HDTenEightyP/NetNews huggingface dataset:
From: vaughan@computing-department.poly-south-west.ac.uk (Vaughan.Bell)
Newsgroups: comp.virus
Subject: C.H.A.D and Magic Mutation... (PC)
Date: 13 Nov 92 19:41:56 GMT

I've heard that there is a new virus writing group that has started by
the name of CHAD, standing for the Central Headquarters for Anonymous
Devistation does anyone know any more...  Also, does any one know
anything about Magic Mutation, I suppose it is a MtE clone/equivalent.

Any information would be greatly appreciated.

Thanks in advance...

}===--->	Vaughan Bell - vaughan@uk.ac.plym.sc    <---==={
}===--->       University of Plymouth - Drakes Circus   <---==={
}===--->       Babbage Building - Room 112 - Plymouth   <---==={
}===--->	      Devon - UNITED KINGDOM	        <---==={

}=->  "I got it!, I got it!, You're being intrepidatious!"  <-={
}===--->         Scuttle from The Little Mermaid        <---==={
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: F-Prot Bug (PC)
Date: 16 Nov 92 13:48:20 GMT

vxc15931@vax1.mankato.msus.edu writes:

> I just got version 2.06a of F-Prot but I think it is still buggy.
> When I check the Virus Information, the program quits whenever I
> selected information on the second virus I pick, exactly the second
> virus.  Otherwise the program works very well.

I was unable to reproduce your problem here. Could you please supply
more information? How much is the amount of free conventional memory
on your machine? Version 2.06 had one bug that caused it to do strange
things when there was not enough memory, but as far as I could test,
it has been fixed in 2.06a - this version checks the amount of free
memory and warns you if it is not enough...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Need some help disinfecting NOP virus (PC)
Date: 16 Nov 92 15:18:37 GMT

BERGERA@Citadel.edu (Andy Berger - IRM User Support 2-6996) writes:

> We are experiencing an outbreak of NOP viruses on our campus.  Does
> anyone have any recent experience with disinfecting this virus from
> floppies and hard drives?  How about any suggestions on doing this
> easily to a large population of several hundred users?  Are McAfee's
> SCAN, and M-disk the best utilities to do this?  Are there any others
> which work better?

All I know is that there is a boot sector infector which SCAN calls
like that. Unfortunately, SCAN is very unreliable in identifying
viruses exactly. On the top of that, I am unable to test it on boot
sector viruses, because I don't have them in live form - only as
binary dumps of the infected boot sectors.

So, I have no clue what the "NOP virus" actually is. Could you please
try to run F-Prot 2.06a on an infected diskette and tell me the
results?

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: MtE ?? (PC)
Date: 16 Nov 92 15:14:00 GMT

chess@watson.ibm.com (David M. Chess) writes:

> ? Not sure why you say that.  Any unencrypted instance of a virus that
> uses the MtE will contain the MtE itself in the file.  Just doing a
> thorough scan for a signature from the engine will then detect the
> infected file.  That's what we do, and it works.  (Of course, any
> brand-new virus can have some brand-new method of encryption, and
> therefore not be detected by a known-virus detector, but that's well
> known, and has nothing to do with the MtE itself.)

Yes, this is what Yisrael means. It is not possible to achieve 100%
detection of some unknown MtE-based viruses when they are in
unencrypted replicants. However, it is possible to achieve 100%
detection of all known MtE-based viruses in both encrypted and
unencrypted replicants.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: krvw@cert.org (Kenneth R. van Wyk)
Newsgroups: comp.virus
Subject: More Administrivia - a few last minute FAQ mods
Date: 18 Nov 92 14:22:42 GMT

VIRUS-L/comp.virus readers:

As you can see, I'm sending out a couple batches of informational
postings today.  The first contain several product reviews from Chris
McDonald and Rob Slade (thanks guys, as always!).  After those have
moved through the mail queues, I'll send out the new FAQ document.

An error was spotted in the FAQ that I put on the FTP archive
yesterday.  (I inadvertantly used a copy of the FAQ that was not the
most current.)  I fixed the problem, and have updated the archive on
cert.org as well as the info file on listserv@lehigh.edu.  The
time/date stamp on the new one is: 18 November 1992, 7:45 AM EST.  If
yours is older than that, please update.

Side note: while I'm sending out these digests, I'm also doing a mass
cleaning of the mailing list.  Since I get about 50 bounces per
digest, I'm trying to strip off the addresses that have been
consistently bouncing.  Alas, it's a losing battle.

Thanks,

Ken

Kenneth R. van Wyk
Moderator VIRUS-L/comp.virus
Technical Coordinator, Computer Emergency Response Team
Software Engineering Institute
Carnegie Mellon University
krvw@CERT.ORG       (work)
ken@THANG.PGH.PA.US (home)
(412) 268-7090  (CERT 24 hour hotline)
From: C.Bradford@cs.ucl.ac.uk
Newsgroups: comp.virus
Subject: Re: How good is Norton Antivirus? (PC)
Date: 17 Nov 92 15:47:41 GMT

My norton anti-virus is very old, but it does the job. Although it
keeps moaning about it's age.....oh well......ho...hum
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Comment on the MtE wars (PC)
Date: 16 Nov 92 13:28:04 GMT

tck@fold.ucsd.edu (Kevin Marcus) writes:

> One, as someone kindly pointed out at one time, I forgot where I saw
> it, but the MtE can only generate certain code.  It can't generate a
> variety of instructions, and any program which begins with these
> instructions cannot possibly be infected.

This is essentially what Frans Veldman says in the documentation of
TbScan, but it has to be understood correctly; not followed blindly.
First of all the problem for detecting reliably all MtE-based viruses
(or at least all replicants of the known MtE-based viruses) consists
of two separate and equally difficult problems:

1) Detect all files that contain the MtE-based virus as infected.

2) Do NOT detect any file that DOESN'T contain any MtE-based virus as
infected. In other words - avoid the false positives.

It is possible to do some statistical analysis to see what
instructions are usually present in the MtE-generated decryptor, but
you are running the risk to miss some infected samples. It is also
possible to raise an alert any time you see one of the possible
instructions in the decryptor that actually to the encryption - they
are not that many and the variety of addressing modes uses is also not
that great. But then, you are running the risk to cause a lot of false
positives... The really smart trick is to combine both ideas in a
sensible way and to detect all viruses without any false positives.
Currently very few scanners have achieved this.

> Two, the MtE always has certain markers.  For example, the end of the
> decrypting algorythm always ends with JNZ.

Yes, and it seems that all MtE detecting programs are using this. But
it is pretty slim as a clue; you need much more to achieve reliably
MtE detection...

> If you have a disasssembler, or even debug, you can spend a few hours
> and figure out how to take care of a variety of infections.

And you'll end up with yet another unreliable MtE detector... :-)

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: SCANV97 don't work in OS/2 dosbox (OS/2) (PC)
Date: 15 Nov 92 06:52:38 GMT

Hello Christer Olsson,

co@bildsun1.mednet.gu.se (Christer Olsson) writes:
>I'm trying to use scan version 97 in a DOS-box but OS/2 trows out the
>scan with an error message saying that SCAN uses illegal 386
>instructions.
[...deleted...]

SCAN V97 is known to generate an exception error when run with some
memory managers under DOS.  I have not had any reports of problems
running it in a VDM (DOS session) under OS/2 V2.  I would recommend
that you upgrade to the current version of SCAN, 97-B.  It can be
found in the Simtel20 archives or any of its mirror sites, or in the
pub/antivirus directory of the mcafee.com site (IP# 192.187.128.1) as
scanv97b.zip.

>The machine is a AST 486/E Premium at 33 Mhz with 10 Mb of memory and
>OS/2 2.01 beta.
           ^^^^
You may wish to considering installing the OS/2 V2.00 Service Pak.
The beta version is, well, a beta version.  Your IBM representative in
Sweden should be able to tell you about the availability of a
Swedish-language SP.

Regards,

Aryeh Goretsky
Technical Support

PS: SCAN 97-B with the /UNATTEND switch (required for Windows or OS/2
DOS sessions) runs great on my PC: 483-33 clone with OS/2 V2.00 with
Service Pak installed.

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences)
Newsgroups: comp.virus
Subject: Re: Is this a virus? (PC)
Date: 13 Nov 92 23:17:16 GMT

tck@bend.ucsd.edu (Kevin Marcus) writes:

>Well, it depends.  See, not ALL computers get 655360 bytes free.  For
>example, genuine IBM's are 1K under the 640K barrier.  It is possible
>you have an unknown virus, though I can't think of one which is 1K
>exactly; most MBR infectors take at least 2K.

Vesselin also mentioned that MBR infectors that only use 1k are 
rare, in his response to the same query.  This is a bit of a 
concern, given that another notice mentioned that the Monkey
virus is a problem at a location in Ottawa.

Most of the Empire family, including Monkey, take only 1k of
memory from the "top of memory".  While these viruses are 
rare, so far, worldwide, they are common in the Edmonton area,
and I have heard of reports in Ottawa, and several locations
in the USA. 

I have a request.  If anyone has seen any of the Empire variants
(including Monkey) anywhere outside Edmonton, or on Vx BBSs, please
send me a note.  I suspect some of these viruses will be common
pests worldwide, in the future.

Second request: Vesselin, Frisk, Dave Chess, others in the anti-virus
(research) business: have you had reports of Empire viruses being
seen outside Edmonton?

Thanks,
 
Tim.

 -------------------------------------------------------------
  Tim Martin                   *
  Spatial Information Systems  *   These opinions are my own:
  University of Alberta        *      My employer has none!
  martin@cs.ualberta.ca        *
 -------------------------------------------------------------
From: btwalker@eos.ncsu.edu (BRIAN THOMAS WALKER)
Newsgroups: comp.virus
Subject: Re: VCL? (PC)
Date: 13 Nov 92 20:35:50 GMT

question regarding legalites of VCL

    suppose someone were to make a working virus with VCL [unlikly but
possible] if this said virus spread and caused damage who would be
held responsible.
    VCL states that the author can't be held responsible and the
person who feed the specs in to VCL could say they didn't write it,
but would that stand up in court?

	-btwalker
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: How good is Norton Antivirus? (PC)
Date: 17 Nov 92 09:02:20 GMT

sbonds@jarthur.Claremont.EDU (007) writes:

>   + The ability to allow the user to add new scan strings, including the use
>     of wildcards.  (F-prot does this w/o wildcards.)

No - you can use wildcards - although it does not allow
variable-length wildcards. A "??" in the pattern stands for a single,
variable byte.

- -frisk
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: KEY Press virus & McAfee v97 (PC)
Date: 15 Nov 92 06:39:28 GMT

Hello Frisk,

you write:
[ a ">>" indicates I wrote it]
>>Well, they all are detected as viruses, which is a start.
>
>Nobody doubts that SCAN is one of the best packages for telling you if you
>have a virus at all (whether it, Alan's FINDVIRU or my own F-PROT does best
>in testing, depends of course primarily on whose collecion is used).  The
>point is, however, that SCAN is occasionally not very accurate in determining
>exactly which virus you have.

I understand that, believe me.  We will fix any such problems reported
to us.  However, we also have to look at new viruses as well as add
the occasional new feature.  Our programmers are also becoming
responsible for an increasing number of new programs, which further
limits the amount of time they have.  This means that they must
prioritize their work.  If a new virus is not detected by VIRUSCAN or
one of the existing options does not work correctly, then they are
going to be looked at first, before a virus which has a "double hit"
(i.e., two different viruses being reported in the file) on it.

That's not to say we're not going to fix it, all reported bugs are
fixed, eventually.  However, their severity, that is, their impact
upon the end user, has to be decided first.

[...portion about Cmdr. Bomber not being detected 100% deleted...]
>The problem with this one is that you don't really know where to look for it.
>It is not hard to detect by scanning the entire file, but that is really

SCAN should be doing that, which indicates (to me) a problem with
either the detection method, or the string being looked for.  Our
programmers will be looking into this one, shortly.

>time-consuming. It is a problem - and I think most scanners will have a hard
>time detecting it.

Regards,

Aryeh Goretsky
Technical Support
- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: CANSU info (PC)
Date: 16 Nov 92 22:38:59 GMT

Libbie Counselman writes:
>Has anyone on this list heard of the CANSU virus?  Many of the
>machines on our campus have been infected, and so far only one
>anti-viral program, (McAfee) has been found that can combat it.  Does
>anyone know of other anti-virals that will detect and/or disinfect it?

NAV 2.1 can detect and disinfect it.

Cansu has the ability to permute a small number of its instructions to
make itself look different.  (12 permutations).  Once in memory, it
has a consistent memory signature.

The strain of Cansu with which we are familiar does not damage
systems.  It only has the capability to display a large V on the
screen.  This large V accounts for its aliases as V-SIGN and BigV.

I guess we can add PA/NJ to the list.  Sigh.  Previously, it had only
been seen in Europe and Southern US.

Jimmy Kuo                                       cjkuo@ccmail.norton.com
Norton AntiVirus Research
From: webbew@aron01.gs.com (William Webber)
Newsgroups: comp.virus
Subject: Monkey Virus (PC)
Date: 17 Nov 92 13:16:51 GMT

Copy of Monkey virus found: UK London (JMP 01D0).

Reguards
 
        William Webber...
From: MOPURC01@ULKYVM.LOUISVILLE.EDU (Michael Purcell)
Newsgroups: comp.virus
Subject: Virus Identity? (PC)
Date: 17 Nov 92 01:07:22 GMT

Cataloging Manager, Kornhauser Library
(502) 588-5767

  A local user believes he had a virus. I am waiting for more
information from him, but I was wondering if anyone could identify the
problem or the virus from the following limited information:

  "There seems to be a new virus on the market right now, and it does
only one thing.. It scramble both FATs and writes them to disk.. So
when you comeback to copy or read or pull a file from that floppy, you
get the ARIF error {Abort, Retry, Ignore, Fail}.. If you have it, you
will find that even a low level format will not clear the problem.
Nortons is about the same, with the virus. Both are useless. The
survival of a perfectly good disk depends on unmarking the 0 sector.
The virus apparently marks this sector bad on the disk and you must
then remove it. Nortons disktool will not even read the disk. It just
throws a low level format screen up. The only way is to go manual or
toss the disk."

  None of the locally prominent viruses resemble this vague
description.  Does anyone have any idea what problem (virus or not)
could scramble both copies of the FAT and mark the first sector of a
floppy as bad?

 Michael Purcell, Cataloging Manager
 Kornhauser Health Sciences Library, University of Louisville
 MOPURC01@ulkyvm.louisville.edu / MOPURC01@ULKYVM.Bitnet / FAX:(502)588-8527
From: cz1jed@orac.sunderland-poly.ac.uk (J.EDWARDS)
Newsgroups: comp.virus
Subject: F-Prot's (v2.05) memory scanning. (PC)
Date: 13 Nov 92 19:44:40 GMT

After hours of failing to get Windows to install, the owner suddenly
announced he thought his computer might be infected.  I ran F-Prot
straight away and sure enough it announced it had detected 'Stoned' in
memory.  I booted from my clean floppy and when running F-Prot again
it claimed the hard-disk was infected with not 'Stoned' but
'Michaelangelo'.  I assumed the disk must be infected with both but
let F-Prot clean 'Michaelangelo' anyway, expecting the boot sector to
now become infected with 'Stoned'.  (That would be right, wouldn't
it?)  However after this cleaning, and clean booting again, F-Prot
declared the disk clean.

Q's 1) Could his hard disk still infected with 'Stoned' and/or
          'Michaelangelo' and F-Prot can't detect either for some
          reason?

   or 2) Was F-Prot's detection of 'Stoned' in memory actually a
          mis-identification of 'Michaelangelo'?

Jonathan Edwards - MSc. Scientific Computing
                   University of Sunderland - England
From: S12609@prime-a.plymouth.ac.uk (Trantor The Last Stormtrooper)
Newsgroups: comp.virus
Subject: Atari ST Viruses! (Atari ST)
Date: 16 Nov 92 16:13:52 GMT

Does anybody out there who reads VIRUS-L know anything at all about
Atari ST viruses or are you all just PC Virus people????

Glenn Edwards, University Of Plymouth
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: SCAN 95b doesn't find MtE in EXE files (PC)
Date: 16 Nov 92 15:43:22 GMT

tck@bend.ucsd.edu (Kevin Marcus) writes:

> Frisk, that is a very serious problem.  It's quite analogous to the
> reason why 100% detection of MtE based .COM infectors is necessary.

Not quite. It is analogous to the problem for detecting viruses in
self-compressed files. My own opinion is that instead of forcing
everybody's scanner to be able to handle all the dozen
self-compressors available, it would be much better to have the
scanner only warn you about the compression and have a separate
program that can strip the compression off.

However, I agree that if somebody's scanner claims to be able to scan
inside compressed executables, it should be able to do so any find all
viruses that it normally can find in uncompressed files.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: Re: How good is Norton Antivirus? (PC)
Date: 14 Nov 92 10:19:18 GMT

Lars J|dal writes:
>How does Norton Antivirus compare to other virus programs, such as
>F-prot and Vscan, apart from that Norton is commercial? Norton is
>almost never mentioned here. Is that because it is commercial or
>because the other programs are better?

As most of my time and those of my staff are usurped by responding to
customers' letters and issues which have filtered through our Tech
Support and Corporate Support personnel, I would venture a guess that
Symantec's customers, instead of asking in a forum that is a voluntary
exchange of information, pick up the phone and/or use another medium
that requires a response.

What this may point out is that the purchase of NAV does not simply
get you a program, it buys you the aid of all the technical staff at
the Peter Norton Group.  My staff and I are ready to resolve any
incidents or simply help educate.

>Please note that I'm NOT
>trying to start a flame war about "my scanner is better than your
>scanner". It must be possible to give some unbiased measures of an
>antivirus program, such as

>Approximately how many viruses does it detect?  Does it detect all the
>"important" viruses?  How often is it upgraded?

Definitions updates are offerred monthly.  The other questions I leave
unanswered as they would be considered biased to come from me.

Jimmy Kuo                                       cjkuo@ccmail.norton.com
Norton AntiVirus Research
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: KEY Press virus & McAfee v97 (PC)
Date: 17 Nov 92 17:08:43 GMT

mcafee@netcom.com (McAfee Associates) writes:

> >point is, however, that SCAN is occasionally not very accurate in determinin
g
> >exactly which virus you have.

> I understand that, believe me.  We will fix any such problems reported
> to us.

Will you? Any such problems? Let's hope... Because, if memory serves
correctly, I am reporting such problems to you since about a year...
Such problems include:

1) Viruses mentioned in VIRLIST.TXT but never reported by SCAN.

2) Viruses reported by SCAN but never mentioned in VIRLIST.TXT.

3) Viruses mentioned under one name in VIRLIST.TXT, but reported under
a slightly different name by SCAN.

4) Viruses described with wrong properties in VIRLIST.TXT.

5) Several (often - completely different) viruses reported with one
and the same name. This is the most dangerous problem, since it causes
misidentification. As a reply of one of my reports about these, I got
a very angry reply from John McAfee himself. The reply was posted from
your account, so you should know about it. It claimed that the viruses
mentioned by me are actually closely related. Those viruses were
Number of the Beast, Compiler.1, and Darth Vader. Anybody who has
bothered to disassemble them knows that they are completely
different... BTW, SCAN 97 still reports all the three of them as "512
[512]"... :-(

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany