can virus infect( not destroy)  a disk with no .com and .exe
>         files and no bad sector

Yes. All boot sector infectors, (that accounts for a huge number of
infections) plus a few odd file infectors.

> 	4.  Can virus infect a nonbootable floppy with only .zip file with no
>         bad sector ?

Yes. Ditto. The "nonbootable floppy being safe" myth is quite strong.

>   Did you ever del the command.com in the root directory?   Take 3 weeks
> to find/learn that only dos 3.3 or above can access 40meg partition HD
> when I first buy a computer.

I presume you mean DOS 3.31 or above. That's why it is such a neat
idea to keep a bootable diskette handy, made by the system when it is
known to be free of viruses. Actually, this is *the* reason for using
setting the read-only attribute on the system files - to avoid
accidental deletions.

Bye,
Mark Aitchison, Physics, University of Canterbury, New Zealand.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Mutation Detection (PC)
Date: 13 Apr 92 12:01:10 GMT

0004886415@mcimail.com (Joe Wells) writes:

> However, there are already scanners that will detect Pogue, as well as
> the Mutation Engine. McAfee's scan claims 100 accuracy, Alan Soloman
> (at my last discussion with him) was at 99% on the MTE, Fridrik I know
> is working on it and undoubtedly will be detecting it very soon, and
> our product, Novi 1.1 is currently at about 99.7% on the MTE (current
> misses being failures of the Engine to work properly, detection for
> which I have yet to add).

I haven't tested the other claims yet, but Alan's program has at most
85-90 % detection rate of the MtE-based viruses.

> But polymorphics are not the biggest problem scanner developers face.
> The biggest problem is glut. The constant influx of new viruses to

Right, the real danger is a flood of polymorphic viruses, not a single
one...

> scan for.  Straight string scanners will grow larger and slower as new

Not necessarily slower. At least not noticeably in the near future.
This can be achieved by using more modern search algorithms. Currently
I know about at least four scanners that are using hashing - IBM's
VIRSCAN, Dr. Solomon's Anti-Virus ToolKit, TbScan, and the scanner
that is shipped with the Untouchable.

> Alternate technologies are needed to compliment scanning. One
> discussed much here of late is CRC or Checksum integrity checking.
> This system is reliable, but only as far as the user impliments it
> and, at best only reports infections "after the fact". Relying on
> users to run software doesn't have the defensive level of a TSR

Right, but here comes Fred Cohen's idea about the integrity shells...

> One aspect of a some products (including ours) is incorporating
> unknown detection in the TSR. e.g. When I first received Pogue I ran
> it against the unknown-virus systems in our TSR. We detected it going
> memory resident but didn't interfere since it wasn't a known virus.
> However, when I ran another program and Pogue infected it, the TSR
> announced the infection, restored the victem program, and blew the

Hmm, maybe this was because Pogue was not aware of the technique that
you are using... If you explain it (privately) to me, maybe I'll be
able to point you out its drawbacks... As to the automatic
restoration of the infected program, Pogue is not designed to counter
that. You should try Phoenix.2000 (SCAN calls it V82) instead. See
what it does with the EXE files and tell me the news... :-)

> Actually, since virus-writers have aimed viruses at specific products,

Yep, and while there's no memory protection, any particular TSR-based
protection could be disabled by a virus, if it lets the virus code to
be executed.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: OMICROM virus (PC)
Date: 9 Apr 92 20:08:29 GMT

MANTONIO@PTEARN.BITNET (Antonio Joao Nunes Cardoso) writes:

> A friend of mine asked me to ask this : How to remove the NEW OMICROM
> virus reported by CPAv ?

> He used CPAV to remove it and he couldn't remove that properly.

Step 1. Remove CPAV.
Step 2. Get something more useful.

> Another thing is that someone told him that the OMICROM virus is a
> mutating virus wich can be traced as FRODO or 4096.

First, it's probably Omicron, not Omicrom. Second, it's an alias for
Flip, not fro Frodo. Third, most good removers are able to remove it.
Try F-Prot, Dr. Solomon's Anti-Virus ToolKit, CLEAN 89-B (in that
order). If you don't succeed, contact either Fridrik Skulason (author
of F-Prot) or John McAfee (author of CLEAN).

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54