HDTenEightyP/NetNews huggingface dataset:
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Question about Central Point VSAFE message (PC)
Date: 9 Apr 92 21:09:20 GMT

CHUCKM@UCRDG.UCR.EDU (Chuck McDaniels, UCR Academic Computing) writes:

> COMMAND.COM was changed

> What he's been doing is deleting his COMMAND.COM, and reloading it
> from a master DOS floppy.

Tell him to check whether this is the same file (same DOS version and
brand - MS or PC or DR) as the originally installed. Also, ask him
whether he has run SCAN with the /AV or /GV options, or any anti-virus
program (-especially- CPAV) in "immunize" mode.

> He asked me today if he needs to do this,
> since his scanning software can't find a virus (he says he's just had
> it for a month, and that it can detect Michelangelo).

First, the scanning software can detect only KNOWN viruses. Second,
Michelangelo has nothing to do with COMMAND.COM - it's a master boot
sector infector. Third, Michelangelo is not the ONLY virus one has to
worry about.

> So, does this seem symptomatic of a virus?

Yes, it's symptomatic. But nothing more than that. The real thing that
is detected is that the command interpretter has changed. All viruses
cause changes, but not all changes are caused by viruses. If there's
no change, there's (well, probably) no virus, but if there's a change,
it is not necessarily caused by a virus.

> The next time I talk to him, I'll try to
> get a copy of his "modified" COMMAND.COM, if that would help in
> tracking this down.

Get also a copy of the "original" COMMAND.COM. It will be usefult to
compare the two copies.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: C_PUFFER@unhh.unh.edu (Charles Puffer)
Newsgroups: comp.virus
Subject: Computer Hazzard Symbol
Date: 3 Apr 92 13:21:47 GMT
Organization: Lehigh University

I have been thinking about the a computer hazzard symbol for some time
now and would like to suggest somthing like this.

			0
			1
		      1   1
		    0       0
               <Type of danger here>

It would have 2 advantages first it can be displayed or printed in
ASCII and will not be confused with other hazzard symbols. second it
is a trefoil so even someone how does not know what it means might not
take chances with it.

It can also be used to lable other types of computer hazzardes
information.

Charles Puffer
From: martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences)
Newsgroups: comp.virus
Subject: Re: Questions about AAVIRUS (PC)
Date: 8 Apr 92 20:32:42 GMT

James_Williams%ESS%NIAID@nih3plus.BITNET writes:

>Their is a really neat looking program called AAVIRUS on SIMTEL20 in
>the TROJAN-PRO directory.  It creates a checksum and backup of your
>boot sector.
>
>Three general questions:
>
>1.  Have any of the virus experts on this list looked at AAVIRUS?  What
>    is your opinion of it?
>
>2.  How affective is a checksum of the boot record again stealth viruses
>    or polymorphic viruses?

I just hauled it down and had a look at it.  It simply doesn't deal with
stealth at all.  If I do a checksum, then infect the system with a
stealthy Empire virus, then use aavirus to test the system, it claims
the system is ok.  The same thing happens if I install DiskSecure in
the interim, since Disk Secure uses similar "stealth" methods to protect
the Main Boot Record.

The other serious shortcoming is that if a boot sector virus is already
in the MBR when aavirus is "installed", the program happily makes a chksum
that is dependent on the virus.  This is not good, and not necessary.
The program does have one or two lines in the documentation telling the
user to first scan for known viruses, before "installing".  It should
do some checking of its own, as well, though.

Tim.

 -------------------------------------------------------------
  Tim Martin                 *
  Soil Science               *     These opinions are my own:
  University of Alberta      *        My employer has none!
  martin@cs.ualberta.ca      *
 -------------------------------------------------------------
From: kev@inel.gov (Kevin Hemsley)
Newsgroups: comp.virus
Subject: Virus infection tracking
Date: 7 Apr 92 20:55:02 GMT

rslade@sfu.ca (Robert Slade) writes:

>                    Antiviral checklist - part 6
>
>                          For each office: (cont.)
>
>_   List of all hardware and software purchased, supplier and serial
>         number

>In order to effectively track infections, however, even data
>diskettes and customer data diskettes have to be identifiable.  The

Maybe I am missing something, but I fail to see the value in
cataloging the source of all incoming diskettes for later use in
tracking the source of virus infections.  It seems to me that a scan
of all incomming diskettes will reveal any known viruses and prevent
an infection in the first place.

Once the diskettes are delivered to users across the company, the
actual source of a virus infection could be any machine that the disk
touches, providing that the disk is not write-protected.  Therefore,
if you really wanted to track the source and history of a virus
infection, you would need to keep a record of every machine which
every disk touches.  This is not a viable tool.

I believe that a better approach to tracking virus infections is to
use principals of epidemiology to trace possible infections.  See "The
Application of Epidemiology to Computer Viruses" by Bill Murray in the
Procedings of the Fourth Annual Computer Virus and Security
Conference.

In actual practice, it is not always easy to trace the infection path
without missing a disk, or, more commonly, without loosing the scent.
My experience has been to trace an infection back one or two machines
before loosing the scent.  If you can't trace the infection back to
where it entered the organization, it will always come back to haunt
you.  When this hapens, you can pick up the scent again and try to
find the source.  In an organization with thousands of computers which
share media across multiple locations, the task becomes very
interesting to say the least.  Add to all this a large network and you
have a headache.

- -
 Kevin Hemsley                             | The cute message that used
 Information & Technical Security          | to be here was destroyed by
 Idaho National Engineering Laboratory     | a nasty .sig virus!
 (208) 526-9322                            |
 kev@inel.gov                              | Please control your .sigs
- -
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: warning about mutation engine (PC)
Date: 9 Apr 92 22:08:48 GMT

PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics) writes:

> I can understand scanners failing on mutating viruses - that's "old
> hat" , but the claim it can wiggle past "any other memory resident
> checker" has me worrying; does that mean only memory-resident scanners
> or *any* memory resident checker?

> I suspect that these viruses, even if their code differs greatly, will
> still always use just one or two methods of infecting - it should be
> stoppable at that stage, with a checker that looks at what it does,
> rather than the code it uses to do that.

Oh, bypassing the monitoring programs is pretty trivial. All modern
tunnelling viruses do it. Till there's no memory protection, there's
no way to stop them from doing so.

> Rememberring that there are more ways of stopping a virus than simply
> scanning for it, what other anti-viral methods (e.g. change detectors,
> software write-protection, anything) actually succeed? Has anyone
> carried out the tests?  If not, could someone with the engine do so -
> quick, please!

The MtE is just that - a polymorphic engine. Everything else must by
supplied by the virus writer. The real problem is that it can be done.
I won't be surprized to see "stealth engines", "tunnelling engines",
and "infecting engines" to appear, so we'd better be prepared...

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: F-PROT warning: false positive? (PC)
Date: 2 Apr 92 15:22:11 GMT
Organization: Lehigh University

In Message 25 Mar 92 04:04:00 GMT,
  PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of writes:

>bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
>> 0004839378@mcimail.com (Joshua Proschan) writes:
>>> A related question: f-prot identifies nearly all the Norton Utilities
>>> programs

The reason for this is that the programs use OPTLINK, (a linker which
adds PKLITE-like compression to executables as they are linked).  My
heuristics did not include a rule to specifically exclude OPTLINK
(I have rules to exclude PKLITE, LZEXE, DIET, KVETCH, ICE, EXEPACK etc)
so it detected "highly suspicious self-modifying code" - which,
strictly speaking is true.  This was fixed in 2.03.

and several Microsoft Word programs as exhibiting virus-like
>>> behavior, when the heuristic scan is used.  Is this also a false
>>> positive?

This (at least WORD.COM) is a documented false positive - see ANALYSE.DOC.
I am working on reducing the number of false positives, but I fully agree
that heuristic analysis should only be used by experienced users....there
are still some false positives....

>A better solution is AI scanners (perhaps not the best term, though).
>Instead of looking for fragments of known viruses (with all the
>problems that entails), or looking for "things viruses tend to do", it
>is possible for a program to look at a boot sector and categorically
>say if it is a genuine DOS boot sector or a virus.

This is theoretically impossible - just ask Fred Cohen :-)

[Well, it is easy to see if it is a true DOS boot sector, but there will
always be some "unknowns"...]

However, it is *nearly* possible in practice, although you will always
get a few false positives, a few false negatives or both.

I am working on my heuristic analysis - which (and I think nobody in
the anti-virus community disagrees with me) is able to detect the
majority of unknown viruses, but it is not perfect - I don't analyse
boot sectors yet, and I detect only a low percentage of viruses
written in high-level languages.  However, as I said...the analysis is
improving.

- -frisk
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Novell Virus? (PC)
Date: 9 Apr 92 20:02:02 GMT

gscobie@castle.edinburgh.ac.uk (G J Scobie) writes:

> Last year I ftp'd an article which apparently had been published in
> Computers and Security Nov 1990 issue (I forget which site). This
> paper written by Jon David outlines a virus which seemed to infect a
> Netware server without the appropriate rights to do so. Anyone any
> upto date info on this given the recent discussion on this topic?

Unfortunately, Jon David has refused to supply an example of the
actual virus used to the other anti-virus researchers for testing. I
myself tested the behaviour reported in the article, using the
functions that the virus mentioned there (Jerusalem) uses, but
couldn't confirm Mr. David's observations.

To those who have not read the article, the reported behaviour is that
the virus is able to -slightly- bypass the granted rights (e.g.,
modify the file attributes without having the MODIFY right, but not
writing to the file; infecting the file without having the WRITE
right, it at least READ right is granted, but not delete the file,
etc.).

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: heuristic scanners
Date: 9 Apr 92 19:01:53 GMT

0004839378@mcimail.com (Joshua Proschan) writes:

> Upon reflection, I must side with those who want the heuristic
> scanners to continue to be available.

Available - yes. Used by Joe Users and relied entirely on them (as
some people are relying entirely on SCAN) - definitively not.
Currently the anti-virus researchers are the only software producers
that must also support the product of their competitors... Have you
thought how many times McAfee or Frisk had to answer the question why
they are detecting CPAV as a virus?

> The problems of avoiding a
> deluge of inquiries from casual users with false positives can be
> avoided by including a prominent warning in the documentation that

Yeah, right. Unfortunately, the casual users mentioned above tend not
to read the docs... :-((

> false positives can occur; and by the previous suggestion of including
> it in the FAQ and simply not responding.

The latter is the attitude that I am proposing. Anybody who is
competent enough to use a heuristic scanner should know about the
potential problems and not ask silly questions...

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Re: LAN PROTECT by Intel?? (PC)
Date: 10 Apr 92 23:14:30 GMT

There is, or, rather, will be, a LANprotect product from Intel.  The
product has not yet been released, as was learned when Intel's
LANspool product got a bit of a bad break with an infected release.

Intel is not developing this, but is "second sourcing" it.

=============
Vancouver                               | "The client interface
Institute for  Robert_Slade@sfu.ca      |  is the boundary of
Research into  rslade@cue.bc.ca         |  trustworthiness."
User           CyberStore Dpac 85301030 |    - Tony Buckland, UBC
Security       Canada V7K 2G6           |
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: MDISK & FDISK - Are they the same? (PC)
Date: 9 Apr 92 19:38:05 GMT

mcafee@netcom.com (McAfee Associates) writes:

> The FDISK program is MS-DOS's utility to partition a hard disk after
> low-level formatting or change the sizes of the partiions, etc.
> M-DISK is a set of utility programs for replacing the Master Boot
> Record (partition table) and DOS Boot Sector code when infected by a
> virus.  M-DISK works for MS-DOS (and PC-DOS) 3.00 through 4.01.
> MS-DOS 5.00 has it's own built-in "M-DISK" for removing partition
> table infectors.  It's the undocumented /MBR switch, which will remove
> the existing code in the MBR and replace it with a clean copy from
> inside itself, while leaving the data (the actual partition table)
> intact.

Unfortunately, FDISK /MBR does not fix the diskETTE boot sectors... I
really wish there were a similar option for SYS... So maybe a MS-DOS
5.0-aware version of M-DISK is not that silly as idea? But I guess
that Padgett will have the problem solved earlier and (he promisses)
independent of the DOS versions...

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: polymorph virus questions (PC)
Date: 9 Apr 92 20:17:27 GMT

ukcy@sunyit.sunyit.edu (Kevin Yager) writes:

> I am also interested in learning more about polymorph.  My boss read

Read the FAQ list then... :-)

> about it in a magazine and had me write a program that will document
> the length of every com and exe.  On subsequent runs it will check to
> be sure the file length is the same and add or delete executables that
> have been created or deleted.

The main problem with the above procedure is that it won't catch a
stealth virus if it is active in memory. It will also not catch a
virus which does not change the length of the file (Lehigh, Number of
the Beast, 1963, the silly overwriting ones, the Phoenix family under
some conditions, The Rat, and many others). Also, it will not catch
any boot, master boot, or file system infector (Dir II).

> Since I wrote the program I have learned that some of the "stealth"
> viruses are smart enough to change the length data so that when a dir
> listing is done you will so the old length of the file instead of the

Yep. And this is even called semi-stealth only... The fully stealth
viruses are so smart that even if you read the whole file, you will
not notice any changes in it, if the virus is active in memory.

> actual length.  How many viruses can really do this??

Many enough.

> How usefull is the program that I wrote??

It can detect silly (but widespread) viruses like Jerusalem or Dark
Avenger. However, it also provides you a false sense of security...

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: michael.blackwell@f820.n680.z3.fido.zeta.org.au (Michael Blackwell)
Newsgroups: comp.virus
Subject: Virus surving format (PC)
Date: 31 Mar 92 14:04:00 GMT
Organization: Lehigh University

In a recent arcticle [New Scientist no.1813 p48] the author stated
"...some viruses may transfer from floppy to hard disk DURING
FORMATTING" {caps mine}.

As far as my little knowledge tells me, this cannot be. I h ave yet to
find a virus description that aludes to this. I suppose theoretically
it is possible, but so is walking through walls. Has anybody heard of
such a virus?

Thanks in advance.

Michael
- ---
 * Origin: Coffee Au Go-Go. We don't know what it means either. (3:680/820)
From: cosc15yc@rosie.uh.edu (92S10711)
Newsgroups: comp.virus
Subject: home made anti-virus tricks and questions (PC)
Date: 6 Apr 92 22:55:00 GMT


	Please answer these questions for a new computer owner.

	1.  If I set the attribute of all files on disk to read only,  would
        that trip any known/popular virus that trying to infect say command.com

        (i. e. dos would say *.com readonly    message alert me to
       	virus present).

    	2.  Can virus infect  any file extension or just .com and .exe?

	3.  Can virus infect( not destroy)  a disk with no .com and .exe
        files and no bad sector

	4.  Can virus infect a nonbootable floppy with only .zip file with no
        bad sector ?

  Did you ever del the command.com in the root directory?   Take 3 weeks
to find/learn that only dos 3.3 or above can access 40meg partition HD
when I first buy a computer.

Thank in advance  Tony       cosc15yc@jetson.uh.edu
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: warning about mutation engine (PC)
Date: 9 Apr 92 21:58:17 GMT

mike.opzoomer@canrem.com (Mike Opzoomer) writes:

> >     Three new viruses have appeared in the past two months that
> > utilize the Bulgarian Dark Avenger Mutation Engine.  The source
> > code for this mutation engine has appeared on numerous virus-
> > exchange bulletin boards and is now in the hands of virus writers.

> VB>The source?! Are you sure? What we have here is a virus development
> VB>kit, which contains the MtE as a compiled, ready to link OBJ file,

> The source IS available as after a great concern about the polymorphic

I meant are you sure that the source of the MUTATING ENGINE is
available? Can you provide some information about it; e.g. how many
lines has the file that contains it?

> engine and a call the McAffee in Canada I found out THEY have a copy
> of the code for the engine and virus.

Sure, they do have a copy of the code for the engine and the source
for the virus. It was me who sent it to them, so I should know... :-)
My question however was whether they have a copy of the source of the
MtE, not of the demo virus that is supplied with it. To my knowledge,
currently nobody has seen the source of the MtE, but I might be
wrong.

> Yes.. the Pogue was detected and cleaned (most of the time) but the
> NEW polymorphic engine (not the one that spawned Pogue and the others)
> has a way of wiggling its way through vshield or any other memory
> resident checker.

The MtE itself has -no- means to bypass VSHield or any other memory
resident checker. It is a library function to create random mutations
of a piece of code. Any additional tricks like fast infection,
tunnelling, and stealth must be provided by the writer of the virus.

> The polymorphic engine is just that, and once infected it mutates on
> an ongoing basis, rendering any scan utility useless (unless you have
> a copy of the size of the original file)

The MtE does not mutate at all. It only provides a library function
which can be called to mutate (i.e., encrypt and construct a random
decryptor) the virus code. As to "rending any scan utility useless",
this is, of course, rubbish. Any particular virus can be scanned for,
including all those made with the MtE. The real problem is that when
there are A LOT OF such viruses, which use DIFFERENT polymorphic
mechanisms, it is very tedious and time-consumming to update the
scanners. Look at the new SCAN - it has increased by about 14 Kb - and
have in mind that it is PKLited...

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: LANs, Viruses, & Detection (PC)
Date: 11 Apr 92 18:38:48 GMT


	I received my upgrade copy of Artisoft's Lantastic 4.1 this
week and my "first look" indicates that it is still impossible for a
Lantastic "server" to force a "workstation" to authenticate itself
prior to allowing login other than with a simple password e.g. login
scripting capability controlled by the server that can force the
"workstation" to run anti-virus software or other user selected
validation during the login process and permiting denial of the login
on failure is still not provided.

	IMHO, while I find Lantastic to be a very nice product
otherwise, this omission makes anti-viral defenses at the server level
much more difficult. I suspect that this may be a shortcoming of any
peer-peer network but it certainly does not have to be.

	If I am wrong in this assessment, I would be very glad to be
corrected and will post the correction but the preceeding is based
both on study of the Lantastic upgrade book and conversation with the
Artisoft staff.
					Warmly,
						Padgett
From: chris@coombs.anu.edu.au (Chris @ SSDA ...)
Newsgroups: comp.virus
Subject: New SAM Defn File - e-mail or post? (Mac)
Date: 25 Mar 92 06:12:04 GMT
Organization: Lehigh University

Hi all,
	I was wondering if some kind sole could either post or e-mail me
the latest SAM Defn File?

Thanks in Advance.

Chris.

- - --
- -
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-=
                  Chris Patterson | Ph:  +61 6 2492185
     Social Science Data Archives | AARNet: Chris@coombs.anu.edu.au
   Australian National University | "I wonder what happens if I ..."