HDTenEightyP/NetNews huggingface dataset:
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: Info on Music Bug virus (PC)
Date: 29 Dec 92 00:40:00 GMT

Quoting from Scott Jeffrey B to All About Info on Music Bug virus ( on 
12-09-92

SJ> My 286 clone was recently infected with the 'Music Bug' virus.
SJ> Every time something was read from the hard disk, it played
SJ> a random tune.  Didn't seem to be harmful - just annoying as hell.

The Music Bug virus isn't generally destructive, but the FAT table 
structure on hard drives gives some weird effects occasionally.

SJ> I'm just curious.  Does anyone know exactly what this virus does?
SJ> Is it harmful?  Might I still have problems in the future as a result
SJ> of this virus?

Like all boot sector viruses. if you didn't scan every diskette in the 
building, the virus will probably come back sooner or later.

I have heard that Music Bug waits four months before the musical effects 
start.
 
The tune is usually 36 notes long.

Bill

- ---
 * WinQwk 2.0 a#383 * Thunder Byte USA BBS (615) 442-2833
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Clearing out old signatures (PC)
Date: 7 Jan 93 19:46:14 GMT

riordan@tmxmelb.mhs.oz.au (Roger Riordan) writes:

> To guard against possible unknown viruses like to Chinese Fish, 
> which install themselves in high memory, but do not set the top of 
> memory down, we recently added a feature to VET to fill unused 
> memory with a diagnostic procedure which gives a warning message, 
> and locks the PC, if anything attempts to execute unused memory.  So 
> if you run VET, and an unknown virus of this type is already in 
> memory, you get the warning as soon as VET calls an interrupt the 
> virus has trapped.

Hmmm... How do you achieve that? One could fill the free memory with
INT xx instructions and intercept interrupt number xx, but
nevertheless chances are that the "something" that has been active in
the unmarked memory will be called in the middle of the INT
instrcution... The chances for this to happen are 50%... Ahh, I think
I guessed it - you use interrupt number 0CDh? :-)

> We investigated, & found that they were using Microsoft Lan Manager.  
> When PROTMAN was run from CONFIG.SYS a block of code was installed 
> at 7000:7800, but top of memory (as recorded at offset 2 in the PSP) 
> remained 9FFF:0000.  If this code was overwritten by running VET (or 
> anything else) before the user logged in, the system would crash 
> when the program NBP.EXE was run as part of the log in procedure.

Hmmm, that's a serious bug in the Lan Manager, IMHO... If it indeed
keeps active code at that segment, then it could be overwritten by
ANYTHING! A large program, multiple copies of the command interpreter,
anything...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: Jerusalem (Israeli) Virus (PC)
Date: 29 Dec 92 06:33:00 GMT

Quoting from Samid Hoda to All About Jerusalem (Israeli) Virus on 12-20-92

SH> 	I need some information on the Jerusalem B virus as it has
SH> infected almost every single file on my system. Does anyone know how
SH> it spreads and how it spreads so fast? Any advice in getting rid of
SH> the virus would be appreciated( except for a low level format as that
SH> is an obvious option.)

Jerusalem B is a file infector. It runs as a TSR, and will infect every 
executable file you run except for .COM files larger than 62K. I believe 
the virus is around 1800 bytes long.
 
McAfee's Clean can remove this virus fairly easy to remove. It would be a 
very good idea to re-boot the computer from a known clean bootable 
diskette. If you don't have a clean bootable diskette, go ahead and type 
the following on the command line.
 
CLEAN C: [JERU]
 
after Clean gets finished, turn your computer off for a few seconds, then 
back on. The reason for this is that since Jerusalem-B runs as TSR. After 
the computer is clean, make a bootable diskette, then place a write 
protect tab on the notch. Then the next time you have another virus, you 
will be ready.
 
I hope this has been of help to you.

Bill

- ---
 * WinQwk 2.0 a#383 * CASPER activates Apr 1st
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Export restrictions of anti-virus software?
Date: 6 Jan 93 20:57:29 GMT

The following was provided by Robert Heuman from Canada in one of the
newsgroups (sci.crypt, I think). It seems to imply that some kinds of
anti-virus programs are restricted from export in Canada. I would be
very interested whether similar export restrictions exist for the USA.
Please note that I am interested -only- in export restrictions of
anti-virus software, not in export restrictions of cryptographic
software. Could somebody in the USA who has access to the full text of
ITAR verify that? Please, if you find something, post the exact
reference and quote, if possible. Thanks.

Regards,
Vesselin

Date Entered: 12-22-92 10:34
I was asked to supply information re export control over anti-virus 
software, since I stated it was restricted in some cases.

The exact information follows:

Source: A Guide to Canada's Export Controls, January 1, 1992

Page 25, item 1150.Information Security

NOTE: The embargo status of "information security" equipment, 
"software", systems, application specific "assemblies", modules, 
integrated circuits, components or functions is defined in this 
Category even if they are components or "assemblies" or other 
equipment.


Page 25, item 1154. Software

1154.a.c.3. "Software" designed or modified to protect against 
malicious computer damage, e.g., viruses.


Page 1, General "Software: Note

This List does not embargo "software" which is either:
1. Generally available to the public by being:
    a. sold from stock at retail selling points, without restriction,
       by means of:
        1. Over the counter transactions
        2. Mail order transactions
        3. Telephone call transactions _AND_
    b. Designed for installation by the user without further 
       substantial support by the supplier, _OR_
2. "In the public domain".

A check with Ottawa resulted in the statement that F-PROT was export 
restricted (controlled) as shareware did not meet the criteria of this 
general "software" note... Therefore SCAN by McAfee also would not 
meet the requirements.

I believe a similar restriction will be found in the US regs, as 
Canada's are based in good measure on the US regs, and this specific 
restriction was added at the request of the US gov't.

Bob
- ---
   RoseReader 1.70 P001886: Twice as human as anyone else my opinions are my ow
n
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Interesting Book
Date: 5 Jan 93 15:54:00 GMT

Over the holidays took a much-needed rest (family went to visit
cousins in Scotland & I was permitted to stay home 8*) & caught up on
some reading. One of the more interesting ones was *War in 2020* by
Ralph Peters.

Published in March of 1991 it missed the breakup of the Soviet Union
though the afterward makes it clear that the author was not surprised.

An interesting sub-plot developed late in the book was that high-tech
weaponry takes humans out of the tactical loop and relegates them to
strategic decisions. Further, if you can remove trust in the weapons
(virus etc.) you can destroy an adversary's capability to defend
himself.

Somewhere in the last few years we seem to have lost Heinlein's "tell
me three times" concept for trust and IMHO much of our difficulties
today stem from this.
					Philosophically,

							Padgett

ps In a modern PC disk information is stored in the CMOS, Partition Table
   and the DOS Boot Record. The code is trivial and given any two, the
   third can be easily reconstructed.
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: Clash between FDISK/MBR and scanners (PC)
Date: 7 Jan 93 20:56:26 GMT

>From:    tck@bend.ucsd.edu (Kevin Marcus)

>I recently installed Linux, a version of unix for the PC, in addition
>to my regular dos partition.  This comes with a small program called
>"wini" which is a program, which occupies the MBR to allow me to
>choose which OS I would like to boot into.  It's my understanding
>OS/half does somethign like this, also, or can do something like this.
>If FDISK/MBR REWRITES the MBR with the basic, boring code that
>normally is there with DOS, then if I use this method, I will destroy
>the wini program, and restrict myself from booting into my Linux
>partition.  This is another drawback to fdisk/mbr.

COHERANT is another OS that uses this method. Actually there are any
number of other a-v solutions that will do as well (such as my own
FixMBR which can produce a small executable file that will restore the
original MBR) but FDISK /MBR has three great advantages:
a) It is a no-brainer.
b) Everyone who has DOS 5.0 has it.
c) It will *not* lose/change the partition table.

Given that you know FDSIK /MBR uses "basic, boring code" you probably also
know how to use DEBUG to repair most anything that FDISK /MBR can, but for
those who need to ask - K.I.S.S.
					Warmly,
						Padgett

ps It is my understanding (David ?) that OS/2 uses selection through a 
   replacement of the DBR (OBR ?) *not* the MBR and requires a more complex
   approach e.g. You boot. If the wrong OS comes up, you instruct a program
   to replace the DBR with the correct one then you boot again. Hopefully
   this time the correct OS comes up. Only IBM...
From: celustka@sun.felk.cvut.cs (Celustkova-k336-doktorand(Richta))
Newsgroups: comp.virus
Subject: Good and bad viruses (was FC on virus creation)
Date: 22 Dec 92 22:04:48 GMT

With properly defined computer virus there shoudln't be doubts what is
a good and what is a bad virus. Or should be ? Let's suppose that bad
virus is intended to cause some unwanted function in system. Some
programs (even antiviral) can do the same thing, (what is unwanted
function anyway ?) but they cannot propagate. Good virus can
propagate, but it is supposed to not invoke anything unwanted. But, by
definition good virus can mutate, so can become bad virus. Also, good
virus on one system can be bad virus on another system (causing some
unwanted function). Could all bad viruses be good viruses ? Yes,
because without them many A-V producers would loose their source of
money. Can all good viruses be bad viruses ? Yes, because they are
viruses (something very suspicious). Confusing ? Not to anyone who
ever met chinese philosophy and principles of Yin and Yang. Shortly,
good and bad are inseparable and dependent one of the another (you
can't define good without defining bad and vice versa).

So, what to do ? Let's throw (unnecessary) philosophy and look at
(poor) simple PC user. S/he finds something weird on her/his PC and
suspects it could be a virus (whatever could be called by that name).
S/he chooses some A-V product and tries to solve the problem. If the
product solves problem and everything is like before user is
satisfied. And that should be the main goal of every A-V producer. If
Fred Cohen's customers are satisfied with his product why all that
complaining about ethical correctness. Ask them if they have any
ethical problem using that product. If they are not satisfied that is
Fred Cohen's problem and he has to solve it. Simple, isn't it ?
                                                                           
Cheeers,                __________________________                         
                       |                          |                        
Suzana                /|     I'm a good virus!    |\     |\__/|            
         /~~~~~~\    / |     He's a bad virus!    | \   /      \           
      ~\(  * *   )/~   |__________________________|  ~\(  0 0   )/~        
        ( \___/  )                                     ( /---\  ) 
         \______/                                       \______/           
        @/       \@                                    @/      \@
- ---------------------------------------------------------------------------
Address: Suzana Stojakovic-Celustka          e-mail addresses:
         Department of Computers             celustka@sun.felk.cvut.cs
         Faculty of Electrical Engineering   celustkova@cs.felk.cvut.cs
         Karlovo namesti 13
         12135 Prague 2                      phone : (+42 2) 293485   
         Czechoslovakia                      fax : (+42 2) 290159
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Clash between FDISK/MBR and scanners (PC)
Date: 5 Jan 93 20:31:08 GMT

>From:    "Roger Riordan" <riordan@tmxmelb.mhs.oz.au>

>The command FDISK /MBR is often recommended for removing MBR 
>infectors (Stoned, etc) from hard disks.  However in some 
>circumstances this can cause problems with some scanners.  It 
>appears that some versions of FDISK/MBR rewrite the Master Boot 
>Record only as far as the end of the error messages, leaving the all 
>important partition information unchanged, but also leaving any 
>viral code between the messages and the partition information.

Cannot speak for all versions but the FDISK.EXE in MS-DOS 5.00
dated 3-22-91 is identical to that of 11-11-91 and both zero out all
the unused bytes between the end of the messages at absolute offset
0D9h and the beginning of the partition table at offset 1BEh. 

Of course FDISK/MBR will not have *any* effect with any DOS before 
5.00 so this may be the cause. 

It is possible that PC-DOS or some other proprietary version or even
that there may be an "export" MS-DOS that might have the effect Roger 
reports. (can only speak for what I have seen).

Please reply directly & I will summarize any verifiable exceptions.

					Warmly,

						Padgett
		<padgett@tccslr.dnet.mmc.com>

ps anyone know what the FORMAT switches /SELECT, /BACKUP, & /AUTOTEST
   do (MS-DOS 5.0) ?
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: SUMMARY: FORM virus infection in Germany (PC)
Date: 5 Jan 93 18:30:02 GMT

cfsc-hga-gc-mis@augsburg-emh1.army.mil (David Hanson) writes:

> Thanks to all who wrote to tell me to use SYS.COM.  However, I don't
> think that I would recommend SYS without the caveat that you may lose
> some FAT information.  Areyah alludes to it in his response, and in
> reality, there can be quite a bit of destruction.

Could you please elaborate -how- could SYS.COM cause destruction of
some FAT information? Assuming that you are using the same DOS version
your DOS partition is formatted with, of course. But even if you don't,
all damage I can think about is that your DOS partition could become
non-bootable  or SYS could just refuse to work (i.e., "no room...")...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: Re: Untouchable (PC)
Date: 28 Dec 92 23:48:00 GMT

Quoting from Vesselin Bontchev to All About Re: Untouchable (PC) on 
12-07-92

VB> One important thing to have in mind is that the product is very good,
VB> but not as good as the advertisements are trying to suggest you. Some
VB> advertisements (in France) say that it is "the absolute weapon agains
VB> computer viruses" and that no virus, even an unknown one, is able to

I agree 100%.
 
Untouchable is capable, but I wouldn't do much farther. I have Untouchable 
1.13.

UTScan
Detection is fair
removal leaves a lot to be desired.
 
I would place F-Prot, VIRx, and Scan in front of it.

UTRes
Detection is fair.

UTPeriodic
This is one of the best integrity checkers that I have seen. I would put 
it in the same league with Victor Charlie's Bit Checking, or Integrity 
Master.

The advertising for Untouchable is doing them a dis-service.
 
Untouchable is good, but not THAT good.
 
Bill

- ---
 * WinQwk 2.0 a#383 * Hacked version of Math Master MATHMSTR.*
From: riordan@tmxmelb.mhs.oz.au (Roger Riordan)
Newsgroups: comp.virus
Subject: Clash between FDISK/MBR and scanners (PC)
Date: 24 Dec 92 01:55:07 GMT

The command FDISK /MBR is often recommended for removing MBR 
infectors (Stoned, etc) from hard disks.  However in some 
circumstances this can cause problems with some scanners.  It 
appears that some versions of FDISK/MBR rewrite the Master Boot 
Record only as far as the end of the error messages, leaving the all 
important partition information unchanged, but also leaving any 
viral code between the messages and the partition information.

This will cause problems if the user later scans the disk with a 
scanner which uses a string in this area to detect the virus.

In our case VET reported that the MBR of a PC was infected, and the 
recovered copy of the MBR was also infected, but the PC booted OK, 
the top of memory was OK, the virus was not in memory, and the PC 
did not infect floppies.  The main part of the MBR seemde normal, 
but code from Stoned followed the messages.  It appears that the PC 
had twice been infected with Stoned, and each time it had been 
removed using FDISK/MBR.  Thus both the MBR, and the copy saved by 
Stoned, contained viral code, which included the template used by 
VET.

FPROT reported the infected MBR as 
     Master boot sector: Possibly a new varient of Stoned.

SCAN, Dr. S Toolkit, did not report any virus.

We understand that FDISK was definitely run on this PC, but we could 
not confirm that FDISK was responsible, as it cleared this part of 
the MBR when we used it to remove Stoned from an experimentally 
infected PC.

Roger Riordan                     riordan.cybec@tmxmelb.mhs.oz.au

CYBEC Pty Ltd.                                 Tel: +613 521 0655
PO Box 205, Hampton Vic 3188   AUSTRALIA       Fax: +613 521 0727
From: celustka@sun.felk.cvut.cs (Celustkova-k336-doktorand(Richta))
Newsgroups: comp.virus
Subject: Good use of (possible bad) viruses
Date: 22 Dec 92 22:04:50 GMT

Hi boys and girls, (a day of inspiration,huh ?)

Just one of those days...Two examples of good use of (possible bad)
viruses come to my mind :

1. Viruses written to improve an A-V product

The logic is simple. It is better that I write virus which can do this
or that and have prepared solution to implement in my A-V product than
wait that such virus arises in wild and then react. That means if I
know that today exist viruses which could be stealthy, tunneling or
polymorfic why shouldn't I write virus which is all that and design my
A-V product to recognize such virus before it really appears in wild.
(Well, maybe it is not commercial, I don't know). If such virus *by
accident* escape from my lab I already have a response and there is no
ethical problem at all.

2. Viruses built in an A-V product (it's just an idea, don't blame me if it
is not applicable in reality)

Suppose that we have an A-V product which in regular intervals or
randomly send a virus in system. Virus (fast infector) infects only
programs which checksum doesn't correspond to previously calculated
values. If no such program is found virus deletes itself or removes
from memory. If changed program found virus activates scanner to check
if there is any known virus.  If known virus is found message is sent
to the user. If program is changed and no known virus is found the
message is sent to the user to make decision.  If decision is to leave
program as is, virus cuts itself from the program.  The whole process
(except messages) takes place in background. There is no need for all
A-V program (which is combination of I-checker and scanner) to be TSR,
only virus is occasionally TSR. There is slight similarity in this
idea with reaction of human immunity system. Anyone has ethical
problem with her/his own immunity system ?

Cheeeers,

Suzana                                                                   
              ____________________________________________________ 
             /                /    |                              |
            /         |\__/| /     | We wish you Merry Christmas  |
       /~~~~~~\      /      \      | and Happy New Year !         |
    ~\(  * *   )/~~\(  0 0   )/~   |______________________________| 
      (   O    )    (   O    ) 
       \______/      \______/                        
      @/       \@   @/      \@

- ---------------------------------------------------------------------------
Address: Suzana Stojakovic-Celustka          e-mail addresses:
         Department of Computers             celustka@sun.felk.cvut.cs
         Faculty of Electrical Engineering   celustkova@cs.felk.cvut.cs
         Karlovo namesti 13
         12135 Prague 2                      phone : (+42 2) 293485   
         Czechoslovakia                      fax : (+42 2) 290159
From: pd@nwavbbs.demon.co.uk (Peter Duffield)
Newsgroups: comp.virus
Subject: PKZIP V2.04C (PC)
Date: 7 Jan 93 11:44:21 GMT

I picked the following post up in comp.archives.msdos.announce and thought
it may be of interest to this group...

- --------------------------------- cut here -----------------------------

From: PKWare.Inc@mixcom.mixcom.com (PKWare.Inc)
Subject: PKZIP 2.04c RELEASED (NO VIRUS)
Reply-To: PKWare.Inc@mixcom.com
Date: Thu, 7 Jan 1993 09:38:18 GMT

        PKZIP 2.04c is now released and on the PKWARE BBS (414-354-8670)

        Some reports have come in the certain version of Norton Anti-Virus
        are reporting PKZIP 2.04 to have the Maltese Amoeba virus.

        THESE REPORTS ARE FALSE! If the version of Norton is upgraded to
        a newer version the false reports cease.

        The correct files size,date and time should be:

        PKZ204C.EXE     188818  12-28-92        2:04
                        SIZE    DATE            TIME

        If you have any further questions, please feel free to contact
        me here at pkware.inc@mixcom.com

        Mark Gresbach
        PKWARE, Inc.
- --
PKWARE.Inc@mixcom.com      Voice (414)354-8699   Authors of PKZIP, PKLITE
9025 N. Deerwood Dr.         BBS (414)354-8670   PKZFIND, PKZOOM, and the
Brown Deer, WI 53223 USA     FAX (414)354-8559   Data Compression Library

- --------------------------------- cut here -----------------------------
Peter
- --
Peter Duffield                          pd@nwavbbs.demon.co.uk (Internet)
Voice: +44 244 545669                   BBS:  +44 244 550332   8,N,1
North Wales Anti-Virus Support BBS, FidoNet: 2:250/201, VirNet: 9:441/110
===  PGP 2.0  ==  public key available on request  ==  Key ID 991AB1  ===
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: Re: Brain Viruses (PC)
Date: 28 Dec 92 23:53:00 GMT

Quoting from Kevin Marcus to All About Re: Brain Viruses (PC) on 12-07-92

KM> brain, whatever you wanna call it).  It is a VERY old boot sector
KM> infector (some of the newer varients can infect the MBR).  This means
KM> they infect disks, and not files.  It uses some steath techniques, so
KM> that it hides the it's infection by redirecting calls to read in the

I'f I not mistaken. I believe "Pakistani Brain" was the first virus that 
used stealth routines.
 
No-Int (sometimes called Stoned three) is also a stealth boot sector 
virus. However; the stealth routines are quite sophisticated.
 
Bill

- ---
 * WinQwk 2.0 a#383 * SATURDAY THE 14TH activates Saturday 14th