HDTenEightyP/NetNews huggingface dataset:
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: CLEAN removing Jerusalem (Was: Re: Jerusalem (Israeli) Virus (PC))
Date: 14 Jan 93 18:17:09 GMT

Hello Vesselin,

You write:

>Due to the infection method that this virus employs, it destroys EXE
>files with internal overlay structure (e.g., WordPerfect). Such files
>will crash when executed. They will still crash after disinfection,
>although McAfee's Clean does not warn you about that. If you have an
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>outbreak of this virus, the best solution is to delete all infected
>files and to replace them with clean copies.

CLEAN-UP does have a limited ability to check a Jerusalem virus
infected file and warn the user that the virus can not safely be
removed.  It will then ask the user if he (or she) wants to
overwrite-and-delete the file instead.

Regards,

Aryeh Goretsky
McAfee Associates Technical Support

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Sale of Viri
Date: 14 Jan 93 17:16:05 GMT

alby@access.digex.com (Albatross) writes:

>      Is there any law in the USA the prohibits the Sale of Virus
>software to the Public? Or any type of distrubution of such software
>with the sole intent to create business revenew?

I'm no lawyer...just a techie :-)...but my answer would be
"Unfortunately no".  In fact, this has been done, well sort-of...just
consider the "little black book".

Maybe some day some enterprising soul will gather all the viruses
available on the various Vx BBSes - put them on a CD-ROM and offer
them for sale.

As things are now, I don't see any way to stop that - It is difficult
to write a law that would prohibit writing/selling viruses...and any
such law might be challenged as violating the first amendment (isn't
that the "free speech" thing ?)...It is much easier to make laws
prohibiting introducing viruses into somebody's comeputer system...but
still...

As I have said before - the lack of any action against virus writers
is the primary reason why viruses are a problem today.

- -frisk

Fridrik Skulason      Frisk Software International     phone: +354-1-694749
Author of F-PROT      E-mail: frisk@complex.is         fax:   +354-1-28801
From: ygoland@SEAS.UCLA.EDU (The Jester)
Newsgroups: comp.virus
Subject: Re: on the definition of virus
Date: 20 Jan 93 21:27:06 GMT

So I said:
> > So, in summary, I have yet to see anyone on this group who understood
> > exactly what Dr. Cohen was refering to disagree with his assertions.
> > What is being argued here is definitions and personally I think its a
> > bit ungentlemanly for Dr. Cohen to make his various statements without
> > cleary explaining that he is using the term virus in a form which the
> > average individual of some computer knowledge would not be familiar
> > with.
> 
So Dr. Cohen Said:
> I have clearly explained my definition hundreds of times - literally.
> I have published the definition in journals - and books - and on radio
> - - and on television - and in popular magazines - and over the networks
> of the world - over the last 9 years.  Perhaps the problem is that so
> many others don't bother to do the background work and then make
> statements as if they were experts.  They then propogate the incorrect
> memes and corrupt the `average' individual's perception.  Perhaps it
> is those people who are being `ungentlemanly', and not me.  A real
> expert bothers to get the facts before making assertions.
> 
Many people are familiar with your work and writings, myself
included. 

However, the very fact that there has been continual conflict on this
group from people who did NOT know your definition shows that
there are a lot of people out there who are not familiar with it.
The average user simply doesn't (nor should he) read virus papers
and such. So when you made your various assertions regarding the use
of viruses many people became confused and argued with you, not on
the merit of your concepts, but on what they perceived as a
definition problem. As such, it would only seem apropriate that
before you start a major thread on a subject which includes a
non-standard definition, that you perhaps explain it first. 

					Yaron (The Jester) Goland
From: eugene@kamis.msk.su (Eugene V. Kaspersky)
Newsgroups: comp.virus
Subject: Re: How do MtE viruses detect themselves? (PC)
Date: 18 Jan 93 18:47:00 GMT

Hello all,

Malte Eppert (2:240/535) writes:

> Can anybody tell me how MtE utilizing viruses detect themselves in an
> infected file?

The polymorphic viruses (including MtE based viruses) detects the
infected files at the same way as old not-polymorphic viruses. Several
of them set the specific date/time stamp of infected files and checks
it upon infection (for example, Vienna set 13th month or 62 seconds
and polymorphic Todor sets it to 22 seconds).

Other viruses set the fixed byte or word of infected file to the
specific value and check it (Pogue, Groove).

Several MtE viruses set the length of infected files to the value
which is divided by 10h. Uruguay viruses (not MtE but polymorphic)
infect the files so that the length of infected file is divided by 13h
(or 17h). Those viruses infects the files if the file length is not
divided by 10h (13h,17h).

Commander Bomber (not MtE but polymorphic) infects the COM-file twice,
but on executing infected program saves the memory image of the file
on disk and as result the one-time infection is present only.

Mutant viruses (not MtE but polymorphic) infect the files several
times, but these viruses pack the file upon infection and the length
of the infected file doesn't grow.

> Or do they reinfect the file each time they attack it, like old
> Jerusalem?

Those are 'good' viruses, but MtE (and polymorphic too) virus can be
very primitive and it can infect the files several times.

> Can't an algorithmic scanner use the method used by MtE itself to detect
> it?

Those methods are not enough to detect the virus, see above.

Best regards,

Eugene.

- -- 
- --  Eugene Kaspersky, KAMI Group, Moscow, Russia  
- --  eugene@kamis.msk.su, +7 (095) 499-1500
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Monkey [Mon] and Multi-2 [M12] viruses (PC)
Date: 14 Jan 93 11:41:05 GMT

LIBBIE@pucc.PRINCETON.EDU (Libbie Counselman) writes:

> The first one discovered was the Monkey [Mon] virus.  It affects the
> File Allocation Table.  SCAN discovers it, but does not disinfect, but
> Norton Disk Doctor will recover the clean FAT.

> The second is known as Multi-2 [M12].  It has a predecessor called
> Multi [M-123], also not recognized by F-Prot.  This one infects .COM
> files, .EXE files, overlays and becomes memory resident.  CLEAN
> apparently disinfects it.

Sigh... Yet another identification problem... SCAN 99 does not report
as [Mon] or [M12] anything from our virus collection, so obviously we
do not have these viruses. SCAN 99 reports as [M-123] the virus with
CARO name SD-123. This virus -is- detected by F-Prot 2.06a, so
obviously you mean a different one...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: MCKNIGHM%UNION.decnet@gar.union.edu (UNION::MCKNIGHM)
Newsgroups: comp.virus
Subject: NOINT Virus (PC)
Date: 20 Jan 93 14:21:09 GMT

Several of our lab machines have become infected with a virus that has
been identified as:
	NOINT (STONED)			F-PROT 2.05
	A new variant of STONED		F-PROT 2.06
	NOINT				CPAV (version that came with
					      PCTOOLS 8.0)

F-PROT, which is the college's primary virus protection program, does
not disinfect the virus; however, CPAV will.

Why is F-PROT able to detect but not disinfect NOINT and are there plans
for F-PROT to eventually handle the virus?

Thanks for any help.

Mary McKnight				Union College
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Wanted: info about Dos 5.0 virus (1578?) (PC)
Date: 15 Jan 93 06:34:02 GMT

lvandyke@balboa.eng.uci.edu (Lee Van Dyke) writes:

> I have just been informed of a virus in command.com (47,845 4-9-91) of
> Dos 5.0. Can anyone give me info on this?

Please, check you source of information, before spreading rumors like
that... We had enough of PKZ204C and definitively to not need the same
story repeated for DOS. Also, please read the FAQ, question F4, in
order to learn how to report suspected virus infections.

In your particular case:

1) Where do you have this information form? The local pirate BBS, an
unmoderated newsgroup, a friend, a newspaper, a computer magazine,
Microsoft's tech support?

2) What does the information say exactly? If it says nothing more that
COMMAND.COM in DOS 5.0 is rumored to contain a virus, then you can
safely ignore it. Rumors like that appear with every new DOS version.

3) What -facts- support the claim that there is a virus? Does any
scanner report it? Does it replicate?

4) Does your information source report a virus infection of a
particular site, of the system diskettes distributed by a particular
OEM vendor, of the diskettes distributed by Microsoft?

5) If there has been an official report about an infection from the
supplier, for which geographical area does it apply? The net
distributed your message all over the world.

6) At last, -which- DOS? MS-DOS, produced by Microsoft, or PC-DOS,
produced by IBM?

All in all, your message is either based on some local infection, or
(more likely) is just a rumor. Until it is confirmed (and I doubt that
it will ever be), just ignore it.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: pcb!amyleigh.clarke@batpad.lgb.ca.us
Newsgroups: comp.virus
Subject: Re: Known virus that tweaks PC date function? (PC)
Date: 15 Jan 93 14:01:00 GMT

AMN@vms.brighton.ac.uk(Anthony Naggs) writes:

   >student, <vpcsc11@sfsuvax1.sfsu.edu> asks:
   >In the office where I work, we recently purchased a 286 clone..  
   >Over the past few weeks, the computer's internal clock has been losing
   > days.  [...]
   >
   > Has anyone heard of a virus that would produce these symptoms?  If
   > not, does anyone have any other ideas about how to fix the problem?

AN>
AN>I don't remember any viruses like that, the only time I've seen
AN>anything similar was on a 'true blue' IBM AT which needed a new
AN>battery for the clock.  If you bought this new then contact your
AN>supplier saying you have a clock problem, if it's previously been 
AN>used then just replace the battery.

I know that a lot of AT class (286) clones had this problem - it was 
really prevalent if a machine was left on all the time.  Sometimes it 
would miss a midnight rollover. If memory serves me correctly, it was a 
problem in the BIOS.

- ---
 . WinQwk 2.0b#0 . Unregistered Evaluation Copy
                                                                               
                    
- ----
////////////////////////////////////////////////////////////////////////
/////// This article originated at The Batchelor Pad PCBoard BBS ///////
// Long Beach, CA ///// 1200-14,400 V.32bis+HST ///// +1 310 494 8084 //
////////////////////////////////////////////////////////////////////////
From: mdbois@hvlpx.ns-nl.att.com (Big Foot)
Newsgroups: comp.virus
Subject: Virus Calendar
Date: 15 Jan 93 05:39:05 GMT


    To all those experts out there,

       I'm  trying to  compile a  calendar,  specificing just those  virusses
    that hit on [a]  certain day[s], like Payday on every friday except 13th.
    I already have the list from VSUM.
    
    I think I have heard others on this list trying to do the same, but never
    heard  anything about a  completed (as far as that's  possible, with viri
    getting created in bunches .. :-( ) one.
    
    So, I would like al of you who gave up (?), or just have some information
    to e-mail me.  At the  moment, I'm  compiling month by month, and think I
    got next Februari covered ...
    
    Second, is there a way to scan the VIRUS-L backlogs.  Listserv@lehigh did
    not understand my mails (I got several ideas from HELPNET, but no way ..)
    I just wanted to find the ones containing "calendar" or something similar

[Moderator's note: Yes, there is a way to scan the backlogs.  All
postings to VIRUS-L/comp.virus, since day one, are archived on
cert.org in pub/virus-l/archives.  The old listserv@lehiibm1 no longer
has any VIRUS-L archives on it.]
    
    Third, a Dutch  magazine  mentioned the Hymn virus, which seems to hit on 
    the day with the same number as the month, so Jan. 1th, Feb. 2nd, etc ...
    VSUM and F-prot did not know about it ?!?

    aTdHvAaNnKcSe,

- -- 
       Marc du Bois                                  .--------_____  _/
       Systems & Network operator EDP-CC             |__o       __ ==
       AT&T Network System Netherlands bv.            `---\\----
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Vshield vs Virstop (PC)
Date: 15 Jan 93 06:23:44 GMT

ST29701@vm.cc.latech.edu writes:

> VSHIELD with the /CF option to check for a file validation information
> will not catch a file infecting virus like INTRUDER (very generic)
> untill after it has infected.  I would have hoped it could catch it
> while the infection was trying to occure.

Well, the /CF switch instructs VShield to use checksums of the
protected programs, stored in a separate file. This means that in this
particular case, VShield acts as a resident integrity checker. All
integrity checkers detect modifications, not viruses. Next, they can
detect the modifications only AFTER the modifications occur. Thus,
VShield with the /CF option will catch an unknown virus only after
this virus infects a protected file (i.e., causes a modification) and
you try to execute it (because VShield performs its checks on program
execution). There is no way an integrity checker can detect a virus
before any modification occurs...

Of course, it remains unanswered why the -scanner- component of
VShield does not detect the virus - at least SCAN 99 -is- able to
detect Intruder (although it reports it as two viruses - Sick [Sck]
and Intrud-B [Intr])...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: ingar@cee.heriot-watt.ac.uk (Ingar F Pedersen)
Newsgroups: comp.virus
Subject: Here virus (PC)
Date: 20 Jan 93 10:00:41 GMT

Hi,

I've just scanned my HD with scan 99, and it reported that some of my
files are infected with the Here virus. Have anybody got any
information on this virus? The only thing I know is that it infects
com files.  What I would like to know is what it can do, how do I get
rid of it, is there a way to find out where it came from etc etc

Ingar

ingar@cee.hw.ac.uk
From: FRAHM@UCSU.COLORADO.EDU (Joel A. Frahm)
Newsgroups: comp.virus
Subject: Mr. BIOS (PC)
Date: 14 Jan 93 21:34:27 GMT


    I was recently called in to work on a new PC clone, and it had BIOS
from the Mr. BIOS corporation.  And if that wasn't weird enough, this BIOS 
contains some type of antivirus code, perhaps an MBR protector or something.
Does anyone out there in the real world know anything more about this BIOS 
and the ramifications of BIOS based AV software?

Thanks in advance,
     Joel A. Frahm, Joint Institute for Labratory Astrofizzics.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Measuring polymorphism
Date: 14 Jan 93 11:36:38 GMT

barnold@watson.ibm.com writes:

> - - Difficulty of analysis.  By this metric, the TPE is simpler than the
> Whale, and the Whale is simpler than the MtE.

I disagree with those of your arguments. It is a metric for armouring,
not for polymorphism. The other arguments were very interesting; I'll
think on them...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: lschumac@mainz-emh2.army.mil (Ludwig (Lu) Schumacher ->)
Newsgroups: comp.virus
Subject: FAR-TRIEVE w/ Stoned Virus (PC)
Date: 20 Jan 93 06:25:55 GMT

Version 4.1b (Upgrade) of FAR-TRIEVE was recently received directly
from CACI, INC-Federal, P.O. Box 3950, Merrifield, VA 22116-3950, on a
1.2M diskette infected with the Stoned virus.

The virus was reported by F-Prot 2.06a.

It should be noted that this is the second product from CACI with an
infection.  An update was received late last year with Micheangelo.

POC.  Lu Schumacher (lschumac@mainz-emh2.army.mil)
Xref: sparky comp.virus:4976 news.answers:5420
From: chess@watson.ibm.com (David M. Chess (863-6665))
Newsgroups: comp.virus
Subject: re: Math Models of Polymorphic Viruses
Date: 18 Jan 93 20:54:41 GMT

>From:    ygoland@edison.SEAS.UCLA.EDU (The Jester)

>The question is:Given functions VX() and VY(), can I determine if
>they are both members of the same tree?

Yes, you can: they are!  *8) Consider V0, where V0(V0,K) produces a
completely random string of bytes, using K (derived from the current
machine state, or whatever) as a key.  Any other VX and VY are in the
tree leading from V0 (in fact, they're both on the very first level of
the tree).  That's a limiting case, of course, and rather silly, in
that most of the offspring of V0 aren't V's at all in any useful
sense.  But clearly for any VX and VY you could write a V<X,Y> which
produced either VX or VY depending on the parity of K.  So again any
pair VX VY are in the same tree.

A related problem which doesn't have a trivial answer is something
like: given VX and VY, is VY anywhere in the tree leading down from
VX?  That is, is VY a descendant of VX?  For the VXs that are existing
viruses, answering this question is trivial.  It's interesting to
think about how hard the question can be (I mention this in passing in
the beginning of my "Virus Verification and Removal..." paper, which I
think is available on VIRUS-L).

In Hoffman's "Rogue Programs", there's a paper by Len Adleman called
"An Abstract Theory of Computer Viruses".  It contains what seems to
be a proof that it's possible to design a virus so that given one
instance of an infected object, it's not decidable whether or not
another object might be a descendant of it.  However, I don't
understand the proof; I'd love to hear from someone that does!  The
next proof in the paper softens the blow: it seems to be a proof that
you can come close enough, by deciding whether or not another object
is EITHER a descendant of the captured virus OR an element of the
"germ set" for the virus, where the "germs" of a virus are the set
(roughly) of droppers of the vius.

- - -- -
David M. Chess                    \      Nothing moves;
High Integrity Computing Lab      \         where would it go?
IBM Watson Research               \
From: S.M.Baines@sheffield.ac.uk
Newsgroups: comp.virus
Subject: windows virus (PC)
Date: 15 Jan 93 16:50:14 GMT

I am sorry to be a nuisance, but several users of Windows at Sheffield
appear to have been hit by a virus that isn't detected directly. Using
memory resident virus checkers only detect a write to a protected file
or disc, but not the name. Scanning the disc and memory also fails to
show up the 'virus'. It appears only to infect the Windows files, and
these fail to run. It has been caught trying to write to the kernel of
windows, and has also written to other windows programs. As this has
occured to 2 different users, not using the same computers, or
software to get the same fault within 2 days of each other seems very
odd. In both cases the only solution was to reinstall windows and all
other software (including non-windows software) and hope the problem
has gone away. The common link between the two was use of HENSA to
download software at terminals at the University of Sheffield. Has
this 'virus', if it is a virus, been reported before or is it just a
bug and an unhappy co-incidence?

Once again I appologise for disturbing you, but hope that someone can
shed some light on the problem, in the mean-time we are avoiding down-
loading files.

Stephen Baines
s.m.baines@howden.sheffield.ac.uk
From: smitch@geog.utoronto.ca (Scott Mitchell)
Newsgroups: comp.virus
Subject: msd - bug ? virus ? coincidence ? (PC)
Date: 20 Jan 93 17:26:11 GMT

Someone suggested that I use the msd.exe program that comes with
Windows 3.1 to diagnose some memory problems I've been having (or so
they predicted).  So I started up the program, and started looking at
the first info dialog it gave,l which was motherboard info, as I
recall.  Shortly after opening the dialog box, my hard disk started
whirring away at an alarming rate, for about 8-10 seconds.  Then it
stopped, and the speaker beeped a number of times, and my system
locked up.  Now whenever I try to reboot from the HD, it goes into an
endless cycle of resetting itself.  I can boot from floppy, but most
of the DOS commands are corrupted.  This floppy happens to be my PC
Tools recovery disk; when I run diskfix, there is a VERY long delay
while it tries to figure out my partition tables ( my secondary HD has
some linux partitions), and then it eventually locks up while trying
to figure out lost sectors, etc (at least, I got tired of waiting
after 10 minutes).  I borrowed Notron Disk doctor, but it didn't get
any further.

SO - are there any known bugs in the windows diagnostic program.  Has
anyone heard of a virus that fits this description ?  ( None of my
checking programs detect any viruses).  Or does it sound like an
unrelated problem that happened to crop up when running msd ?

Thanks in advance,   Scott

- -- 
Scott Mitchell

smitch@geog.utoronto.ca
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: DOS Viruses under HPFS (OS/2)
Date: 15 Jan 93 23:27:00 GMT

Quoting from Chris Antkow to All About DOS Viruses under HPFS (O on 
01-15-93

CA>  Being a virus researcher myself, I find it sometimes suicidal to tes
CA> out and disassemble new stealth and polymorphic class viruses on my
CA> DOS based PC. I'm deathly paranoid that it's going to escape on one o
CA> my floppies and infect the rest of my house... Even though I know my
CA> ASM a bit better than the average Joe, who knows what might happen.

When I test viruses, I configure my CMOS to deactivate the hard drive, 
then I cold boot the computer from a write protected bootable diskette. 
Re-activate the hard drive.

Later i hope to get a laptop for research purposes. You might want to 
think of a dedicated virus test machine yourself.
 
Bill

- ---
 * WinQwk 2.0 a#383 * Hacked version of AutoMenu. 4.8
                                                                               
Newsgroups: comp.programming