HDTenEightyP/NetNews huggingface dataset:
From: tck@bend.ucsd.edu (Kevin Marcus)
Newsgroups: comp.virus
Subject: Re: SCAN 95b doesn't find MtE in EXE files (PC)
Date: 11 Nov 92 00:50:53 GMT

frisk@complex.is (Fridrik Skulason) writes:
>Stefano_Turci@f0.n462.z9.virnet.bad.se (Stefano Turci) writes:
>
>>Well, I converted the files from COM to EXE, and made some scanning
>>tests with the mentioned programs.
>
>>The results were a bit strange, in fact:
>
>>    F-prot 2.05
>>    Scan 97
>>    VirX 2.4
>
>>missed *ALL* the converted files, while
>
>Not surprising - what you did was simply to add a new layer of
>encryption to the files.  Of course, the virus could be distributed in
>this form, and would probably replicate, but all the second (and
>later) generation copies would be detected normally.
>
>I am not at all surprised that my scanner, as well as the others
>missed the virus - actually, no matter how you had encrypted it, it
>probably would be missed.
>
>>converted files are still able to propagate the virus, so I think the
>>authors of the "missing-in- action" programs should improve their a-v
>>packages. 8-)
>
>In my case the reson I miss this particular sample is simple.  I scan
>inside LZEXE-compressed files, but only for signatures - that is, I
>uncompress the virus in memory, and run my scanning engine over it.
>If I uncompressed to disk, and stripped off the COM/EXE conversion, I
>would detect it, but it would slow the scanner down considerably.
>
>I don't consider it a serious problem - basically it is equivalent to
>distributing an old virus, with a new encryption wrapper...the
>original sample will not be found, but all the second generation
>copies will.

Frisk, that is a very serious problem.  It's quite analogous to the
reason why 100% detection of MtE based .COM infectors is necessary.
It can continuously reinstate infection of a computer (or network),
and if the virus does damage slowly, it can be disastrous.
From: ames@bcstec.ca.boeing.com (Wes Ames)
Newsgroups: comp.virus
Subject: Re: Filler virus - Need Help! (PC)
Date: 12 Nov 92 00:28:20 GMT

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
> It is much more
> probable that you are using some other anti-virus software, like CPAV
> or TNTVIRUS, that does not encrypt its scan strings and is causing a
> false positive. If you are using CPAV, read the manual - it clearly
> says that it is not compatible with any other anti-virus software. So,
> throw away either CPAV or SCAN. If I were you, I would throw away
> CPAV...

I have seen several references similar to the above, and I would
appreciate some clarification.  I use several different anti-virus
packages in our "anti-virus toolkit", including CPAV.  My experience
has been that early versions of CPAV did indeed have a problem with
viral scan strings in memory, but the problem has been eliminated in
more recent versions.  Not only are the strings encrypted, but they
are specifically overwritten when the user exits the app.  That has
been my understanding of the current product - have you seen something
different??

Wes Ames                           |
ames@bcstec.ca.boeing.com          |
                                   |
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: FP-206A.ZIP - F-PROT 2.06a: Virus detection/removal software (PC)
Date: 7 Nov 92 20:52:58 GMT

I have uploaded to WSMR-SIMTEL20.Army.Mil:

pd1:<msdos.trojan-pro>
FP-206A.ZIP     F-PROT 2.06a: Virus detection/removal software

I don't know why this always happens....but right after I uploaded
F-PROT 2.06, I got a message about a problem, which forced me to
release 2.06a

The problem is as follows - if a single copy of the program is
installed on a network, it can only be used by one user at a time -
attempting to run the program while somebody else is running it will
generate a sharing violation.

I'm really sorry about the inconvenience....

frisk
- - -
Fridrik Skulason
frisk@complex.is
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Infection density (PC)
Date: 4 Nov 92 11:12:13 GMT

cjkuo@ccmail.norton.com (Jimmy Kuo) writes:

> This is probably as good a place as any to advance my own "infection
> rate" theory.  I would propose that a virus will spread only until it
> meets an anti-virus system.  Thus, it would be one exponential
> function chasing another, which would reduce to a linear effect.

Hmm, if I recall my calculus class correctly, two chasing exponential
functions result in a sinusoid with consecutive peaks in (in this
particular case) in virus spread and in usage of anti-virus software.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: duck@nuustak.csir.co.za (Paul Ducklin)
Newsgroups: comp.virus
Subject: Re: Information on ExeBug requested (PC).
Date: 5 Nov 92 10:00:54 GMT

Thus spake mybdav02@uctvax.uct.ac.za:
>Recently, I have had a run-in with the so-called ExeBug virus

I see you're posting from Cape Town -- not surprising that you've had
EXEbug, because it's rapidly becoming the most common virus in South
Africa. We've had reports of people buying new PC gear that came with
the virus already present, which would help to explain its prevalence
and rapid spread. If my memory serves me right, the virus appeared in
about April 1992, near Pretoria.

>I used CLEAN 97 A: [Swb] /nomem to remove the virus, and CLEAN 
>reported that it had removed the virus.  However, on
>rebooting (before any other programs were run), the partition table of
>the HDD was infected!

I assume the /nomem switch "turns off" the virus-in-memory check.  If
so, this is extremely silly. EXEbug's stealth is such that all writes
to the partition record while the virus is resident get deflected to
its hidden copy of the "real" partition record.  You can't remove
EXEbug with conventional techniques whilst it's resident. BOOT CLEAN
BEFORE GOING VIRUS HUNTING...

>In the article by BIT magazine, it was stated that the virus formatted
>an extra sector for itself, and copied the original boot sector there.
>I couldn't find this extra sector with Norton 6.01's DISKEDIT, so
>copied clean boot sectors from other disks to the infected disks.

Try Quaid's excellent Explorer, or Alan Solomon's PEEKA, if you wish
to look at weird sectors. On high-capacity discs, EXEbug formats an
extra track -- track 80 -- for its own use. Look for 80.0.1. On
low-cap discs, it's at 40.0.1. One serious flaw in the virus is that
it assumes that 720KB stiffies have 40 tracks (0..39), rather than 80,
and formats its "extra" track at 40.0, obliterating anything that was
there before!

DISKEDIT is a "clever" program, which knows the geometry of specific
mdeia. When you ask it to read a particular physical sector, it pops
up an input form asking you to enter the track, head and sector you
wish to look at -- and helpfully performs validation on your input.
So, you can't ask to look at track 40 of a 360KB disc-- DISKEDIT is
"intelligent" enough to know that your "40" is erroneous!
- -- 
- --..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--..--
Paul Ducklin                                       duck@nuustak.csir.co.za

  CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa
From: gator.rn.com!sara@homebase.vistachrome.com (Sara Gordon)
Newsgroups: comp.virus
Subject: evaluation services
Date: 11 Nov 92 17:31:08 GMT

i am looking for information regarding anti-virus product evaluation
services.  specifically: what services are available; what are their
costs, what is included, what are the strengths and weaknesses of
each one; what have you found to be the accuracy/efficiency of the
one(s) you are familiar with.

if you have used such an evaluation service, please e-mail me
to the sara@gator.rn.com.     i am talking about specific evaulation
services, not 'test results' such as posted in this newsgroup.

if you offer such a service, please also e-mail me.


thank you.


- -- 
- ----------------------------------------------------------------------

Talk to me about computer viruses.        sara@gator.rn.com  
                                          SGordon@Dockmaster.ncsc.mil
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Checking high memory with VSCAN (PC)
Date: 2 Nov 92 13:55:37 GMT

ianst@qdpii.comp.qdpi.oz.au (Ian Staples) writes:

> Hmmm... does this imply that once we all have OS/2 or whatever on 386s
> or better, and 32-bit applications addressing oceans of flat memory
> space then we will have to wait forever for SCAN or some other to scan
> the whole bloody lot when we boot up each morning?

I sincerely hope that no anti-virus program will be that stupid! Under
OS/2 in 32-bit mode, when your program (or a virus) wants to "address"
a memory chunk, it must first allocate it. And when it allocates it,
the OS nicely wipes it out. Therefore, there's virtually no hope to
"find" the virus in this way - the most you could do it to wipe it
out. But you cannot do even that, since memory allocated for one
process is protected from the other processes, so they cannot just
poke around...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: MtE ?? (PC)
Date: 2 Nov 92 14:34:43 GMT

hps@sdf.lonestar.org (Holt Sorenson) writes:

> MtE is the Mutation Encryption Engine developed by Dark Avenger. It
> changes filesizes, checksum, and other info that would make it
> possible to detect a virus in a file at runtime so that the virus can
> continue to hide on your computer. The latest version is .91b, unless
> DA has released a newer one.  You can get it from your favorite AV
> researcher that trusts you or off a virus bbs. I won't give you any
> such info (bbs's or copies of the software.) If you don't know
> assembly, it wouldn't help you much anyway.

Couldn't people get their facts right before posting? Anyway, here is
the correction:

1) Dark Avenger has indeed been involved heavily in the development
of the MtE, but according to some sources, this is not -entirely- his
product.

2) All the MtE does by itself is to take a piece of code, encrypt it
using a random key, generate a random decryptor, prepend the decryptor
to the code, and return a pointer to the area of memory that contains
the decryptor and the encrypted code. Nothing more. Not a virus per
se. Everything else has to be supplied by the virus writer. The
changes of the file sizes, checksums, and other info that you are
mentioning come from the virus, not from the MtE. It is perfectly
possible to write a stealth MtE-based virus, that will hide these
changes.

3) The latest available version of MtE is 0.90-beta. What has been
distributed as 0.91 and what many people blindly believe to be 0.91 is
just a bugfix in the random number generator (not in the MtE).

4) No self-respecting anti-virus researcher will distribute the MtE
package to anybody except other anti-virus researchers.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Filler virus - Need Help! (PC)
Date: 4 Nov 92 10:58:12 GMT

teasdale@ere.umontreal.ca (Teasdale Gilles) writes:

> I just find out that Filler virus has invaded my computer system. The
> Scan Test (SCAN 8.9V97 - McAfee) sometime detect it and other time it
> can't. Is there any other thing I can do to get rid of this damned
> virus...

This is a Hungarian boot sector virus that is not spread at all, so I
sincerely doubt that it has made it to Canada... It is much more
probable that you are using some other anti-virus software, like CPAV
or TNTVIRUS, that does not encrypt its scan strings and is causing a
false positive. If you are using CPAV, read the manual - it clearly
says that it is not compatible with any other anti-virus software. So,
throw away either CPAV or SCAN. If I were you, I would throw away
CPAV...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Is this a virus? (PC)
Date: 12 Nov 92 09:33:21 GMT

rknazik@x102a.harris-atd.com (knazik bob) writes:

> My 386 PC reports that I have 654360 conventional memory when I do a
> "chkdsk" or a "mem" (DOS 5.0).  This is 1024 short of the expected
> amount.  I seem to remember that there was a virus that caused this
> result, but VSCAN finds nothing wrong.  Does anyone know if this is a
> virus or just some weird hardware failure ?  Any help is appreciated.

This is in the FAQ. While there -are- viruses that reduce the memory
size by 1 Kb, they are not widespread, so it is rather unlikely that
you have a virus. Most resident viruses reduce the memory size by a
larger amount of bytes - usually at least 2 Kb.

Check your CMOS setup - maybe you have told it to allocate 1 Kb from
the top of memory for its data area. Are you using a SCSI controller?
Any kind of additional operating system, like Unix? Is MS-DOS loaded
high? With what kind of memory manager? All these reasons can cause
memory reduction...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: HAYES@urvax.urich.edu
Newsgroups: comp.virus
Subject: fp-206a.zip available (PC)
Date: 10 Nov 92 11:18:59 GMT

Hello.

Just to report the availability of Frisk's FP-206A from our site.
Enjoy, Claude.

- ----------
Site:       urvax.urich.edu,  [141.166.36.6]    (VAX/VMS using Multinet)
Directory:  [anonymous.msdos.antivirus]

FTP to urvax.urich.edu with username anonymous and your email address
as password.  You are in the [anonymous] directory when you connect.
cd msdos.antivirus, and remember to use binary mode for the zip files.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Claude Bersano-Hayes     HAYES @ URVAX                 (Vanilla BITNET)
University of Richmond   hayes@urvax.urich.edu     (Bitnet or Internet)
Richmond, VA  23173
From: RZOTTO@NYX.UNI-KONSTANZ.DE (Otto Stolz)
Newsgroups: comp.virus
Subject: Re: SCAN 95b doesn't find MtE in EXE files (PC)
Date: 11 Nov 92 10:53:29 GMT

Stefano_Turci@f0.n462.z9.virnet.bad.se (Stefano Turci) writes:
>  I run it on a high number of files infected with two Mte-based viruses
>  ( Dedicated and Pogue) and it is able to detect all of the infected
>  files, but how could I say if it will work for *EVERY* mutation and
>  for *EVERY* Mte-based virus ?
>  I think it's impossible.

On 04 Nov 92 11:27:52 +0000 Vesselin Bontchev
<bontchev@fbihh.informatik.uni-hamburg.de> said:
> You are right, it's impossible. That's why, our tests can only prove
> that a scanner is NOT able to detect the MtE-based viruses reliably.
> Otherwise we can only say that we have been unable to find an MtE
> replicant that the scanner does not detect.

Just to prevent a possible misunderstanding of Stefano's and
Vesselin's claim:

It is indeed impossible to tell it from tests alone, without
considering the program's internal algorithms.

However, it is probably possible (however difficult it may be) to
prove that an Mte detector is reliable: The proof would be based on
the following steps: 
1. Infer, from a sample of the MtE, the algorithm used to produce the
   various decryptors, and prove that the algorithm found and the MtE
   sample are indeed equivalent;
2. infer from that algorithm the set of all decryptors that can possibly
   be produced from the MtE (of course not as a huge list of detailed
   code sections, but rather as a comparably moderate list of possible
   features, or patterns), and prove that the set is indeed produced by
   the algorithm,
3. design an algorithm to detect all of these decryptors, reliably, and
   prove that it indeed does so.

Step 1, called reverse engineering, is routinely performed by many
virus researchers (though, maybe, without formal correctness proofs).

On step 3, read "A Discipline of Programming" by Edsger W. Dijkstra.
The basic idea of this book is to design a suitable proof first, then
write the program in accordance with that proof. This is recommended
reading for all would-be programmers!

Step 2 is probably the most difficult one, as it cannot rely on
established formal methods. Yet, it can probably be done -- as Rubik's
Cube, and many more seemingly intractable problems, have been solved,
eventually.

In principle (but not practically) it could even been done by an exhaust-
ive enumeration, as the set of all possibly produced code sections is
finite (There are two easy proofs for this finiteness. Outline proof 1:
The set of all starting states for the algorithm is finite, and the
algorithm is deterministic, hence it cannot produce more different
results than it has starting states. Outline proof 2: The length of the
produced code sections is limited by the size of the largest disk avail-
able, hence finite, hence the set of all possible code sections is the
power set of a finite set, which is still finite -- and the MtE will only
produce a small :-) subset of that power set.)

Best wishes,
                    Otto Stolz <RZOTTO@DKNKURZ1.Bitnet>
                               <RZOTTO@nyx.uni-konstanz.de>
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: SCAN 95b doesn't find MtE in EXE files (PC)
Date: 11 Nov 92 22:31:54 GMT

frisk@complex.is (Fridrik Skulason) writes:

> In my case the reson I miss this particular sample is simple.  I scan
> inside LZEXE-compressed files, but only for signatures - that is, I
> uncompress the virus in memory, and run my scanning engine over it.
> If I uncompressed to disk, and stripped off the COM/EXE conversion, I
> would detect it, but it would slow the scanner down considerably.

But why uncompressing it to disk? Can't you continue to do it in
memory? The scanner in Untouchable is able to scan inside multiply
compressed files (e.g., it can detect a virus that has been PKLITEd,
then LZEXEd, then ICEd, etc.), so it should be possible to do it...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Dangerous bug in CHKDSK that comes with MS-DOS 5.0 (PC)
Date: 2 Nov 92 18:11:33 GMT

Hello, everybody!

The following is part of a posting to one of the newsgoups. I am
submitting here the relevant part, which I believe to be of interest
to the readers of VIRUS-L/comp.virus.

Regards,
Vesselin

Subject: MSDOS 5.0 chkdsk WARNING!
Date: 30 Oct 92 19:12:47 GMT
From: john@attcan.UUCP (John Benfield)

[stuff deleted]

(This is NOT an official report from Microsoft or AT&T. It's just
 my own friendly posting to try to help)

Program: chkdsk
O/S    : MS-DOS 5.0

Symptoms: Users running chkdsk with the /f option have 256 copies
          of the FAT written onto their hard disk starting at the
          first copy of the FAT. The result being that all directory
          information and a significant amount of the data in the data 
          area are irrecoverably destroyed.

Affected users: Any users using 256 sector FAT's. 

How to tell if you're at risk: 

          Run chkdsk WITHOUT the '/f' option and check the 
          "Total allocation units on disk". If this number is
          more than 65280, you're at risk. DO NOT USE CHKDSK TO
          CORRECT ANY DISK PROBLEMS if this is the case. You'll
          trash your disk.

Solution: Call Microsoft and request the 5.00A upgrade. They know
          about the problem and they've fixed it. They've also done
	  some diddling with the following programs: (though I don't
          know what they did to them.)

	deloldos.exe	diskcomp.com	diskcopy.com
	doshelp.exe	dosshell.exe	dosswap.exe
	emm386.exe	expand.exe	format.com
	himem.sys	mirror.com	qbasic.exe
	recover.exe	setver.exe	undelete.exe
	xcopy.exe

Apparently, the only place that Microsoft posts information of
known bugs is on CompuServe in something they called the Microsoft
Knowledgebase. If there's anyone out there who regularly reads this
forum on CIS, maybe you'ld like to volunteer to cross-post to this
group? 

[stuff deleted]

- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: rknazik@x102a.harris-atd.com (knazik bob)
Newsgroups: comp.virus
Subject: Is this a virus? (PC)
Date: 5 Nov 92 17:20:41 GMT

My 386 PC reports that I have 654360 conventional memory when I do a
"chkdsk" or a "mem" (DOS 5.0).  This is 1024 short of the expected
amount.  I seem to remember that there was a virus that caused this
result, but VSCAN finds nothing wrong.  Does anyone know if this is a
virus or just some weird hardware failure ?  Any help is appreciated.
				thanks
				  Bob Knazik
			rknazik@x102a.ess.harris.com
From: P.E.Beaman@lut.ac.uk (Peter Beaman)
Newsgroups: comp.virus
Subject: Goblin virus (PC)
Date: 3 Nov 92 10:05:18 GMT

We have just located a Goblin Virus on a researcher's disc who has
come from Mexico.  I have used the latest version of Dr.Solomon's
Toolkit to erase the virsus but just wanted to know how wide spread
Goblin is and whether the disc I repaired should still be used, in
case any residual affects remain.


I look forward to hearing your views

Peter Beaman
Social Psychology Technician
LUT
UK
From: leduc@angelo.amd.com (Paul LeDuc)
Newsgroups: comp.virus
Subject: List of virus books and reviews
Date: 6 Nov 92 23:22:37 GMT

Any definite net viral book lists I do not know of.  However, there
are a few publications that I know of that are good sources of viral
information.  First, ACM has the SIGSAC SIG for Security and Audit
Control.  Second, there is a magazine called ISPN Information Security
Product News, that has virus related articles once in a while.  Third,
there is a software company based in the U.K. that puts out a
newsletter called Virus Watch that is helpful.  There are also quite a
number of good books on the subject as well:

A Pathology of Computer Viruses David Ferbrache

The Computer Virus Handbook David Levin

Worms, Trojans, and Viruses Computers Under Attack Peter Denning

Hope this helps...

And yes any sources you find would be of interest

Paul