HDTenEightyP/NetNews huggingface dataset:
From: wlhadley@mwunix.mitre.org (William L. Hadley)
Newsgroups: comp.virus
Subject: Re: Virus discovered in file from WUARCHIVE.WUSTL.EDU (PC)
Date: 27 Jul 92 22:10:54 GMT

system@SCFE.NWC.NAVY.MIL (System Manager) writes:

>Today I downloaded a file from WUARCHIVE.WUSTL.EDU (one of the
>mirroring ftp sites). Filename is
>/mirrors/garbo.uwasa.fi/screen/grabsc11.zip When I tried to ran
>GRABSCRN.COM from this zip file, Norton Antivirus TSR reported that
>the file is infected with Wonder-2 virus.  F-PROT did not report a
>virus.  I sent mail to the person who maintains garbo.uwasa.fi and
>received an answer that he is out of town till July 27. This means,
>the file will not be tested/removed from garbo until then.  Has anyone
>downloaded this file before ?  What happened ?

I downloaded this file, but was unable to find any infection in GRABSCRN.COM
or in the .EXE file (RAW2GIF.EXE).  I scanned it with NAV 2.0 and McAffee's
SCAN v93.  I then downloaded F-PROT 2.04a and VIRX 2.3 from WUARCHIVE and 
tried them...still couldn't find the virus.  From the information I have on
the Wonder (and Wonder-2) virus, it only infects .EXE files (that was why
I played with RAW2GIF.EXE).  I then tried to two executable files with NAV
resident in memory...it still didn't detect it.  Then I looked closely at
them with the Norton Utilities DISKEDIT program.  About the only similarity I
can find with these files and the WONDER virus is that they were both written
in Borland C++.

What version of NAV are you running?  Do you have any other TSRs loaded?
It could be that GRABSCRN combined with something else you have loaded in
memory may be causing a false alarm.  Hope this helps!
Bill Hadley

PS. I downloaded GRABSC11.ZIP from WUARCHIVE too...so I was playing with the
same file that you downloaded.
- --
      William L. Hadley            |     User Support Center Specialist 
      The MITRE Corporation        |       Internet: wlhadley@mitre.org
      7525 Colshire Drive, MS W130 |     UUCP: linus!mitre.org!wlhadley
      McLean, Virginia 22102-3481  | My opinions! Do you hear? MINE!!!!
From: matrix@valinor.mythical.com (JJ Kahrs)
Newsgroups: comp.virus
Subject: Re: Virus BBS List?
Date: 29 Jul 92 02:06:35 GMT

brianc@eskimo.celestial.com (Brian C) writes:

> Could someone please e-mail me a list of virus related bbs?

The problem with finding virus boards is that.... they don't want to
be found. Almost ALL are underground.... and they go to great pains
not to be found by the general public.
                   -JJ Kahrs
- -----
JJ Kahrs
Internet:  matrix@valinor.mythical.com     uucp:  uunet!valinor!matrix
- -----
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Virus discovered in file from WUARCHIVE.WUSTL.EDU (PC)
Date: 28 Jul 92 09:13:14 GMT

system@SCFE.NWC.NAVY.MIL (System Manager) writes:

>Today I downloaded a file from WUARCHIVE.WUSTL.EDU (one of the
>mirroring ftp sites). Filename is
>/mirrors/garbo.uwasa.fi/screen/grabsc11.zip When I tried to ran
>GRABSCRN.COM from this zip file, Norton Antivirus TSR reported that
>the file is infected with Wonder-2 virus.  F-PROT did not report a
>virus.

Ignore this - it is a false alarm.  In fact, ignore everything NAV
says about the Wonder virus.  The virus is written in C or Pascal, and
it seems they are just "detecting" a part of the run-time library.

- -frisk
From: OPA@psuvm.psu.edu (Behrend AArea)
Newsgroups: comp.virus
Subject: Bugsres-2 (PC)
Date: 22 Jul 92 14:38:09 GMT

Hi. I am a computer operator at Penn State Erie, and I have a
student's disk that I ran through F-Prot 2.04.  It detected a virus
named BUGSRES-2 JOKE PROGRAM.  Looking through the Virus information
section of F-Prot, I could not find a description of this virus.
F-Prot also did not disinfect it.  I was wondering if anyone had an
idea of this virus, as in what it does, how to disinfect, etc.
    Any e-mail responses to opa@psuvm.psu.edu will be greatly appreciated.

                 -Jeff Cooper
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: re: McAfee Products (PC)
Date: 22 Jul 92 00:16:17 GMT

James Roy (james.roy@synapse.isis.org) says:
> TO: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
>
> APP>        Lately, there has been a more disturbing trend to leave off
> APP>the explicit identification and identify whole families of viruses
> APP>simply as [GEN-P] (GENeric-Partition). Since IMHO it is important for
> APP>those cleaning up after infections to know what it is they are dealing
> APP>with once an infection has been identified, I sincerely hope that this
> APP>trend will not continue.
>
> McAfee was quoted in Australia recently as saying that he didn't
> recommend using virus cleaning utilities by anyone except those without
> back-ups.
>
> The reason he said this is that such cleaning utilities are not 100%
> effective and can damage code or leave it infected.  One is better to
> identify the infected files, wipe them and restore from back-up.  As
> for those who don't maintain effective back-ups, maybe there is a
> Santa Claus, Virginia.

Padgett doesn't mention cleaning utilities, by which I take you to mean
a 'disinfector'.  For a site with multiple PCs cleaning up is a much larger
operation, for example:
*   restoring function and data to the affected PC;
*   react to information about the effects & damage done by the -identified-
    virus, (eg does corrupt database files, ...);
*   determining and clearing up the spread to other PCs, all removable media,
    any PCs used for home-working;
*   documenting the incident for managers and insurance claims;
*   deciding on a level of police involvement, (eg reporting or requesting an
    investigation);
*   determining how the virus entered the site/company, tracing back/forewards
    to customers and suppliers who may be affected;
*   improve the enforcement of existing preventative measures or implement
    new ones.

Of course McAfee's views couldn't possibly be influenced by the fact that his
CLEAN program is shit, could it?  Skulason's FPROT and Solomon's A-V Toolkit
have reasonable disinfection, if required, and take care to disinfect viruses
that they know.

> Generic detection is the way to go if what we are talking about is the
> ability to detect --all-- viruses known and unknown.  This is the major
> weakness of scanners - they can't identify viruses they don't already
> know about.

Sure good generic detection (ie checking after booting from a clean floppy)
is great and will spot all viruses.  However this detection will only happen
- -after- the virus has changed your system, in some cases this could be too
late.  A number of known viruses with destructive effects simply use a random
number generator to selet their action, how lucky do you feel?  The sensible
response is to use scanning software as a first line of defence to pick up
known viruses, and an integrity checker as the second line.

Regards, Anthony Naggs

Internet:  amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
Janet:     amn@uk.ac.brighton.vms  (  cbs%uk.ac.brighton.vms::amn  )
    or     xa329@uk.ac.city        (  cbs%uk.ac.city::xa329        )
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: UK Computer Crime Unit
Date: 24 Jul 92 00:56:21 GMT

Over the last 3 months I've had reasonable access to the net and I
have been gradually collecting back issues of virus-l.  I just came
across some mention in December 1990 of the UK Computer Crime Unit.
As there appeared to be little follow up I thought you may like to
know the situation, (as I understand it).

First there is no "UK" unit, in London the Metropolitan Police ("New
Scotland Yard") has a CCU of four officers and a some clerks.  In the
various police districts there are officers who are trained to have
some familiarity with computers.  They will investigate reports, with
the assistance of technical people at the complaining company, other
experts or may refer (some politics in this one) to the CCU in London.

The CCU held a meeting in March 1991 of around 30 people,
opimistically called the National Computer Virus Strategy Group.  The
main result was the report forms mentioned below.  I hope that the CCU
workload will soon reduce, so that they will be able to arrange a
second meeting later this year.

Most incidents reported and investigated are computer assisted frauds
or cracking.  The CCU is not well equipped to investigate virus
incidents, and would call on experts, such as myself, to give
technical assistance.  The CCU has a scheme for reporting virus
incidents, if there is interest I'll post a copy of the forms to Ken
to make available for FTP.

The current purpose of the scheme is to gauge the number of incidents
& financial losses accruing.  This will allow a case can be made to
the appropriate government agencies, (the Home Office and the
Department of Trade & Industry), for funding to expand the CCU and
support it in properly investigating these incidents.  So if you want
to help them to do this you should report all UK virus incidents.

The CCU telephone number is 071 230 1176, virus related matters are
normally handled by Detective Constable Noel Bonczoszek.  Ye olde
postal method: Computer Crimes Unit (CCU), 2 Richbell Place, LONDON
WC1X 8CD

No they don't read VIRUS-L/comp.virus, basically because with such a
small staff and a high work load they don't have the time to browse
and pick out the useful/interesting bits.

I can forward email to the CCU, though this would be a strictly
unofficial arrangement.

DISCLAIMER: This message is not an official statement, and any inaccuracies
            or misrepresentation in this information is solely due to my
            fallibility and misunderstanding.

Regards, Anthony Naggs

Internet:  amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
Janet:     amn@uk.ac.brighton.vms  (  cbs%uk.ac.brighton.vms::amn  )
    or     xa329@uk.ac.city        (  cbs%uk.ac.city::xa329        )
From: storner@diku.dk (Henrik St|rner)
Newsgroups: comp.virus
Subject: Re: GIF viewer crashes system (was Re: an amazing problem...) (PC)
Date: 28 Jul 92 12:32:39 GMT

[after downloading a GIF viewer, the system crashed and now reports a
 'drive c write protected' when booting]

You are running Stacker, and this message DOES come from stacker. When
a system crashes, that has a Stacker drive mounted, some allocation
errors can occur on the Stacker drive. If these cannot be fixed
automatically when booting, Stacker write protects the drive that has
the error. Note that drive C in Your case is NOT the physical drive C,
but rather the drive that Stacker has compressed. Your physical C:
drive is called D:.

Solution: Run SCHECK to repair the Stacker drive, possibly also CHKDSK
/F.  Reboot, and You should be running fine.

- --
Henrik Storner (storner@diku.dk)
Dept. of Computer Science
Univ. of Copenhagen, Denmark.
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: McAfee Products (PC)
Date: 22 Jul 92 08:52:53 GMT

james.roy@synapse.isis.org (James Roy) writes:

>Generic detection is the way to go if what we are talking about is the
>ability to detect --all-- viruses known and unknown.  This is the major
>weakness of scanners - they can't identify viruses they don't already
>know about.

Well, if you define "scanner" as using only simple signature search,
this is correct - such a scanner will only detect viruses it knows or
variants of it.  However, some "scanners" now include the ability to
find non-specific virus-like code, and this approach does enable the
scanner to find around 90-95% of NEW viruses.

- -frisk
From: martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences)
Newsgroups: comp.virus
Subject: Re: WARNING - Virus Creation Laboratory (PC)
Date: 27 Jul 92 17:23:42 GMT

millernw@craft.camp.clarkson.edu (Neal Miller) writes:

>	Oh for crying out loud...  Just what we need...  A
>Virus-Construction Kit for beginners...  I hope that McAfee gets their
>hands on this package ASAP, if not sooner.  Here's an idea...  Could

The package has already been forwarded to Frisk, McAfee, etc.
I will not send it to anyone else, so don't bother asking.  :)

>someone conceivably write a virus that will seek out and destroy such
>a V.C.L. based on unique strings within the program?  Just an idea...

Technically, yes.  Ethically, morally, no.  An idea, yes, a good one,
no.  A virus designed to destroy other viruses might easily become
more of a problem that the viruses it seeks to destroy.  Depending on
how one defines "virus", one might argue a case for "good" viruses,
but that debate doesn't include viruses designed to seek out and
destroy one another.  Playing "core wars" in real cyberspace is not a
good idea.  :)

Tim

 -------------------------------------------------------------
  Tim Martin                   *
  Spatial Information Systems  *   These opinions are my own:
  University of Alberta        *      My employer has none!
  martin@cs.ualberta.ca        *
 -------------------------------------------------------------
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Strange Identification with SCAN91 (PC)
Date: 29 Jul 92 08:11:42 GMT

g89r4255@hippo.ru.ac.za (Lt Sajid Rahim) writes:

>I find it very strange to see that SCAN identifies Saturday the
>14th virus as Armagedom. Having disassemble the code for both
>viruses, I find no particular relationship between the two.

True - there is no relationship whatsoever.  There are even some
fundamental differences, such as that Armageddon adds its code in
front of the files it infects, but Sat. 14th appends the code.

However, the viruses may nevertheless have a code piece in common,
which makes it possible to reduce the total number of search strings
by one.  After all, most users may not care which virus they have,
only if they have a virus or not - a job which SCAN performs very
well.

- -frisk
From: glratt@is.rice.edu (Glenn Forbes Larratt)
Newsgroups: comp.virus
Subject: GIF viewer crashes system (was Re: an amazing problem...) (PC)
Date: 23 Jul 92 05:09:01 GMT

sbb1@Ra.MsState.Edu (Shay B. Berthelson) writes:
>t7@elan.glassboro.edu (TEMP_7) writes:
>
>>i am in desperate need of help.
>
>>yesterday i downloaded a piece of software called NakedEye -- a p.d. gif 
>>viewer -- when i tried to run it, the screen blanked and the system crashed, 
>>but when i rebooted i got an error "drive c write protected" -- i am using 
>>dos 5.0 and as far as i know (and as far as my manual says) you cannot write 
>>protect a drive. although i am also running stacker and 4dos. 4dos does not 
>>have a write protect command. does stacker? how did this happen? i am having 
>>a hell of a time running applications now because of this persistant error. 
>>any help would be greatly appreciated....
>
>Do you have a virus scan program??? Really sounds to me like you got infected.
>Better get a scan/clean prog. and clean it up.  Most stuff can be fixed and 
>saved if it hasn't destroyed everything.

I agree that this sounds like malicious code at work, since t7's
assumption is correct that write-protecting a hard drive is not a part
of standard MS-DOS or (I think) 4DOS or Stacker.  This is especially
likely if you down- loaded from a BBS or from an INCOMING directory of
an ftp site.

Your best bet would be to take your inquiry to comp.virus: that forum
reaches some of the foremost experts in antiviral and other
anti-malicious code work.

Followups to comp.virus.

- -- 
===/| Glenn Forbes Larratt      |    CRC OCIS     | "Quid pro quo,   |/
==/| glratt@rice.edu (Internet) | Rice University | Clarice."       |/=
=/| GLRATT@RICEVM1 (Bitnet)     |=================|  - The Silence |/==
/| The Lab Ratt (not briggs :-) |  Neil  Talian?  |  of the Lambs |/===
From: WALKER@aedc-vax.af.mil (William Walker C60223 x4570)
Newsgroups: comp.virus
Subject: Re: Bugsres-2 (PC)
Date: 27 Jul 92 21:45:24 GMT

From:    Behrend AArea <OPA@psuvm.psu.edu>
> Hi. I am a computer operator at Penn State Erie, and I have a
> student's disk that I ran through F-Prot 2.04.  It detected a virus
> named BUGSRES-2 JOKE PROGRAM.  Looking through the Virus information
> section of F-Prot, I could not find a description of this virus.
> F-Prot also did not disinfect it.  I was wondering if anyone had an
> idea of this virus, as in what it does, how to disinfect, etc.

BUGRES.COM (or whatever it may have been renamed) is a "Resident
Screen-Eating Utility."  It loads TSR, and when activated (the version
I have is activated by ALT-B) a number of character-graphic "bugs"
wander about the screen and "eat" characters in their path, and
continue wandering about the screen until you press a key, which
restores the original screen.  It is essentially a cute screen saver.

>   Any e-mail responses to opa@psuvm.psu.edu will be greatly appreciated.

I'm sending this to VIRUS-L as well as opa@psuvm.psu.edu, since others 
may also be wondering about this.

Bill Walker ( WALKER@AEDC-VAX.AF.MIL ) |  "History is made at night.
OAO Corporation                        |   Character is what you are in
Arnold Engineering Development Center  |   the dark."
M.S. 120                               |        -- Lord John Whorfin,
Arnold Air Force Base, TN  37389-9998  |           "Buckaroo Banzai"
From: JFORD@ua1vm.bitnet (James Ford)
Newsgroups: comp.virus
Subject: New files on risc.ua.edu (PC)
Date: 29 Jul 92 15:33:40 GMT

The following files have been placed on risc.ua.edu in the directory
/pub/ibm-antivirus for anonymous FTP:

               tbscan40.zip - Thunderbyte Scan v4.0
               mteavr22.zip - Signature file for use with tbs* programs
                 i-m123.zip - Integrity Master v1.23a
               i-msetup.bat - Batch file to set up Integrity Master

- ----------
The number of a person's relatives is directly proportional to his fame.
- ----------
James Ford -  Consultant II, Seebeck Computer Center
              The University of Alabama (in Tuscaloosa, Alabama)
              jford@ua1vm.ua.edu, jford@seebeck.ua.edu
              Work (205)348-3968  fax (205)348-3993
From: 74656.557@CompuServe.COM (ESSMAN)
Newsgroups: comp.virus
Subject: WARNING - New Virus Analysis, NPOX (PC)
Date: 20 Jul 92 00:01:37 GMT

Preliminary Analysis of a New Virus -- Eric J. Essman
_____________________________________________________

Proposed Names:                 NPOX or 963

Place of Origin:                Unknown

Discovery:                      Ft. Lee, N.J. USA (Seen in the Wild)
				July, 1992

Type of Virus:                  COM (including COMMAND.COM) and EXE File
Infector

Memory Status:                  TSR taking 1024 bytes of conventional memory.
				Full Stealth

Text Strings:                   NPOX; Evil Genius V2.0
				R.S/NuKE C:\COMMAND.COM

File Size increase:             963 Bytes

Symptoms:                       COM and EXE growth by 963 bytes though not seen
				while virus is in memory; Decrease in conventio
nal
				memory; Programs may fail to execute. Cross-lin
ked
				files and overwritten sectors on hard disk.

CPU's Tested:                   8088, 286, 386SX, 386SLC, 386DX

DOS Versions Tested:            MS 3.3, MS 5.0, PC 3.3, PC 5.0

File Date and time:             Unchanged

Detection Method:               None

Removal Method:                 Delete infected files


For further information, contact Eric Essman at CIS 74656,557
					     or MCI 390-1560
From: perry@andre.utmb.edu (John A. Perry)
Newsgroups: comp.virus
Subject: New files on eugene and beach (PC)
Date: 17 Jul 92 14:26:51 GMT

Hello everyone!

	I apologize for the delay in posting these new files to eugene
and beach. You wouldn't believe how incredibly busy I have been
setting up a new system. Anyway the following files have been posted
to eugene.utmb.edu (129.109.9.21) and beach.utmb.edu (129.109.1.207).
If you have any questions, please send email to perry@eugene.utmb.edu.

asig9207.zip
clean93.zip
fp-204b.zip
mteavr22.zip
netscn93.zip
scan93.zip
tbscan40.zip
vshld93.zip
wscan93.zip

Additionally I have posted some new anti-viral files for the amiga on
eugene.

- --
John A. Perry - perry@andre.utmb.edu
From: D.Ivens@deakin.OZ.AU (David H. Ivens)
Newsgroups: comp.virus
Subject: VET as good as Viruscan? (PC)
Date: 17 Jul 92 01:55:28 GMT

I have evaluated VET anti-virus software (Australia) and it seems a very
good alternative to the expensive Viruscan.

Has anyone had problems with this software?

We do not get a lot of viruses and are considering a site licence for VET.

- --------------------------------------------------------------------------
David H.Ivens,                                            Ph. 61 52 272508
Computing & Communications Services,                      Fax 61 52 272010
Deakin University,
Geelong, Victoria, Australia   3217             email: davidi@deakin.OZ.AU
- --------------------------------------------------------------------------
From: system@SCFE.NWC.NAVY.MIL (System Manager)
Newsgroups: comp.virus
Subject: Virus discovered in file from WUARCHIVE.WUSTL.EDU (PC)
Date: 23 Jul 92 23:30:56 GMT

Today I downloaded a file from WUARCHIVE.WUSTL.EDU (one of the
mirroring ftp sites). Filename is
/mirrors/garbo.uwasa.fi/screen/grabsc11.zip When I tried to ran
GRABSCRN.COM from this zip file, Norton Antivirus TSR reported that
the file is infected with Wonder-2 virus.  F-PROT did not report a
virus.  I sent mail to the person who maintains garbo.uwasa.fi and
received an answer that he is out of town till July 27. This means,
the file will not be tested/removed from garbo until then.  Has anyone
downloaded this file before ?  What happened ?
 
*****************************************************************
*  Andrew Zaitsev,                                              *
*  Computer Lab Consultant, University of Missouri - St Louis   *
*  "This ain't working,                                         *
*   That's the way you do it-                                   *
*   Money for nothing,                                          *
*   Chicks for free!"                                           *
*               (Dire Straits)                                  *
*****************************************************************
From: C015FDH@UTARLG.UTA.EDU (DUSTIN FU)
Newsgroups: comp.virus
Subject: vshield 93b & netware 3.1 driver (PC)
Date: 17 Jul 92 13:38:03 GMT

Hello,

Has anyone experienced your PC locked up when you loaded Novell
network drivers after Vshield 93b stayed resident?

Dustin Fu
Academic Computing Services
U of TX at Arlington