HDTenEightyP/NetNews huggingface dataset:
From: TO5232@iscsvax.uni.edu
Newsgroups: comp.virus
Subject: Anyone heard about NOVI ?? (PC)
Date: 30 Aug 92 12:39:00 GMT

Has anyone heard read any reviews on the antivirus product NOVI by
Certus?  I am interested in how NOVI compares to CPAV, McAfee's, and
F-PROT.  Whether it has the same or better detection and disinfection
power than the other packages.  I tried to find a review on CERT.ORG,
but there was not any.
From: PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics)
Newsgroups: comp.virus
Subject: Re: On integrity checking (PC)
Date: 31 Aug 92 03:18:19 GMT

tck@netlink.cts.com (Kevin Marcus) writes:
> Hey, Vesselin, all that talk about new products and detecting unknown
> viruses...  Blech.  Wouldn't this fool an integrity checker, if the
> virus were installed to a new system...

I guess an integrity checker could limit the spread and warn of the
presence, but not stop a virus-infected program being put onto the
system.

> Assume a stealth virus, which disinfected on the fly - really flying -
> disinfecting on file opens, reinfecting on a file close, and also on
> findfirst/next calls.  If the virus is unknown to the integrity
> checker, then woulnd't it fake it out if it were in memory at the time
> of the scanning?

If the change detector uses standard DOS calls (or even BIOS) then it
stands to get fooled.  But it doesn't have to. As for an integrity
checker doing its thing as part of the program execute sequence, it is
a good idea to use this in conjunction with other anti-viral
precautions, e.g. ones that check whether important BIOS and DOS
vectors have changed. There is still a way a virus can get around
this, but it is difficult, and requires the virus know about the
particular change detector that is running.  And viruses that go to
such an extent will be obvious to other, elementary, change detectors
(e.g. ones that simply look for changes to particular parts of system
memory).

Mark Aitchison, University of Canterbury.
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: Stoned/Azusa haunting (PC)
Date: 26 Aug 92 12:57:49 GMT

>From:    drt@brolga.cc.uq.oz.au (David Taylor)
>
>Anyone know if these two virii mutate when they're together?

Nyet, comes under the thories of simularity and contagion. Bet the
system will not boot by itself either.

Used to be that we got reports of Joshi/Stoned allatime but then the
PC would still boot since they didn't fight.

What has happened is as follows: The machine was infected by Stoned.
This put the Stoned code in sector 1 and the *real* MBR in sector
seven. Since Stoned is non-stealth it copied a copy of the partition
table into itself. Then the machine was infected by Azusa which moved
the Stoned code into *another sector but not 7* (I forget which) and
itself into sector 1 also copying the P-Table into itself.

Now when a boot occured, the Azusa ran & went resident at the TOM. It
then loaded the Stoned which, being obliging went resident itself just
under the Azusa. Then it loaded the *real* MBR and booted.

Next, the Stoned resident portion looked at sector one and observed
that it was *not Stoned* and reinfected, moving the Azusa MBR into
sector seven. At this point we have Stoned in sectors 1 & *some other
sector* , Azusa in sector 7, and the *real* MBR is just a memory.

The machine now refuses to boot except from floppy and the user
notices *something* amiss. (Viruses and Trojans, and Worms - Oh My !)

SCAN is exectuted from floppy. Even if the /M is used, nothing will be
detected since neither of these viruses (original flavour) survives a
re-boot.

SCAN runs & finds whichever infected last in the MBR (say Azusa).
CLEAN comes along and cleans [AZUSA] by retrieving the sector AZUSA
stores the *real* MBR in except that this contains not the *real* MBR
but Stoned.

SCAN now reports [STONED]. CLEAN having the [STONED] reported verifies
that it is in sector 1 and replaces sector 7 into sector 1. Except 7
contains not the *real* MBR but AZUSA.

SCAN now reports AZUSA. etc etc etc. You get the idea.

Answer: Well, you could use my FixMBR, select *any* sector with a
valid p-table and let it install the *Safe* code, or you could just
use DOS 5.0 FDISK /MBR Either will work.

						Breezily,

							Padgett
From: ocl@cc.imperial.ac.uk (Olivier M.J. Crepin-Leblond)
Newsgroups: comp.virus
Subject: Re: Jerusalem virus (CVP)
Date: 20 Aug 92 10:22:39 GMT

Earlier, I wrote: 

>PS. I was indeed surprised when Padgett advanced the theory of
>anti-semitism, which I had never heard of before.  Maybe the ":-)" had
>something to do with it...

Oops, Rob Slade, not Padgett. Apologies, I've been overworked lately.

- -- 
Olivier M.J. Crepin-Leblond, Digital Comms. Section, Elec. Eng. Department
 Imperial College of Science, Technology and Medicine, London SW7 2BT, UK
      Internet/Bitnet: <ocl@cc.ic.ac.uk> - Janet: <ocl@uk.ac.ic.cc>
From: dana%are.Berkeley.EDU@ucbvax.Berkeley.EDU (Dana E. Keil)
Newsgroups: comp.virus
Subject: F-PROT reports Bugsres 3 Jokes program? (PC)
Date: 3 Sep 92 02:34:40 GMT

I just obtained F-PROT. Running a scan with it reports that a file
named bugres.com is infected with a virus named "bugsres 3 jokes
program". I can find no mention of this virus anywhere in F-PROT
documentation (nor elsewhere). Can anyone enlighten me about it?

- -- 
Dana E. Keil           Department of Agricultural and Resource Economics
dana@are.Berkeley.EDU                 University of California, Berkeley
From: cmontoya%carina.unm.edu@lynx.unm.edu (Red Dragon)
Newsgroups: comp.virus
Subject: Bugs on my Atari (Atari)
Date: 1 Sep 92 19:45:23 GMT

I know I'm the not the only person with an old Atari.  I just had a
bunch of bugs appear on my screen and eat up the screen and trash my
disk.  Help please.  I was just going to help a friend with an Amiga
virus and this happens!  BTW, can PC viruses infect my Atari?  I was
using a DOS disk when this happened.
/cm
cmontoya@carina.unm.edu
From: cmontoya%carina.unm.edu@lynx.unm.edu (Red Dragon)
Newsgroups: comp.virus
Subject: Amiga virus info (Amiga)
Date: 1 Sep 92 18:59:26 GMT

Where can I get Amiga virus information?
/cm
cmontoya@carina.unm.edu
From: JFORD@UA1VM.UA.EDU (James Ford)
Newsgroups: comp.virus
Subject: New files on risc (PC)
Date: 30 Aug 92 18:01:28 GMT

The following files have been placed on risc.ua.edu (130.160.4.7) in the
directory /pub/ibm-antivirus for anonymous FTP:

                  fp-205.zip   - FProt v2.05
                  vsumx208.zip - Virus Summary Listing.

It is time for the once-in-a-blue-moon checking of files on
risc.ua.edu.  Please send email to jford@risc.ua.edu if any of these
files are out of date or just should not be there.  Thanks.

- -- jf

P.S.  I have removed htscan17.zip already.................
- ------------------------------------------------------------------------
               cvcindex.zip   navupd01.zip   vaccinea.zip   virx23.zip
0files.9209    dir2clr.zip    netsc95b.zip   validat3.zip   vkill10.zip
aavirus.zip    fixfbr11.zip   pcv4.zip       validate.crc   vshell10.zip
asig9207.zip   fixmbr24.zip   pkz110eu.exe   vc300ega.zip   vshld95c.zip
avs_e224.zip   fixutil3.zip   scanv95b.zip   vc300lte.zip   vsig9207.zip
bbug.zip       fp-205.zip     secur235.zip   vcheck11.zip   vstop54.zip
bootid.zip     fshld15.zip    sentry02.zip   vcopy82.zip    vsumx208.zip
catchmte.zip   fsp_183.zip    stealth.zip    vdetect.zip    vtac48.zip
ccc91.zip      htscan17.zip   tbresc19.zip   vds20t.zip     vtec30a.zip
chk.zip        htscan18.zip   tbscan41.zip   virlab15.zip   wcv201.zip
chkint.zip     i-m123.zip     tbscnx31.zip   virpres.zip    wolfchk.zip
clean95c.zip   i-msetup.bat   trapdisk.zip   virsimul.zip   wp-hdisk.zip
cpavse.zip     innoc5.zip     unvir902.zip   virstop.zip    wscan95b.zip
cvc792am.zip   killmonk.zip   uxencode.pas   virus-l.faq    ztec61b.zip
cvc792ma.zip   m-disk.zip     vacbrain.zip   virusck.zip
cvc792ms.zip   mteavr22.zip   vaccine.zip    virusgrd.zip
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Introduction to the Anti-viral archives listing of 01 September 1992
Date: 1 Sep 92 18:53:37 GMT

Introduction to the Anti-viral archives	listing of 01 September 1992

This posting is the introduction to the "official" anti-viral archives
of VIRUS-L/comp.virus.  With the generous cooperation of many sites
throughout the world, we are attempting to make available to all
the most recent news and programs for dealing with the virus problem.
Currently we have sites for Amiga, Apple II, Atari ST, IBMPC, Macintosh
and Unix computers, as well as sites carrying research papers and
reports of general interest.  Updates to these lists are made exclusively
by contributions provided by the readers of this group.  My thanks go
out to the many people who keep this information current.

If you have general questions regarding the archives, you can send
them to this list or to me.  I'll do my best to help.  If you have a
submission for the archives, you can send it to me or to one of the
persons in charge of the relevant sites.

If you have any corrections to the lists, please let me know.

The files contained on the participating archive sites are provided freely
on an as-is basis.

To the best of our knowledge, all files contained in the archives are either
Public Domain, Freely Redistributable, or Shareware.  If you know of one
that is not, please drop us a line and let us know.  Reports of corrupt
files are also welcome.

PLEASE NOTE
The Managers of these systems, and the Maintainers of the archives, CAN NOT
and DO NOT guarantee any of these applications for any purpose.  All possible
precautions have been taken to assure you of a safe repository of useful
tools.

Jim Wright
Canada-France-Hawaii Telescope Corporation
jwright@cfht.hawaii.edu
JWRIGHT@UHCFHT
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Products for review - shipping
Date: 26 Aug 92 19:54:32 GMT

I have just completed a major mailing requesting submission of
antiviral products for review.  I have sent this mailing to all those
for whom I have valid addresses, based upon the CONTACT.LST.  If any
of you have not received a mailing from me, please consider this to be
the request, as well as sending me your address and contact info.

I have, in the past few days, started to receive some of the products
for review.  Unfortunately, most have been very badly prepared for
shipping and customs.  As I have no funding for the product reviews, I
am unable to receive packages which arrive COD, postage or customs
due.

Some tips:

Wherever possible, have a Canadian office or distributor forward the
package, thus eliminating the whole problem.

Don't use UPS.  In two years I have never received an evaluation
package shipped via them without major problems.

Prepare the packages properly regarding customs documentation.  As the
packages, after review, will be used in seminars, they may be declared
as educational material.  However, please remember also to note that
the package is an evaluation copy, and has no resale value.  for
purposes of the GST, please declare the "service value" at under $25.
Alternately, please prepay the duty and taxes.

As a side note, I had hoped, with this round of reviews, to include
some book reviews as well.  Unfortunately, the response from
publishers has been very disappointing so far.
 
==============
Vancouver      ROBERTS@decus.ca         | "Don't buy a
Institute for  Robert_Slade@sfu.ca      |     computer."
Research into  rslade@cue.bc.ca         | Jeff Richards'
User           p1@CyberStore.ca         | First Law of
Security       Canada V7K 2G6           | Data Security
From: kw3@prism.gatech.edu
Newsgroups: comp.virus
Subject: Re: 4096 (frodo) false alarm? (PC)
Date: 24 Aug 92 20:57:45 GMT

In VIRUS-L Digest V5 #140 nyh@gauss.technion.ac.il,  Nadav Har'El writes.

stuff deleted ---

>didn't help.  Does anyone know of a program to clear every unused
>portion of the disk (i.e.  parts of sectors after eof, and totally
>unused sectors)?

stuff deleted ----

Yes. There is a real handy public domain utility called Prune v2.1.
Prune will clear the unused space in a cluster after EOF and all
unused clusters.  It will also do subdirectories and allows a user
definable fill pattern.  The program is available from the authors on
their BBS.

Sydex BBS
Eugene, Oregon
USA
503-683-1385

Keith R. Watson
Georgia Institute of Technology, Atlanta Georgia, 30332
uucp:  ...!{decvax,hplabs,ncar,purdue,rutgers}!gatech!prism!kw3
Internet: kw3@prism.gatech.edu
From: HAYES@urvax.urich.edu
Newsgroups: comp.virus
Subject: McAfee's 95 series (PC)
Date: 26 Aug 92 15:17:41 GMT

Hi fellows.

In reply to my query about the authenticity of McAfee Associates "95"
serie of programs i got a message from a Belgian user who mentionned
that the files were on the GARBO server.  It seemed to me that US
programs should also been made available from a US site <grin>, so I
fetched the files which are now available from us too.

- -----
files:	CLEAN95C.ZIP	NETSCN95B.ZIP	SCANV95B.ZIP	VSHLD95C.ZIP
- -----
Site:       urvax.urich.edu,  [141.166.1.6]    (VAX/VMS using Multinet)
Directory:  [anonymous.msdos.antivirus]

FTP to urvax.urich.edu with username anonymous and your email address
as password.  You are in the [anonymous] directory when you connect.
cd msdos.antivirus, and remember to use binary mode for the zip files.

- -----
PLEASE!!!  Do not overload our small site and start FTP'ing after 21:00 Eastern
time.

Best to all, Claude.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Claude Bersano-Hayes     HAYES @ URVAX                 (Vanilla BITNET)
University of Richmond   hayes@urvax.urich.edu     (Bitnet or Internet)
Richmond, VA  23173
From: alawrenc@sobeco.com (a.lawrence)
Newsgroups: comp.virus
Subject: Re: help, high weirdness (PC)
Date: 27 Aug 92 06:14:24 GMT

leveret@warren.demon.co.uk (Nick Leverton) writes:

>hurd@sfu.ca (Peter L. Hurd) writes:

>>2)  Keyboard spaceyness, it gets to thinking that the shift is down, so
>>even numbers show up as @#$%^, and the alt ,and ctrl keys don't quite
>>do what I expect them to (usually happens in WP5.1)

>This is a known problem with some BIOSes. There is a set of programs
>Out There Somewhere (tm) which fix it. I came across them under the
>name INT099FI.ZIP, so look for that name wherever you usually get your
>shareware and PD software.

I have had this problem as well.  It appeared when I used a
replacement keyboard while my orginal was beening fixed.  I have a
solution in the form of a DEBUG script retrieved from FIDOnet.  The
text with the solution attributes it to Microsoft.  If anyone wishes
it, I can post it to the appropriate group.  (alt.sources.misc ??).

Please e-mail any requests.
- -- 
On a clear disk you can seek forever.
- -------------------------------------------------------------------------
Andrew Lawrence, Informaticien Conseil           |  alawrenc@sobeco.com
3605 St-Urbain, #1605                            |  uunet!sobeco!alawrenc
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: Symantec announces NAVSCAN (freeware) (PC)
Date: 26 Aug 92 00:04:55 GMT

Symantec has made available as freeware, a detect/delete only version
of NAV.  This program is made available through BBSes throughout the
world.  We encourage people to try the program.  The user interface of
NAVSCAN and NAV is similar throughout the Peter Norton line of
products.

NAVSCAN is a detection only version of NAV incorporating the August 1
update definitions set.  (Files detected by NAVSCAN can be deleted
from within NAVSCAN.)  The August definitions set has also been sent
to each of the BBSes so that full function NAV users can download and
update their programs from a variety of BBSes.  (You can also bug your
sysop to start carrying each new month's update on that BBS.)
Information on how to purchase the full function The Norton AntiVirus
product is available in the NAVSCAN program.

Jimmy Kuo                                       cjkuo@ccmail.norton.com
Norton AntiVirus Research
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: re: On integrity checking (PC)
Date: 26 Aug 92 14:36:16 GMT

tck@netlink.cts.com (Kevin Marcus) asks whether a disinfect-on-the-fly
virus wouldn't escape notice from an integrity checker if it was
active while the checker was running.  Yes and no!  The same applies
for any other stealth technique; it will fool an integrity checker
*if* it is active when the checker is running *and* the checker
doesn't defeat the particular kind of stealth.  The various integrity
checkers that don't require a cold trusted boot before running all
incorporate some sort of anti-stealth hacks to prevent the most common
kinds of stealthing.  The kind you mention would be reasonably easy to
detect (an open-for-read shouldn't cause a write!).

There is of course much room for an arms race here, with viruses being
written to escape detection by existing anti-stealth methods,
anti-virus programs getting cleverer anti-stealth, and so on.  I'd
advise Ken not to let the discussion of possible methods get too
detailed here in public!  *8)

A cold trusted boot is still the best idea; that's what I use...

DC
From: jaflrn!jaf@uunet.UU.NET (Jon Freivald)
Newsgroups: comp.virus
Subject: Mail-server software updates
Date: 1 Sep 92 02:59:17 GMT

The following software has been added to the mail-server at
jaflrn.UUCP.  To get UUEncoded copies via E-mail, send a message to
mail-server@jaflrn.UUCP containing a line "get dos/virus/filename" for
each of the files you want sent.  If you have problems, please send
mail to jaf@jaflrn.uucp.

New files:

SCAN95B.ZIP     145022   23-Aug-92 McAfee ViruScan V95B
CLEAN95C.ZIP    153633   23-Aug-92 McAfee Clean-Up V95C
VSHLD95C.ZIP    120216   23-Aug-92 McAfee VShield V95C
NETSC95B.ZIP    135263   23-Aug-92 McAfee NetScan V95B
WSCAN95B.ZIP    195605   23-Aug-92 McAfee Windows shell for ViruScan V95B
NETSHLD.ZIP     104838   23-Aug-92 McAfee NLM virus scanner

(The McAfee files above were downloaded from the McAfee BBS by me
personally.  The following files were obtained from Compu$erve.)

FPR204.ZIP      267838   26-Aug-92 Fridrick Skulason's F-Prot virus scanner
I-MAST.EXE      282383   26-Aug-92 Integrigy Master 1.23a

=============================================================================
		   Jon Freivald ( jaflrn!jaf@uunet.UU.NET )
	 Nothing is impossible for the man who doesn't have to do it.
=============================================================================
From: rslade@cue.bc.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Brandau virus followup - four years later (Mac)
Date: 22 Aug 92 00:18:00 GMT

Canadian content time.  This just passed to me from a news type off the 
AP "Wire" (I suspect he got it off Compuserve):
                             
Online Today
 
CANADIAN CHARGED WITH PLANTING ALDUS COMPUTER VIRUS 
 
  (Aug. 20) 
  Former Canadian computer magazine publisher Richard Brandow, 28,
has been accused of planting a computer virus that tainted thousands
of copies of Aldus Corp. software in 1988. 
  According to The Associated Press, Brandow, who now writes for
"Star Trek," has been charged by prosecutors in King County,
Washington with malicious mischief and could face up to 10 years in
on if he is convicted. 
  Brandow said he finds the charges surprising. "What are they going
to do?" he asked, "It happened four years ago, and I am here in
Montreal." 
  He told AP that he arranged for a message to flash briefly on
computer screens that wished peace "to all Macintosh users around the
s were designed to educate the public
to the danger of viruses. Brandow included his name in the message so
he could be contacted. 
  The virus made its way eventually to Aldus where it infected a
master disk for producing copies of Freehand, an illustration
program. After the virus was discovered, Aldus recalled 5,000 copies
of Freehand and replaced another 5,000 copies it had in its
inventory. The incident cost the firm $7,000. 
  Ivan Orton, King County senior deputy prosecuting attorney, told AP
it was the first time the state has brought such criminal charges. He
also said he believes the incident was the first time a virus had
tainted commercial software. 
  For more news from The Associated Press, consult the Executive News
(GO APONLINE). 
  --Cathryn Conroy 
 
 
I think they got his name wrong.
 
==============
Vancouver      ROBERTS@decus.ca         | "Is it plugged in?"
Institute for  Robert_Slade@sfu.ca      | "I can't see."
Research into  rslade@cue.bc.ca         | "Why not?"
User           p1@CyberStore.ca         | "The power's off
Security       Canada V7K 2G6           |  here."
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Anyone for a Feist ??? (PC)
Date: 26 Aug 92 15:43:06 GMT

ISB202REID@redgum.qut.edu.au (Did somebody say Coffee ??????) writes:

>A few days ago I came across a machine absolutely
>covered by the feist virus..

Hm - strange.  As fas as I know, Feist is unknown outside Russia. 

>Clean 93 wouldn't remove it, although it was in F-Prot 2.04a's
>database, wouldn't even recoginise it !!

In that case there are two possibilities:

	1) This is a false alarm - F-PROT detects Feist without problems,
	   I just checked.

	2) This is a new virus, that (whatever other program you used)
	   just happens to mis-identify as Feist.  In this case I would
	   need a sample of it to update F-PROT.

However, It might also be interesting to see what other scanners report, or
what F-PROT's Quick and Heuristic scan report.

- -frisk
From: tck@netlink.cts.com (Kevin Marcus)
Newsgroups: comp.virus
Subject: On integrity checking (PC)
Date: 23 Aug 92 05:07:22 GMT

Hey, Vesselin, all that talk about knew products and detecting unknown
viruses...  Blech.  Wouldn't this fool an integrity checker, if the
virus were installed to a new system.  Maybe install a bad term, makes
it sound intentional.  If the system were infected...:
 
Assume a stealth virus, which disinfected on the fly - really flying -
disinfecting on file opens, reinfecting on a file close, and also on
findfirst/next calls.  If the virus is unknown to the integrity
checker, then woulnd't it fake it out if it were in memory at the time
of the scanning?
 
Making a multi-partite infector could have some other interesting
options,0as well thrown in, and make inital infection much easier if
the integrity checker had a memory resident part notifying you of a
change to a file...
 
Or is there something I am missing?
- --                    
INTERNET:  tck@netlink.cts.com (Kevin Marcus)
UUCP:   ...!ryptyde!netlink!tck
NetLink Online Communications * Public Access in San Diego, CA (619) 453-1115