HDTenEightyP/NetNews huggingface dataset:
From: Kevin_Haney@nihcr31.bitnet
Newsgroups: comp.virus
Subject: OS/2 boot sectors (OS/2)
Date: 24 Aug 92 13:28:11 GMT

Yaron Goland asks
 >My Question is as follows:Does os/2 change the boot sector of
 >drives under it's control? In addition, I understand why my first 1
 >meg, boot manager, partition would have a self booting program in it
 >but why should my D drive have one? Os/2 does NOT boot from D drive
 >and dos boots from C drive! So should there be a self running
 >program on my D drive? I'm very concerned as this sort of activity
 >is standard viral activity. And finally, is there any known virus
 >which targets cmos and clears out sections of it?

Yes, if you have a dual boot machine, the boot sector is changed from
an OS/2 boot sector back to a DOS boot sector when you execute the
BOOT command, and vice versa when you go back to OS/2.  Nothing
abnormal there.  Concerning the detection of a supposedly "self
booting program", I would surmize that the integrity program you use,
like almost all DOS programs, wasn't written to take into account the
fact that it could also be run on an OS/2 machine.  The OS/2 boot
record is different than the DOS boot record, albeit similar in
structure, so this is probably what is producing your message, since
the OS/2 boot program could very well be described as self-booting.

About the possibility of a CMOS virus, as far as I know, the CMOS
memory is not in the address range of 80x86 processors, so a program
usually cannot access this memory directly or change it.  Not to say
that it's impossible, but I have heard of no viruses that target CMOS.
It is far more likely that this problem is the result of a bad battery
or motherboard problem.  The CMOS memory chip itself can also go bad.

Kevin Haney
Internet: khv%nihcr31.bitnet@cu.nih.gov
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: I'm off [to Scotland]...
Date: 27 Aug 92 03:50:06 GMT

I just released a new version of F-PROT (2.05), and now I'm off for
the virus conference in Scotland.  I will be taking my yearly one-week
vacation [no :-) here, unfortunately] right after the conference, and
will not be back until September 13th.

My apologies to those which have sent me E-mail recently that I have
not been able to reply to - I have 400 messages waiting for a reply
and they will probably be around 800 when I get back.

If anybody absolutely has to get in contact with me personally during
this time, just send a fax to +354-1-28801 - my staff will know how to
contact me.

- -frisk
From: lachlan@dmp.csiro.au (Lachlan Cranswick)
Newsgroups: comp.virus
Subject: Re: Need Advice on Evaluating and Ordering Antivirus Software (PC)
Date: 27 Aug 92 03:36:51 GMT

JSIMPSON%MIAMIU.BITNET@OHSTVMA.ACS.OHIO-STATE.EDU (Joe Simpson) writes:

>We evaluated anti-viral software for MS-DOS.

>We used the criteria:
>Cost
>Distribution off campus (the data doesn't stay on campus).
>Frequency and quality of updates (anti-viral programs require
>                                  frequent update)
>General concerns about the nature of the supplier.
>Prophylaxis as well as identification/removal.
>"Ease of Use"
>Co-existance with dos, windows, networks, various apps.

>We ended up liking McAfee's product and Fridrick Skuulassen's product.
>Bought f-prot on the basis of ease of distribution off campus.
>We think we gave up some technical support by making this decision.
>We very much admire McAfee's company and can testify to the support
>they have to offer.

Have you looked at VET which is made my CYBEC in Australia.  Very easy
to install, also has memory resident software including a device
driver that checks every floppy-disk when it is put into the
disk-drive.

Has other utilities also, including saving the CMOS setup to disk just
in case the battery runs out or it is corrupted by a virus.

It is also legetimate to give to give copies to people to install on
their home computers as that is where an infection will usually come
from.

For out site licence, it averaged 10 to 15 Australian Dollars per
on-site computer.

- -- 
  Lachlan Cranswick  -  CSIRO             _--_|\  lachlan@dmp.CSIRO.AU
  Division of Mineral Products           /      \     +61 3 647 0367
  PO Box 124, Port Melbourne 3207        \_.--._/ fax +61 3 646 3223
  AUSTRALIA                                    v
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: Jerusalem virus (CVP)
Date: 19 Aug 92 20:37:08 GMT

>From:    "Olivier M.J. Crepin-Leblond" <ocl@cc.imperial.ac.uk>

>PS. I was indeed surprised when Padgett advanced the theory of
>anti-semitism, which I had never heard of before.  Maybe the ":-)" had
>something to do with it...

Sorry, it was not I, I have no opinion on the naming of the 1813

						Padgett
From: Albert-Lunde@nwu.edu (Albert Lunde)
Newsgroups: comp.virus
Subject: Misunderstanding of polymorphic
Date: 29 Aug 92 13:35:54 GMT

(I know that there was a message saying that no further rumors about
Aliens 4 would be posted.)

I read the intial bulletin and the later follow-up elsewhere, and it
seems fairly likely that no new virus was involved. (False alarms from
old software, multiple infections by common viruses and non-virus
related problems seem like plausable explainations, though one can
never prove absolutely a negative.)

It seems that the originator of the reports is (still) unclear about
how a polymorphic virus will behave.  I am concerned that this
misconception not be spread further.

In my understanding, it is not particularly likely that a polymorphic
virus would trigger scanners in such a way that it would look like two
different existing viruses.

A new polymorphic virus is most likely to "look" to scanners like a
series of unknown viruses (which may well not be detected by scanners
at all on this account).

A polymorphic virus with code derived from an existing virus might at
times look like that virus -- but it is wildly unlikely that it would
resemble two unrelated viruses.

This looks like a canditate for a developing virus "urban myth".
- -- 
    Albert Lunde                      Albert-Lunde@nwu.edu
                                      alunde@nuacvm.bitnet
From: cohen@fitmail.fit.qut.edu.au (Mr Fred Cohen)
Newsgroups: comp.virus
Subject: Unix servers and DOS viruses (PC) (UNIX)
Date: 22 Aug 92 20:01:05 GMT

Well, it's worse than I thought it would be.  Unix experiments through
last night showed that viruses succeeded in infecting files that
didn't have read or write access.  I could even run programs with no
read, write, or execute privileges!  It seems that the Unix networking
allows far more than the access controls permit to the local Unix
user.  Directory protection seemed to work right, but then, I was able
to load and execute files from directories with only Execute
permission - not a good sign.

I got a lot of mail about the last posting.  I don't think I'm a
moron, and if someone can break Novell in 2 days, I don't think the
situation gets better by spending more time.  Novell version 3.11 - I
used the default installation with no 3rd party software - I do know
the difference between file attributes and directory rights, and the
inheritence does indeed work the oposite of the way the manual
describes it.  I am replacing the renowned virus marketing expert John
McAfee at the Vbull conference - first speaker on the first day - I
think.  Full details of the experiments will be published at that
conference, and after we get some more experiments done, I hope to
submit to Computers and Security.  Perhaps some of you should read the
paper before making assumptions and calling me names.  In anticipation
of more questions about Unix, System V3.2 with Sun's PC/NFS on the
PCs.  Default installation - I still don't think I'm a moron - No I
haven't tried setting the file system to Read-Only, I am only looking
at how an average network might be installed by an average
administrator, not at how the world's leading expert on Novell might
do it after spending a year to get it right.  Want to repeat the
experiment?  I think the paper provides adequate documentation to
allow a thorough repetition, and we repeated the test with independent
people watching to make sure we weren't doing something wrong.  By the
way, the peron installing the Novell has done a number of commercial
installations before, and to claim that they know nothing about how to
make Novell safe is confirmation of the fact that it is hard to
understand the way inheritence, rights, and attributes work together,
and that many Novell installations may be unsafe.  I doubt if any
legitimate and knowledgeable people from Novell will disagree with my
findings once they come to the conference and/or read the paper.

	Which brings me to one last point.  I got a lot of complaints,
but only one person wanted to perform similar experiments to confirm
our results.  There is a big risk associated with unconfirmed (or
refuted) results.  I don't believe all I read either, but if I really
want to know, I repeat the experiment or ask for more details.

FC
From: suresh@papaya.iss.nus.sg (Suresh Thennarangam - Research Scholar)
Newsgroups: comp.virus
Subject: Fingerprinting self-modifying files
Date: 28 Aug 92 11:26:12 GMT

Is there general agreement that fingerprinting files with a relaible
method is the most foolproof way of detecting virus infection ?

How would one apply this technique to some programs that modify their
disk-images ?

Does the MS-Windows distribution contain any such binary files that
are self-modifying ?
***************************************************************************
* Suresh Thennarangam               *  EMail: suresh@iss.nus.sg(Internet) *
* Research Scholar                  *         ISSST@NUSVM.BITNET          *
* Institute Of Systems Science      *  Tel:  (065) 772 2588.              *
* National University Of Singapore  *  Facs.: (065) 778 2571          *
* Heng Mui Keng Terrace             *  Telex: ISSNUS RS 39988             *
* Singapore 0511.                   *                                     *
***************************************************************************
From: m91mfr@bellatrix.tdb.uu.se (Mikael Fredriksson)
Newsgroups: comp.virus
Subject: Re: Waldo ?? (PC)
Date: 20 Aug 92 16:23:14 GMT

george@mulgulgum.asis.unimelb.EDU.AU (George Ferenc) writes:
>treeves@magnus.acs.ohio-state.edu (Terry N Reeves) writes:
>> Anyone know of a virus/trojan/joke/ etc that self-identifies as Waldo?
>>  
>> I have not seen it, unfortunately I have only a sketchy report of a
>> message seen periodically on a pc running windows 3.1 & corel draw
>> 2.0.  I ma told a "waldo virus" is identified. Unfortunately I can't
>> even be sure the word virus was in the actual message.
>
>Hi,
>
>This is not a virus. If you are runing an old (i.e. not the latest)
>version of Corel Draw under Windows 3.1, the program will crash when
>you use the 'Blend' function. It worked fine under Windows 3.0.

Yep! And the WALDO-error also pops up if you use Corel 2.0 + win 3.1 +
Norton Desktop (don't ask!) and try to use the extrude function.
Without ND it works alright.

/Micke
- -- 
- -----------------------------------------------------------
email: m91mfr@tdb.uu.se                
smail: Blomdahls vaeg 3, III ;  S - 756 49 Uppsala ; SWEDEN 
voice: +46 18 401481
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: VACSINA Information Wanted (PC)
Date: 1 Sep 92 00:34:03 GMT

[A quick apology to anyone whose mail I haven't replied to - a hard
disk failed one morning.  Backup?  No need - nothing important on
there; only a couple of packages and some files (& mail) off the net.
Even I am not perfect, :-) ]

Garry Scobie, <g.j.scobie@edinburgh.ac.uk>, reports a VACSINA incident:
> Bates Anti-Virus Utilities v3.37
>
> TREE.COM        Found Vacsina - TP05 <1206>
> MEM.EXE         Found Vacsina - TP05 <1206>
>
> F-PROT v2.04
>
> TREE.COM        Infection: Vacsina (TP-5)
> MEM.EXE         Infection: Vacsina (TP-5)
> CHKDSK.EXE      Infection: Vacsina-loader
>
> I am interested in the result of F-PROT indicating CHKDSK. Is this
> file infected - probably but to what extent?

First I should remind/explain that MS-DOS supports two executable file
formats, (omitting batch files from this discussion).  These are known
as 'COM' and 'EXE' formats, often the format used is reflected by the
filename extension, but this is not necessarily the case.

The infection function of Vacsina viruses recognises 'COM' format files
and will infect them when they are found.  Some of the early variants
infect 'EXE' files in two passes, when they are first encountered the
virus modifies them to become 'COM' format files.  So when the file is
encountered on another occasion the infection will be completed.

CHKDSK.EXE is in this state where it has been converted to a 'COM' file,
but the second stage of infection hasn't occurred.

> Is it important that one utility recognised CHKDSK while the other did not?

Yes, 'EXE' files modified in this way may be corrupted and either fail to
work or work incorrectly.  This includes a number of programs that
use overlays or include configuration information in the executable file.
Software that misses these files may leave continuing problems, and resolving
these will be difficult if you believe that the virus has been removed.

Yours,
Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
               --  Oe Noe!  Danny Quale is in the shrubbery!  --
From: rslade@sfu.ca
Newsgroups: comp.virus
Subject: (c) Brain - part 2 (CVP)
Date: 21 Aug 92 17:10:38 GMT

HISVIR7.CVP   920810
 
                        (c) Brain - part 2
 
Who wrote the Brain virus?
 
Well, it's quite simple really.  In one of the most common Brain
versions you will find text, unencrypted, giving the name, address
and telephone number of Brain Computer Services in Pakistan.  The
virus is copyright by "ashar and ashars", so we have two brothers
running a computer store who have written a virus.  Simple, right?
 
(Oh, the danger of simple answers.)
 
First of all, Alan Solomon's analysis and contention that ashar is
older than Brain is quite convincing.  Also, in the *most* common
version of Brain, the address text does not appear.  Further, it
would be a very simple matter to have overlaid the text in the ashar
or Brain programs with the address text.
 
What motive would the owners of Brain Computer Services have for the
writing of a virus?  One story is that they sell pirated software, a
practice that is legal in Pakistan, but not in the United States. 
Therefore, the infected disks were sold to Americans in punishment
for their use of pirated software.  Unconvincing.  The moral
attitude seems quite contorted, Brain would have no reason to
"punish" the United States (its major source of software) and the
Brain infection is not limited to the western world.
 
Another story is that Brain wrote some software of their own, and
were incensed when others pirated *their* software.  Unlikely.
Infected disks would be most likely to be sold by Brain Computer
Services, and this would tend to mean that a customer would be more
likely to get a "clean" copy if it was pirated.  (The hypothesis
that Brain is some kind of copyright device is absurd: the virus
would then be going around "legitimizing" bootleg copies.)
 
Given that Brain is relatively harmless it is possible that the
virus was seen as a form of advertising for the company.  Remember
that this is the earliest known MS-DOS virus, and that the hardened
attitude against viral programs had not yet arisen.  Brain predates
both Lehigh and Jerusalem, but even some time after those two
"destructive" infections viral programs were still seen as possibly
neutral or even beneficial.  In those early, innocent days, it is
not impossible that the author saw a self-reproducing program which
"lost", at most, 3k of disk space as simply a cute gimmick.
 
copyright Robert M. Slade, 1992   HISVIR7.CVP   920810

==============
Vancouver      p1@arkham.wimsey.bc.ca   | You realize, of
Institute for  Robert_Slade@sfu.ca      | course, that these
Research into  rslade@cue.bc.ca         | new facts do not 
User           p1@CyberStore.ca         | coincide with my
Security       Canada V7K 2G6           | preconceived ideas
From: drt@brolga.cc.uq.oz.au (David Taylor)
Newsgroups: comp.virus
Subject: Stoned/Azusa haunting (PC)
Date: 21 Aug 92 04:55:25 GMT

scan a: - 1 virus found [azusa]
clean a: [azusa] - 1 virus removed [azusa]

scan a: - 1 virus found [stoned]
Wow!
clean a: [stoned] - 1 virus removed [stoned]

scan a: - 1 virus found [azusa]
Huh!?!!
clean a: [azusa] - 1 virus removed [azusa]
Hmmm. OK.

scan a: - 1 virus found [stoned]
WHAT!!!!
clean a: [stoned] - 1 virus removed [stoned]

scan a:
1 virus found [azusa]
AAAAAARRRRRRRRRRRRRRRRRRRRRRRRGGGGGGGGGGHHH!!!!!!!!!!!!!!!

format a:
@#%#&@ virii!

Anyone know if these two virii mutate when they're together?

D.T
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: re: V-SIGN virus (PC)
Date: 26 Aug 92 14:30:46 GMT

Originally reported in Turkey, where it's called CANSU, this virus
seems to have reached the U.S. recently.  It's a relatively simple
master-boot-record infector.  Here's what I posted to VIRUS-L last
time someone asked...

The virus is indeed a master boot infector that takes 2K and does a
simple self-modification.  Of the three signatures that you give, only
the first will ever appear in the master boot record, and it will
appear in only about one-third of infections.  The other two
signatures are in the non-boot-sector part of the virus, but they will
be visible in memory if the virus is active in the system.  Here are
three better signatures for the virus; at least one will be found in
every infected MBR, and in memory if the virus is active:

     31C0 8ED0 8ED8 8EC0 48 89C4 30E4 CD13 72FA
     %s the Cansu virus.
     Boot records.  No mutants.
     31C0 8ED8 8EC0 8ED0 48 89C4 30E4 CD13 72FA
     %s the Cansu virus.
     Boot records.  No mutants.
     31C0 8EC0 8ED0 8ED8 48 89C4 30E4 CD13 72FA
     %s the Cansu virus.
     Boot records.  No mutants.

(This is the format that the IBM Virus Scanning Program uses, but it
should be readily convertible.)  If you have the IBM Virus Scanning
Program version 2.2.1 or better, it will detect the virus.  The Cansu
doesn't seem to have any destructive effects; it will sometimes
display a sort of "logo" when booting an infected machine, but this
shouldn't be counted on for detection.

As for disinfection, since it's a normal master-boot-record infector,
you can use FDISK /MBR, or anything else that can fix the master boot
record code without altering the partition table data (see previous
talk in VIRUS-L about this).

DC
From: RZOTTO@NYX.UNI-KONSTANZ.DE (Otto Stolz)
Newsgroups: comp.virus
Subject: Re: new virus found (PC)
Date: 1 Sep 92 08:41:31 GMT

Hello Frisk,

On Sat, 01 Sep 90 23:41:26 -0700 sulistio@sutro.SFSU.EDU (Sulistio
Muljadi) said:
> This is the translated version of an article in an Indonesian
> Computer Magazine, as I noted in a posting of VIRUS-L edition
> Friday, August 31, 1990 about mysterious message. [...]
> No more information I have instead of this one.
>
>                    INDONESIAN VIRUS
>
> * FREDDY
>   Freddy was made by one of a student in a academy of
>   computer in Indonesia.  It infected the program, not a boot
>   sector virus.  The program infected is IBMBIO.COM
>   The characteristic of this virus is the appearance of
>   FREDDY in a box.

Now sapao@dcc.ufmg.br writes:
> A new virus not detected by McAfee's Scan93 nor Virx version 2.3 was
> found in Brazil. F-prot said it's a new variant of jerusalem.

And on 26 Aug 92 15:33:10 +0000 you said:
> Well, it turned out that it is not.  This virus belongs to a separate
> family.  It contains an encrypted text string "Freddy Krg", so I have
> proposed the name "Freddy" for it.

I fear, this name has already been given to another virus (cf. the
above quote from an old VIRUS-L posting). If I'm right, you'd better
choose another name for the new beast, otherwise please tell us which
name the Indonesioan virus has acquired, meanwhile.

Best wishes,
                    Otto Stolz <RZOTTO@DKNKURZ1.Bitnet>
                               <RZOTTO@nyx.uni-konstanz.de>
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Atari ST Anti-viral archive sites last changed 07 July 1992
Date: 1 Sep 92 18:56:11 GMT

Atari ST Anti-viral archive sites	last changed 07 July 1992

atari.archive.umich.edu
        Jeff Weiner <weiner@atari.archive.umich.edu>
        Service via FTP and mail, FTP preferred.
        Login as "anonymous", password is your mail address.
        For instructions on the mail server, send the message
                help
        to <atari@atari.archive.umich.edu>
        "Index" contains complete listing with descriptions.
        "CompInd.Z" contains same list but is compressed.
        "ls-lR.Z" contains compressed ls -lR listing.
        All anti-viral material is contained in ~atari/utilities/virus
        The IP number for this site is 141.211.164.8, but may change.

twitterpater.Eng.Sun.COM
        Steve Grimm <koreth@twitterpater.Eng.Sun.COM>
        Access to the archives is through mail server.
        For instructions on the archiver server, send
                help
        to <archive-server@twitterpater.eng.sun.com>

uk.ac.hensa.micros
        HENSA/micros Managers <hensa@uk.ac.hensa.micros>
        Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
        NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
        FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
        Software archive for UK higher education sector. Anti-Viral stuff
        is not collected into a distinct area. Hostname is in UK format.
        (This site previously known as uk.ac.lancs.pdsoft.)