HDTenEightyP/NetNews huggingface dataset:
From: ttan@cse.unl.edu (Teik Tan)
Newsgroups: comp.virus
Subject: Re: GIF viewer crashes system (was Re: an amazing problem...) (PC)
Date: 29 Jul 92 06:44:14 GMT

>>>yesterday i downloaded a piece of software called NakedEye -- a p.d. gif 
>>>viewer -- when i tried to run it, the screen blanked and the system crashed,
 
>>>but when i rebooted i got an error "drive c write protected" -- i am using 
>>>dos 5.0 and as far as i know (and as far as my manual says) you cannot write
 
>>>protect a drive. although i am also running stacker and 4dos. 4dos does not 
>>>have a write protect command. does stacker? how did this happen? i am having
 
>>>a hell of a time running applications now because of this persistant error. 
>>>any help would be greatly appreciated....
>>
>>Do you have a virus scan program??? Really sounds to me like you got infected.
>>Better get a scan/clean prog. and clean it up.  Most stuff can be fixed and 
>>saved if it hasn't destroyed everything.

I have come across such a problem.  At the beginning I thought it must
be a virus.  But further thought leads me to think that there is no
way that a hard disk could be write-protected, unless someone
physically rewire the hard disk.

Now, here is what I did:

1.  Boot from a clean floppy disk (do not run stacker).
2.  Change drive to the original hard disk where stacker is located.
    (ie: change to drive where STACKVOL.DSK is located)
3.  Use DOS ATTRIB to clear the read-only attrib of STACKVOL.DSK
4.  Cold boot (or reset) your system and try to start the stacker drive.

If you follow the procedure above, your system should run properly.
If it still doesn't run, then maybe it is a problem other than I have
encountered.  If it does run, then it is most probably due to the
stacker drive problem.  Normally, stacker alone gives no problem.  But
if it is run together with some caching program (like NCACHE, as was
in my case), the problem would arise since both NCACHE and STACKER
would try to write at the same time, thus "confusing" the computer.  I
don't know much about 4DOS, but I suspect more or less the same thing
happen to your system.

Hope this helps.  

Teik Leong Tan
ttan@cse.unl.edu
(Normal Disclaimer)
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: re: VET as good as Viruscan? (PC)
Date: 22 Jul 92 00:17:34 GMT

David H. Ivens (D.Ivens@deakin.OZ.AU) asks:
> I have evaluated VET anti-virus software (Australia) and it seems a very
> good alternative to the expensive Viruscan.
>
> Has anyone had problems with this software?
>
> We do not get a lot of viruses and are considering a site licence for VET.

I haven't used VET, but I have talked to Roger Riordan (the author) at
a couple of conferences and he certainly knows his stuff, both on
viruses loose on Australia and effective techniques for anti-virus
software.  Better still for you he is also in Victoria and will
provide good quality and timely support, two things which you may have
problems with for Viruscan (esp being so far from LA).

Oh, while I am being rude about McAfee, any suggestions as to what
will happen to Viruscan if the "big one" hits LA?

Regards, Anthony Naggs

Internet:  amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
Janet:     amn@uk.ac.brighton.vms  (  cbs%uk.ac.brighton.vms::amn  )
    or     xa329@uk.ac.city        (  cbs%uk.ac.city::xa329        )
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: re: a report on a viral infection (PC)
Date: 22 Jul 92 00:16:51 GMT

felscher@maplog.informatik.uni-tuebingen.de reports a lingering
Cascade/1701 infection.  The description of the problem indicates that
McAfee's VIRUSCAN software may have failed to disinfect files.

I suggest you try Skulason's FPROT (from SIMTEL20 or images) which may
give you a greater degree of assurance.  It also examines some common
compressed executables for viruses present before the compression
(LZEXE, PKLITE, etc).

Regards, Anthony Naggs

Internet:  amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
Janet:     amn@uk.ac.brighton.vms  (  cbs%uk.ac.brighton.vms::amn  )
    or     xa329@uk.ac.city        (  cbs%uk.ac.city::xa329        )
From: OB77665@IBMH1.ORL.MMC.COM
Newsgroups: comp.virus
Subject: Info on Intel's NLM? (PC)
Date: 28 Jul 92 12:50:41 GMT

In the next several weeks we will be looking at INTEL's NLM for our
servers. I've heard that it is a border line product, but no
specifics. I would appreciate any information that any one would have
on this product.

                Thanks Bruce
From: martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences)
Newsgroups: comp.virus
Subject: WARNING - Virus Creation Laboratory (PC)
Date: 20 Jul 92 09:11:55 GMT

I have acquired a rather disturbing new software package, that is
apparently available from some of the virus BBSes.  It is called the
"Virus Creation Laboratory" v 1.00, (c) 1992 Nowhere Man and [NuKE]
WaReZ.  The package includes the V.C.L. itself, a development
environment written in Borland C++ and styled after the Borland
Integrated Development Environment, MS-Windows .ico and .pif files,
surprisingly well written documentation, and eight example viruses and
trojans.

The VCL makes virus writing a matter of picking options from pull-down
menus.  Infection type, encryption, etc., can be selected, and a large
range of nasty effects and conditions can also be selected.  The
package will create MASM-compatible assembler code, and if an
assembler is available will optionally create an executable .com file.
The package can make *.com infecting viruses, companion viruses,
trojans, and time-bomb object files for linking into software
projects.

The disturbing thing is that with this package any beginning DOS user
can create working viruses.  This kind of a virus development package
was predicted by Vesselin and others some months ago, when the MtE
first showed up.  In fact it isn't the first attempt at such a
package, I gather (from the documentation), but it is (to my
knowledge) the most "user-friendly".

Fortunately the viruses created by VCL v1.00 are pretty simple
viruses.  The package cannot create viruses that stay in memory, and
cannot create *.exe infectors.  The encryption options are rather
simple, not nearly as complex as the MtE encryption routines.
Unfortunately Nowhere Man hopes to improve future releases of the
software, adding *.exe infecting abilities, better encryption, and TSR
ability.

Of the eight demo viruses included in the package, F-PROT 2.04
suspects three of being variants of Vienna.  Using the heuristics
option, F-PROT identifies 7 of the 8 as being suspect.  Scan v93
doesn't identify any of the programs as viruses.

I suspect it will not be hard for the writers of scanners to find
search strings and algorithms to identify all viruses made by VCL.  It
took about 10 minutes, with DEBUG, using carefully chosen
"unassemble", "go", "trace" and "search" commands, to find the ascii
code for all the assembler code output the VCL uses.

It is interesting to note that Nowhere Man has the gaul to expressly
forbid any disassembly of his code, or the use of any binary strings
produced by his program for the purposes of scanning for viruses
created by the package.  Yah, right, Nowhere Man.  Go ahead, sue me.

Tim

 -------------------------------------------------------------
  Tim Martin                   *
  Spatial Information Systems  *   These opinions are my own:
  University of Alberta        *      My employer has none!
  martin@cs.ualberta.ca        *
 -------------------------------------------------------------
From: fran_holtsberry@macgate.csuchico.edu (Fran Holtsberry)
Newsgroups: comp.virus
Subject: Disinfectant 2.9 problems (Mac)
Date: 28 Jul 92 08:02:39 GMT

Since we began installing Disinfectant 2.9 on campus machines, we have
had a rash of System errors. We have lock-ups, inits not loading,
errors when attempting to access Apple Menu selections. . ..

Anyone else experiencing this type problem? was there a warning with
it that I didn't read?

We are sending out a campus warning about Disinfectant 2.9 until I
hear from some of you.

Fran Holtsberry
Fran_holtsberry@macgate.csuchico.edu
From: brunnstein@rz.informatik.uni-hamburg.dbp.de
Newsgroups: comp.virus
Subject: Computer Virus Catalog update
Date: 24 Jul 92 19:05:00 GMT

Computer Virus Catalog summer update available from VTC Hamburg:
          FTP site:  ftp.informatik.uni-hamburg.de
          Adress:    134.100.4.42
          Login:     anonymous
          Password:  your_name
          Directory: pub/virus/texts/catalog
                      (other entries contain info on virus documents,
                       the CARO naming scheme, and info on CCC).

The following new files (in ASCII, will be zipped later) are available:
       Index.792    (26 kB): Survey of all 243 classified viruses/
                             trojans and strains.
       AmigaVir.792 (17 kB): Survey of all  64 classified AmigaVirs;
                            +Incognito,Traveller,2001.
       MacVir.792   (27 kB): Survey of all  34 classified MacVirs;
                            +CODE252,INIT1984,MBDF-A,T4-A,T4-B.
       MsDosVir.792 (88 kB): Survey of all 124 classified MsDosVirs;
                            +Akuku,Amoeba,Anthrax,Armagedon,BFD,
                             Groove,Hafenstrasse-2/-3,Halloween,Joshi,
                             Leningrad-543,Mummy 1.2,P-Check,Peach,
                             Seventh Son,SillyWilly Trojan/Virus,
                             VCS 1.0 Manta,VCS 1.1a,VCS 1.3 RUF,
                             XPEH-4016=CHREN-4016.

If you have no ftp access, please cntact the author or Vesselin Bontchev
who will send the requested files (both on travel until mid-August).

With next CVC edition, a machine readable version will be available,
for direct retrieval, based on dBase III. To assist in retrieval, a
Clipper program will be downloadable (free-of-charge) from the server.
Generally, any critical and constructive remarks will be welcomed.

CVC editors: Klaus Brunnstein + Vesselin Bontchev,
             Virus Test Center, University Hamburg, Germany
             (July 24, 1992)
From: schiffman@wilma.wharton.upenn.edu
Newsgroups: comp.virus
Subject: Stoned and Michaelangelo (PC)
Date: 28 Jul 92 06:43:33 GMT

Hello All,

	I had two odd infection occur in my office in the last 2 days.
Two computers both appeared to have Michaelangelo when run through
Vi-Spy, but appeared to have Stoned when run through SCAN. Niether
detector took notice of both. Any idea or similar experience ?

				
					- J. Schiffman  
					  The Wharton School
					  Univ. of Pennsylvania
					  Phila., Pa
					   Schiffman@Wharton.upenn.edu
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: F-PROT, Telecom, false positive ?? (PC)
Date: 28 Jul 92 09:07:26 GMT

RXB%FDACFSAN.BITNET@VTVM2.CC.VT.EDU writes:

>Situation - After receiving ftp'd *.zip files, I downloaded them
>from my mainframe VM session to my PC using Attachmate's Extra for
>Windows 3.22, under Windows 3.1. Then I ended my mainframe session and
>exited Windows. After unzipping the files onto a floppy, I scanned them
>using SCANv93, then Central Point Antivirus 1.2, and then F-PROT 204a.
>Central Point's VSAFE is loaded into memory as a tsr, the others are
>not. F-PROT gave a message indicating that the Telecom virus
>search pattern was found in memory

This is CPAVs fault - they leave the signature in memory.  No other
major anti-virus producer has a similar compatibility problem with the
rest of the industry In fact, even the CPAV manual says you should not
use other anti-virus programs with CPAV. The reason is simple - they
are responsible for too many false alarms.  As it is generally a good
idea to use multiple scanners, the solution is quite simple - don't
use CPAV....combine a few other scanners - they all work

Of course anybody is free to use CPAV, but if you do, please don't use
any other scanner (including my own) on the same machine - you will
get problems.

>Is F-PROT the only one of the 3 that can scan *.zip files, not yet
>unzipped?

Uh - F-PROT can *not* scan .ZIP files....It can scan compresseded
executables (PKLITE/DIET/ICE/LZEXE/EXEPACK), but not archives....

- -frisk
From: sempson@healthy.uwaterloo.ca (Stephen Sempson)
Newsgroups: comp.virus
Subject: Re: GIF viewer crashes system (PC)
Date: 28 Jul 92 17:42:33 GMT

>t7@elan.glassboro.edu (TEMP_7) writes:
>
>>i am in desperate need of help. ...

There are a number of possibilities. I found out that 'STACKER' does
have some drivers in memory to control reading and writing to the
disk.  (Obviously, check out the 'Config.sys').
 
The trick here is that you must edit your config.sys file to stop the
'/Swap' option. Rem the whole line out. Also take off the check disk
integrity option.

Reboot from here. The next step is to use 'scheck' which will flag you
if a problem is found to use NDD or 'chkdsk /f' to correct the
problems.  At this point you must 'Unmount' the stacked disk.  Then
take off all of the file attributes to this file. It is probably
Stackdsk.vol (Dosshell will even do this).  Now you must remount the
'Stacked Disk'.
 
>From here you will now have the write access to the Stack Volume Disk.
Use 'Chkdsk /f' or 'NDD d: /complete'.
 
Finally set your config.sys to its original setup and reboot.
 
The long and the short... It ends up being a file allocation and lost
clusters found scenario, which is compounded by the fact that you need
to have 'Stacker' up and running, but limited from it's usual boot-up
configuration.
 
Hope this is useful if no virus is found...
 
 ---===---===---===---===---===---===---===---===---===---===---===---===---===
 =========)_____._____                     From: Stephen Sempson
        \  / /  -                                <sempson@healthy.UWaterloo.ca>
        ====={                                   University of Waterloo, Canada
 ===---===---===---===---===---===---===---===---===---===---===---===---===---
From: txl@dbs42.elsegundoca.ncr.com
Newsgroups: comp.virus
Subject: re: virus hiding printer (PC)
Date: 29 Jul 92 15:25:18 GMT

Thanks for the responses to my question a few days ago regarding a
virus capable of altering some data bits to hide the printer and the
changing of floppies to my computer.

Alas, a virus named 'Azusa' was found with the software from McAfe
(I'm sorry if I misspell the name here).  This virus lived in the
partition table of my hard disk and in the boot sector of my floppies.
After cleaning the virus, my system is back to normal.

Thanks again for your responses.
- -Tuan
From: g89r4255@hippo.ru.ac.za (Lt Sajid Rahim)
Newsgroups: comp.virus
Subject: Strange Identification with SCAN91 (PC)
Date: 24 Jul 92 07:27:23 GMT

I find it very strange to see that SCAN identifies Saturday the
14th virus as Armagedom. Having disassemble the code for both
viruses, I find no particular relationship between the two.

Anybody care to comment.

Sincerely

Sajid

- ---------------------------------------------------------------------
- --   Sajid Rahim, Dept of Computer Science, Rhodes University,     --
- --   Grahamstown, South Africa. Internet : g89r4255@hippo.ru.ac.za --
- ---------------------------------------------------------------------
From: avg@rodan.UU.NET (Vadim Antonov)
Newsgroups: comp.programming
Subject: Re: finding 1st one in integer
Date: 21 Jul 1992 21:59:04 -0400
Organization: Berkeley Software Design
NNTP-Posting-Host: rodan.uu.net

In article <1992Jul21.165726@is.morgan.com> berlin@is.morgan.com (Alexander Berlin) writes:
>Vadim, you are assuming Big Endian, aren't you?
>The original article asked for PORTABLE code. ">>=" depends on byte order.

Oops, it doesn't. Loading from and storing to memory does. My code
use the only 8-bit data memory access - which presumeably do not depend
on endianness :-)

--vadim
From: dave@cs.arizona.edu (Dave Schaumann)
Newsgroups: comp.programming
Subject: Re: Is 2.0 PM very different from 1.x PM?
Date: 27 Jul 92 06:01:14 GMT
Reply-To: dave@cs.arizona.edu (Dave Schaumann)
Organization: University of Arizona

In article <1992Jul27.014642.4971@uniwa.uwa.edu.au>, gupw@uniwa (Paul Wagland) writes:
>Is programming for PM under v2.0 much different than under v1.x?

What's `PM'?

>The reason I wish to know is that the only PM programming books around
>here are for OS/2 v1.x.

Oh.  Some ibm thing, huh?  Maybe you could try asking in an ibm group?

-- 
Mary had a swingin' lamb/he followed her to
	school

She hocked his wool for a bongo drum and man that lamb was
	cool.

		-Mr. Know-it-all
Newsgroups: comp.programming
From: peterk@public.sub.org (Peter Kittel)
Subject: Re: finding 1st one in integer
Organization: Public News & Mailserver, Commodore Germany PM UNIX, Frankfurt
Date: Wed, 22 Jul 92 16:56:04 GMT

berlin@is.morgan.com (Alexander Berlin) writes:

>Vadim, you are assuming Big Endian, aren't you?
>The original article asked for PORTABLE code. ">>=" depends on byte order.

Hmm, are you really sure that the result of a >> operation is dependant
of byte order??? That's the task of the compiler to do this the right
way. ">>" works on normal variables, not on memory locations.

-- 
Best regards, Dr. Peter Kittel  // E-Mail to  \\  Only my personal opinions... 
Commodore Frankfurt, Germany  \X/ {uunet|pyramid|rutgers}!cbmvax!cbmger!peterk
                                   or  peterk@public.sub.org
Newsgroups: comp.programming
From: markh@csd4.csd.uwm.edu (Mark William Hopkins)
Subject: Finding the first bit set
Organization: Computing Services Division, University of Wisconsin - Milwaukee
Date: Wed, 22 Jul 1992 16:00:34 GMT

For the case of 32 bit words, most compilers should handle this efficiently
for any 32-bit architecture.

#include <stdio.h>
int FirstBit(unsigned long L) {
   int I = 0;
   if (!(L&0xffff)) L >>= 16, I |= 16;
   if (!(L&0xff)) L >>= 8, I |= 8;
   if (!(L&0xf)) L >>= 4, I |= 4;
   if (!(L&0x3)) L >>= 2, I |= 2;
   if (!(L&0x1)) L >>= 1, I |= 1;
   if (!L) I++;
   return I;
}
From: bnell@siemens.com. (Bill Nell)
Newsgroups: comp.programming
Subject: Re: Does "400% faster" make sense? (Was: Re: finding 1st one in integer)
Date: 23 Jul 92 20:54:12 GMT

pinkas@caraway.intel.com (Israel Pinkas) writes:

>berlin@is.morgan.com (Alexander Berlin) writes:

>   If some job takes me 100 seconds and you can do it in 25 seconds:
>   I am 300% slower then you are.              (100-25)/25*100 
>   You are 75% faster than I am(not 300)       (100-25)/100*100
>   Your performance is 400% of mine.           (1/25)/(1/100)*100
>   My performance is 25% of yours.             (1/100)/(1/25)*100


>Guess again Alexander.  When calculating delta%, divide by the original
>number.  Thus:

>If some job takes me 100 seconds and you can do it in 25 seconds:
>    I am 75% slower then you are.	(25-100)/100*100%   = -75%
>    You are 300% faster than I am.	(100-25)/25*100%    = 300%
>    Your performance is 400% of mine.	(1/25)/(1/100)*100% = 400%
>    My performance is 25% of yours.	(1/100)/(1/25)*100% =  25%


>To compare:

>If I can dig a hole in 60 seconds, and you can dig the hole in 30 seconds,

>you are twice as fast as me:	60/30
>I am half as slow as you:	30/60


>For more info, see a good high school algebra book.

It all depends on your defenition of faster and performance.  In a way you
are both correct.  I've seen and used the first method for measuring
relative performance in a textbook by Hennesy & Patterson on computer
architecture go check it out if you don't believe me.

						Bill

						
--
bnell@ferrari.siemens.com    | Quote of the Day:
Siemens Corporate Research   |   Those who are wise to the words are wise
755 College Road East        |   to those for whom words are sufficient.
Princeton, NJ 08540          |                         - Scott Surowiec
From: S_TITZ@iravcl.ira.uka.de (Olaf Titz)
Newsgroups: comp.programming
Subject: Relative measuring (Re: 400%)
Date: 23 Jul 1992 11:10:01 GMT
Organization: Fachschaft Informatik, Uni Karlsruhe
Distribution: world
NNTP-Posting-Host: irav1.ira.uka.de
X-News-Reader: VMS NEWS 1.23

A very common source of confusion:

We all are used to compare values by relative factors, i.e. if a = 2b,
then we say 'a is 2 times b'. Confusion occurs when we try to apply
such arguments to values measured in 1/x, i.e.
if a/x = 2a/y what is x compared to y?
Mathematically, that should be clear.

Now, in everyday life, we use 'measure units' that are implicitly
'defined' as 1/x values, such as
double as fast == needs half the time or
double as slow == needs double the time or even
double as cheap == half as expensive or
double as cold == ???????

Compare these examples and you see where confusion can arise
especially when using percentage values. (Btw. it seems nobody knows
whether percentage values are measured from the top or bottom, i.e. is
a product bought for $10 and sold for $20 a 100% gain or a 50% gain?
In business it's 100%, but is this always so?)

I've always considered such language usage a great danger to the
understandability of what one *really* means, even though this can
sometimes be derived from the context. We should be more careful.
And, of course, we should be *extremely* careful when we hear this
sort of mathematics in marketing, i.e. 'This device makes your PC 20%
faster and is 30% cheaper than its major competitor, which also has
the setback of making screen updating 10% slower'...

MfG,
        Olaf
--
                                                             o
 Olaf Titz           \    s_titz@iravcl.ira.uka.de \        _/\
                      \   uknf@dkauni2.bitnet       \      _//|_.
y.a. comp.sc.student   \  +49-721-60439@voice        \    (_)`(_) 
Uni Karlsruhe, Germany  \ praetoriu@irc               \~~~~~~~~~~~~~
Future versions of 'grep' should refuse work when run on a file of newsgroups,
 as this usually serves no benign purpose.