HDTenEightyP/NetNews huggingface dataset:
From: M.Meijer@cc.ruu.nl (Maarten Meijer)
Newsgroups: comp.virus
Subject: Re: Questions about AAVIRUS (PC)
Date: 9 Apr 92 11:05:40 GMT

James_Williams%ESS%NIAID@nih3plus.BITNET writes:

>Their is a really neat looking program called AAVIRUS on SIMTEL20 in
>the TROJAN-PRO directory.  It creates a checksum and backup of your
>boot sector.

>Three general questions:

>1.  Have any of the virus experts on this list looked at AAVIRUS?  What
>    is your opinion of it?

>2.  How affective is a checksum of the boot record again stealth viruses
>    or polymorphic viruses?

>3.  Are there better packages which do the same the thing?

Hello James.

Thank you for your attention to my little program AAVIRUS on SIMTEL20.
Concerning your question #2: *any* change to the boot sector or master
boot record will be noticed by AAVIRUS. So the question whether these
changes are caused by stealth or polymorphic viruses, or by viruses of
any kind, isn't as relevant as whether the reading (and writing) of
the boot sectors has been *redirected*, as some sophisticated boot
sector viruses do. In that case, AAVIRUS will read the original boot
records despite the presence of a bootsector virus, and will report
"everything looks fine".  The Tequila virus is an example.

Likewise, restoring boot sectors with AAVIRUS -r (or -e) might seem to
be successful, yet the memory resident virus could redirect this writing
to another location on the disk, leaving the corrupted boot sector
unchanged.

With the current version of AAVIRUS, the only remedy to both cases is to
start the pc with a clean system floppy, and then run AAVIRUS, specifying
[filename] and [disk]. That's far from ideal.

Of course, AAVIRUS could register the address of the disk read/write
routine at installation time, and compare this to the one at test time.
Up to now, I deliberately didn't implement this, because some memory
resident utilities like PC Tools, Sidekick, etc. also change this
interrupt vector. It would result in inconsistent warnings of AAVIRUS,
depending on whether you have loaded or unloaded such TSR's. Perhaps
I should make it an option, but on the other hand I would like to keep
the program as simple as possible. Besides its ability to restore things
under critical circumstances, simplicity should be a feature of AAVIRUS.

In the next version of AAVIRUS I will work this out. Also, I will extend
the program to checksum a limited number of program files (the user's
most frequently used). In case of contamination with a .EXE or .COM virus,
the programs most frequently used are the most likely to be infected.
And finally, the next version of AAVIRUS will be able to check and restore
CMOS data if present.

I hope having answered part of your questions.
Kind regards,

- --
Maarten Meijer,
  ACCU - Academic Computing Centre of Utrecht University
         Budapestlaan 8, De Uithof, 3584 CD Utrecht,
         P.O.Box 80011, 3508 TA Utrecht, the Netherlands.
Fax:     (31) 30 531633
Phone:   (31) 30-531660 / (31) 30-531436
Email:   mmeijer@cc.ruu.nl
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Checklist part 8
Date: 3 Apr 92 20:28:05 GMT
Organization: Lehigh University


                    Antiviral checklist - part 8

                          For each office: (cont.)

_ Log of disks/programs received (cont.)

Last weeks column dealt with the difficulties arising from a policy
intended to keep "pirated" software out of an organization, and to
ensure that software publishers were paid for their efforts.  In
fact, the policy was ignored by obtaining evaluation software "under
the table".  In the end, all it did was prevent publishers who had
standardized policies for review software from competing in reviews
by local offices.

Federal government policy also provides for tracking of all inventory
through accession numbers.  The system works well for desks and cars,
but not so well for computers and software.  (I had a hard time
convincing the "materiel [sic] management" people in one office that
it did not make sense to issue one accession number to twelve video
cards, but it did make sense to issue one number to one card, three
disks of setup software and one manual -- for the same card.)
Because of the difficulty in putting items into inventory (obtain the
inventory coding for the item, obtain an accession number, affix a
label -- you ever try to find space for a 2cm by 6cm label on a video
card? -- and enter up to 46 fields of data into the inventory data
base - by paper form, since only two people in the local office have
access to the data base itself) very few software related items were
ever entered into inventory.  Data disks were never labelled: after
all, what do you do with a carton of 100 blank disks, which are
probably headed for thirty different offices?

In order to effectively track infections, however, even data
diskettes and customer data diskettes have to be identifiable.  The
system for doing so must be easy, must not interfere with normal
work, and must be *rigorously enforced* -- _by_ _the_ _users_.

The trouble with most policies of this type is that these
considerations are not "designed in" from the beginning.  Trying to
make transitory computer materials fit an inventory system designed
for permanent fixtures, or forbidding the entry of disks into the
company, simply means that people will ignore the policies in favour
of greater productivity.  The specifics of recording and tracking
will have to vary with the corporate climate and culture.  If an
intent, and some relevant background, is presented to employees
(rather than a mandated procedure), the users will come up with a
solution ... and one that is far more effective than those imposed by
head office.

copyright Robert M. Slade, 1992   PRTCKL8.CVP   920403

=============
Vancouver                               | "Remember, by the
Institute for  Robert_Slade@sfu.ca      |  rules of the game, I
Research into  rslade@cue.bc.ca         |  *must* lie.  *Now* do
User           CyberStore Dpac 85301030 |  you believe me?"
Security       Canada V7K 2G6           |    Margaret Atwood
From: SYKLB@NASAGISS.GISS.NASA.GOV (Ken Bell)
Newsgroups: comp.virus
Subject: Re: The word 'Cascade' in my hardware ?? (PC)
Date: 9 Apr 92 20:38:26 GMT

>Date:    Tue, 07 Apr 92 04:56:06 +0000
>From:    alamma@craft.camp.clarkson.edu (Munir A. Alam)
>
>I just recently got Norton Utilties Version 6.0, while checking out all
>the new features, I noticed on System Info under the 'Hardware Interrupts'
>the following:
>
>Number   Address   Name                       Owner
> -----  ---------  -------------------------  ---------------
>
>IRQ 00  1934:003C  Timer Output 0             DOS System Area
>IRQ 01  1934:0045  Keyboard                   DOS System Area
>IRQ 02  F000:1F1A  [Cascade]                  BIOS
>IRQ 03  F000:1F1A  COM2                       BIOS
>
>Cascade ? Cascade the virus ?

No, Cascade, the interrupt line into which the 2nd 8259 programmable
interrupt controller on an AT-type PC feeds its output.  FWIW, that's
why a single 8259 (XT) yields 8 IRQs, and a pair of 8259s yields 15;
one (IRQ 02) is used up in connecting the two chips.

Ken Bell (SYKLB@NASAGISS * SYKLB@NASAGISS.GISS.NASA.GOV * 212-678-5545)
From: TYETISER@ssw02.ab.umd.edu (Tarkan Yetiser)
Newsgroups: comp.virus
Subject: VDS20T.ZIP - Superb anti-viral package /w integrity checker
Date: 4 Apr 92 23:38:22 GMT
Organization: Lehigh University

I have uploaded to WSMR-SIMTEL20.Army.Mil:

pd1:<msdos.trojan-pro>
VDS20T.ZIP      Superb anti-viral package /w integrity checker

Here is a brief announcement taken from the press release:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  New Anti-viral Package Featuring Real Intelligence, not Artificial

   VDS (Virus Detection System) 2.0 is an anti-viral package designed
to contain the spread of PC viruses by providing early detection and
quick recovery. What distinguishes VDS from many other products is
that its operation is based on analyzing viral behavior rather than
just looking for known byte sequences extracted from virus samples.
   VDS can catch the most evasive "stealth" viruses even when they are
active in memory.  A unique feature of VDS is its decoy launching
mechanism. The decoys are used to lure any viruses active in memory
and to capture them in a POV (Prisoner Of VDS) file for examination.
The centerpiece of the package (VDS.EXE) is an integrity checker for
hard drives.
   The package includes a special utility (VITALFIX.EXE) to recover
from most system infectors that target vital areas of hard and floppy
diskettes. Another program (VDSFSCAN.EXE) allows users to search DOS-
compatible (including network) drives for known viruses. Both programs
sport an easy-to-use menu-driven user interface with context-sensitive
help. The documentation is full of much EYE-OPENER information and is
a must-read for anyone looking for an anti-viral solution.

P.S.: VDS is not another trivial exercise in pattern-matching!

Regards,
Tarkan Yetiser
VDS Advanced Research Group
(410) 247-7117
e-mail: tyetiser@ssw02.ab.umd.edu
From: leo@hoss.unl.edu (Leo Chouinard)
Newsgroups: comp.virus
Subject: Virstop.exe version 2.03A locks my machine (PC)
Date: 9 Apr 92 18:23:38 GMT

I tried installing F-PROT 2.03A on my work machine yesterday.
Unfortunately, it refused to boot when I put virstop.exe in my
autoexec.bat.  Details:  I run a 486-25 clone (ISA bus) with a 64k
RAM cache, under MS-DOS 4.01.  Config.sys is:
     DEVICE=C:\util\CBLTRON\csipd_e.exe /H:5 /P:300
     stacks=16,256
     files= 30
     break=on
     buffers=20
     lastdrive=g
     device=c:\dos\himem.sys
     device=c:\dos\ansi.sys
     install=c:\dos\share.exe
     install=c:\dos\fastopen.exe c:=(50,25)
     device=c:\dos\ramdrive.sys 1536 /e
     device=c:\dos\windows\smartdrv.sys 256
     shell=c:\dos\command.com /e:1024 /p
Autoexec.bat was:
     @ECHO OFF
     VERIFY On
     PATH c:\batch;C:\DOS;C:\UTIL;C:\util\CUTCP
     set COMSPEC=c:\dos\command.com
     flip num off
     PROMPT $P$G
     VER
     PRINT /D:LPT1
     c:\util\mouse\mouse
     C:\util\CUTCP\NOVELL\IPXCPD
     C:\util\CUTCP\NOVELL\NET4
     c:\util\f-prot\virstop.exe
Tests seem to indicate the conflict is with NET4 - i.e., with either of
the last two lines deleted from the autoexec.bat, the system boots okay.

Almost forgot - I also booted from a clean diskette and ran F-PROT 2.03A
to scan the hard disk, and it reports no problem, so I am assuming that
NET4 is in fact clean.
- --
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
 These are my opinions.  Any similarities to the   |    Leo C.
 opinions of others are purely coincidental.       |    leo@hoss.unl.edu
From: alamma@craft.camp.clarkson.edu (Munir A. Alam)
Newsgroups: comp.virus
Subject: The word 'Cascade' in my hardware ?? (PC)
Date: 7 Apr 92 04:56:06 GMT

I just recently got Norton Utilties Version 6.0, while checking out all
the new features, I noticed on System Info under the 'Hardware Interrupts'
the following:

Number   Address   Name                       Owner
 -----  ---------  -------------------------  ---------------

IRQ 00  1934:003C  Timer Output 0             DOS System Area
IRQ 01  1934:0045  Keyboard                   DOS System Area
IRQ 02  F000:1F1A  [Cascade]                  BIOS
IRQ 03  F000:1F1A  COM2                       BIOS

Cascade ? Cascade the virus ?
This was on a 286, IBM PS/2 Model 30. I checked it out (With Norton 6) on
a friends 386. Same thing. So I scanned the memory for the text 'Cascade'.
Sure enough I found it, but thats about all it was....the word 'Cascade'....
just sitting in my memory. I booted up from a clean floppy. And it was still
there. I'm not worried, nothings wrong with my computer and I doubt
a simple virus like Cascade could be in my ROM, but it sure is intriqing.
I also checked it out with Norton 5.0 and PCTools but it failed to show it.
Is this some Norton 6.0 thing ? Any info on this would be appreciated.
Thanks.........

- -Munir
alamma@logic.camp.clarkson.edu
From: rossiter_p@kosmos.wcc.govt.nz (Pat Rossiter)
Newsgroups: comp.virus
Subject: NETSCAN 89B and NET$OBJ.SYS (PC)
Date: 11 Apr 92 01:53:09 GMT

I have just loaded and tested McAfee Version 89b on my Novell 3.11
network.  In testing NETSCAN, I found that it reported a file in use
during open operation - NET$OBJ.SYS - and gave only the options
abort and retry.  This was consistent on all servers.  Retry of course
still failed, and abort simply ended the scan.

It is my understanding that NET$OBJ.SYS is open at all times that the
network is running (I may certainly be incorrect on this, I'm no expert).
If this is so, then NETSCAN will be of no use whatsoever on SYS disks.

Is anyone aware of a way around this problem, or can anyone detail how
NET$OBJ.SYS can be closed while the network remains up.

Many thanks, Pat
From: tww40334@uxa.cso.uiuc.edu (Harvey Smith )
Newsgroups: comp.virus
Subject: mystery TSR ... (PC)
Date: 11 Apr 92 01:45:23 GMT

I have a program that reports the use of TSR's etc.. and it reports
that there is some sort of program running at segment 0DFD, takes up
4.3 KB's of memory, and uses int's 22 2e and 2f.  This "mysterious"
program is always present, even if I boot up without config.sys +
autoexec.bat

My question is ... Is this normal and if not, what can I do??

McAfee scan show's nothing .....

Tom Wentworth
mack-daddy@uiuc.edu
From: linc@tongue1.Berkeley.EDU (Linc Madison)
Newsgroups: comp.virus
Subject: Re: Computer Hazzard Symbol
Date: 8 Apr 92 07:06:54 GMT

C_PUFFER@unhh.unh.edu (Charles Puffer) writes:
>I have been thinking about the a computer hazzard symbol for some time
>now and would like to suggest somthing like this.

Personally, I like the standard "biohazard" symbol (a vertical line
and two lines at 120-degree angles, each splitting into two curved
lines) as a symbol for computer viruses.  The meaning is reasonably
unambiguous -- there is very likely not any literal biohazard
associated with a computer diskette.

- -- Linc Madison  ==  Linc@Tongue1.Berkeley.EDU
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: McAfee Associates Moving to New Address (PC)
Date: 6 Apr 92 07:21:27 GMT
Organization: Lehigh University


						April 6, 1992

WE'VE MOVED!  McAfee Associates has relocated their headquarters.
Our new address is:

          McAfee Associates
          3350 Scott Boulevard, Building 14
          Santa Clara, California
          95054-3107  USA

Along with the move, we have installed a new telephone system,
reorganized the Customer Support and Technical Support groups,
and upgraded our BBS to serve you better.


Additionally, all sixteen BBS lines have been upgraded to US Robotics
Courier HST Dual Standard modems with HST, v.32, v.32bis, v.42bis,
LAP/M, and MNP 1-5 error correction protocols running at 14,400bps.

We plan to double the number of lines shortly to 32.

Regards,

Aryeh Goretsky
McAfee Associates Technical Support

- --
- - - -
McAfee Associates        | Voice (408) 988-3832 | mcafee@netcom.com  (business)
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | ObQuote: "Log... from Blammo"
Santa Clara, California  |                      |
95054-3107  USA          | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
ViruScan/CleanUp/VShield | USR Courier DS 14.4Kb| or GO VIRUSFORUM
From: PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics)
Newsgroups: comp.virus
Subject: Re: Virus surving format (PC)
Date: 10 Apr 92 02:10:00 GMT

michael.blackwell@f820.n680.z3.fido.zeta.org.au (Michael Blackwell) writes:
> In a recent arcticle [New Scientist no.1813 p48] the author stated
> "...some viruses may transfer from floppy to hard disk DURING
> FORMATTING" {caps mine}.
>
> As far as my little knowledge tells me, this cannot be. I have yet to
> find a virus description that aludes to this. I suppose theoretically
> it is possible, but so is walking through walls. Has anybody heard of
> such a virus?

1. Viruses transferred as part of the formating process are very much
possible. Although they would not be inserted during the BIOS
formatting of the diskette, the DOS format command does a lot more
than that, including writing to the disk(ette) a boot sector and
reading what it wrote.  Any sensible virus already in memory would be
able to infect at the time the boot sector was written & verified
(boot sector infectors) and when/if the invisible files and
command.com was written (okay, only *some* file infectors bother with
these). So reformatting your disk (of doubtful value, in my opinion at
the best of times) is useless if your computer is already infected
while you do the format!

2. Slightly off the subject, but interesting anyway, it IS POSSIBLE
for viruses to survive the format process.  If they were already on a
360Kb diskette's boot sector that is formatted on a 1.2Mb drive to
360Kb again there is a slight chance of the original tracks being
readable on other 360Kb drives, and if the MBR of a hard disk is
infected the normal DOS formatting of partitions probably won't affect
it. We're talking about quite a few more cases than walking through
walls occurrances, here.
From: kondor@ee.ualberta.ca (Ran Kondor)
Newsgroups: comp.virus
Subject: Is this a virus? (PC)
Date: 4 Apr 92 03:51:51 GMT
Organization: Lehigh University

I have found a possible problem with my computer.  Sometimes my GMOUSE
pointer on MS Windows 3.0 seems to be a little lethargic.  It just
doesn't want to move (no other processes are running).  Is this a
possible virus problem?  FPROT 2.02 does not seem to think so.  It
could also be my mouse, although it is relatively new and I have
cleaned it just to make sure.
- --
/********************************************\
*  Ran Kondor                                *
*  University of Alberta                     *
*  Edmonton, Alberta, Canada                 *
From: GS6206@ALBNYVM1.BITNET (gene shackman)
Newsgroups: comp.virus
Subject: netscan and net$obj.sys (PC)
Date: 12 Apr 92 18:09:51 GMT


  Pat Rossiter wrote about using netscan on a novell network, and
having a problem with net$obj.sys.  Netscan stopped at this open file.
  We had a similar problem with net$val.sys.  We ran netscan with the
/unattend option, which seemed to work.  This was using netscan 86b,
so I can't say for sure that it will work on the new version, but give
it a try.

   Gene Shackman
   Network Supervisor
   Department of Sociology
   Suny at Albany
   gs6206@albnyvm1
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: virus classification? (PC)
Date: 9 Apr 92 07:24:20 GMT

In Message 1 Apr 92 20:28:38 GMT,
  rsr@garnet.berkeley.edu (Roger Rosenblum) writes:

>Are viruses that use the Mutating Engine classified as "stealth"
>viruses or as "polymorphic" viruses?  Or either?

They are always polymorphic - in fact, the only thing the MtE does is
to add polymorphic ability to a virus.

It may or may not be stealth - Pogue, Dedicated and Fear are not, but
somebody could add the engine to a "stealth" virus...

- -frisk
From: 0004886415@mcimail.com (Joe Wells)
Newsgroups: comp.virus
Subject: Polymorphic List (PC)
Date: 9 Apr 92 03:09:00 GMT

The subject of Polymorphic viruses seems to be poping up here and there. So
here is a list of the current viruses of this ilk:


POLYMORPHIC VIRUS LIST
======================================================================
Ones I have replicated out multiple samples of:

1260 (V2P1)
Casper
DM-330
Flip
Flip-Prism
Haifa
Invol
Maltese Amoeba
Marauder
Moctzuma
Moctzuma-B
MTE-Dedicated
MTE-Fear
PC-Flu 2
Phoenix-1226
Phoenix-1302 (Proud)
Phoenix-1701 (Evil)
Phoenix-1704 (Phoenix)
Phoenix-2000
Pogue (MTE-Pogue)
Russian Mutant (914)
SBC-1024
Simulation
Suomi (1008)
Telecom	1 (Kamp-3700)
Telecom 2 (Kamp-3784, Holo)
Tequila
Whale
Wordswap 1485
Wordswap 1504
V2P2
V2P6 (V2P6Z & Adolph)
Virus 101

Ontario is slightly polymorphic, it toggles one bit is all.
USSR-1594 only alters one byte.

Starship won't replicate for me. But I have several infections.
Wordswap 1385 & 1391 also don't like my machines.

Joe

======================================================================
Joseph Wells - Virus Specialist	- Certus International - (216)546-1500
Novi Development Team Leader - 0004886415@mcimail.com - CIS 70750,3457
======================================================================
      I may speak English but Assembler is my native tongue.
======================================================================
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: polymorph virus questions (PC)
Date: 9 Apr 92 20:23:03 GMT

frisk@complex.is (Fridrik Skulason) writes:

> >First, it is "polymorphic", not "polymorph". Second, it doesn't need
> >to be self-encrypting (although all of the current ones are).

> Uh, how could you get polymorphism without self-encryption - moving
> blocks around, maybe, but that might also qualify as a primitive
> encryption...

> Or were you thinking of something else ?

Yes, I was thinking about swapping around blocks of code... Tiny
blocks of code... Blocks, consisting of two intructions only: the
actual instruction and a JMP to the next one. This is not encryption,
since all instructions are there in plain text; they are just
permutated. However, this is much more difficult to achive than using
a simple variable encryption, so it is quite unprobable that somebody
will implement this. It is only a theoretical possibility.

> Of course, one program that is (usually) effective against polymorphic
> viruses (at least the self-encrypting ones) is heuristic analysis :-)

The keyword here is "usually". In fact, even a known virus scanner is
"usually" effective against polymorphic viruses... The problem is that
- -some- of them are -sometimes- missed... As to the heuristic analyser,
it doesn't seem too difficult for me to develop an encrypted virus
which is not detected by the heuristic rules, especially if those
rules are known.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: nils@f109f.mil.se (Nils Hammar)
Newsgroups: comp.virus
Subject: Virus protection in general
Date: 6 Apr 92 07:47:11 GMT
Organization: Lehigh University

One thing that I think stops viruses very efficiently is to use
electrically write-protectable hard disks for the programs, and
regular writeable harddisks for the data and memory swapping. This
will probably be the best way to limit the virus attacks on the hard
disks. The write protection is usually occuring on floppy disks, but
there are a few hard disks that allows it too.  Most minicomputer
disks do it, and a few removable PC disks like the Passport plus
removable media. If we all try to tell the hard disk manufacturers
that we want a write protection option on the hard disks, I think that
they will let us have it as an add-on feature.  This option will be
very welcome at some sites, especially military ones.

- --
nils@f109f.mil.se    4341@msg.abc.se    Nils_Hammar@f90.n204.z2.fidonet.org
+------------------------------------------------------------------------+
!  If builders built buildings the way programmers wrote programs,       !
!  then the first woodpecker that came along would destroy civilization. !
From: vail@tegra.com (Johnathan Vail)
Newsgroups: comp.virus
Subject: Re: virus classification? (PC)
Date: 3 Apr 92 16:34:06 GMT
Organization: Lehigh University

rsr@garnet.berkeley.edu (Roger Rosenblum) writes:

   Are viruses that use the Mutating Engine classified as "stealth"
   viruses or as "polymorphic" viruses?  Or either?

I would think polymorhpic.  The ME changes its form while stealth
usually implies hiding its existance.

jv
 _____
|     | Johnathan Vail     vail@tegra.com     (508) 663-7435
|Tegra| jv@n1dxg.ampr.org    N1DXG@448.625-(WorldNet)
 -----  MEMBER: League for Programming Freedom (league@prep.ai.mit.edu)