HDTenEightyP/NetNews huggingface dataset:
From: hombas!rudy.hehn@hombas.uucp
Newsgroups: comp.virus
Subject: Re: HELP! (RE: IBM password) (PC)
Date: 3 Nov 92 22:33:00 GMT

- -> That "I always warn people not to use" covers a lot of territory! In
- -> the business world, that password feature is very desirable. It keeps

I was, perhaps, a little imprecise in my phrasing. I should have said
'warn people not to use unless they don't mind the inconvenience of
losing the password and not having system access until they recover it'.
In a business setting, that feature is desirable, as you pointed out.

- -> circumstances. I suspect that there is a market for this - picure
- -> walking into a better grade of computer store. A PC in the order area
- -> presents a menu driven system. You select your present (or just
- -> ordered) motherboard, then choose from a list of BIOS options like:

<Text deleted>

- -> Seclect what you need, then the system programs a set of chips (a
- -> matter of minutes from direct observation.) Given the amount of

An intriguing and desirable concept. It would be easy enough for the
software to keep track of the number of times each BIOS was chosen so
that the BIOS companies could get their share of the profit. Which
brings to my mind another concept: would it even be possible to have a
virus scanner/cleaner/integrity checker as part of a new BIOS, available
to the operating system as needed?
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: Filler virus - Need Help! (PC)
Date: 4 Nov 92 06:27:21 GMT

Hello Gilles,

you write:
>I just find out that Filler virus has invaded my computer system. The
>Scan Test (SCAN 8.9V97 - McAfee) sometime detect it and other time it
>can't. Is there any other thing I can do to get rid of this damned
>virus...

While there is an actual Filler virus from Europe (?), we have not had
any actual reports of the virus, other than the initial disk that was
send to us.  However, it is fairly common for the Filler virus to be
reported in memory due to a conflict between VIRUSCAN (SCAN) and other
anti-viral programs if they use the same "search string" to detect the
virus but the other anti-viral program does not hide the search string
in memory by ciphering or otherwise encrypting it.

I would recommend that you check your PC to see if any other
anti-viral programs are running and if so, disable them and reboot
your system.  If the virus is no longer reported by SCAN then it is a
false alarm.

Regards,

Aryeh Goretsky
Technical Support

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: rol@grasp1.univ-lyon1.fr (Paul Rolland)
Newsgroups: comp.virus
Subject: PC Memory resident viruses detection (PC)
Date: 12 Nov 92 08:45:57 GMT

Hello,

Because I'd like write some code to have my programs doing a quick
memory check when starting before doing anything else (disk access or
so), I'd like to have information on the way to detect already
installed viruses.  I know some of them (at least 100) use hooked
interrupts to check if they are alreasy present. Could some one give
me these vectors and the tests to perform to see if a virus is memory
resident ?  Any help would be greatly appreciated !

PS : I already have the ones described in Ralf Brown's interrupt list.
I don't want the code of the virus but just the interrupt to call to
see if it is present.

Thanks

Paul Rolland, rol@grasp1.univ-lyon1.fr
- ---
A bug can be changed to a feature by documenting it. Developpers know !
- --------------------- DISCLAIMER -------------------
All the opinions I express in this posting are mine, but I'm
ready to share them with anybody interested :-)
From: lchardon@trentu.ca (Laurent Chardon)
Newsgroups: comp.virus
Subject: Re: What has became with R.T.Morris ?
Date: 10 Nov 92 03:08:00 GMT

lieberzeit@vax.felk.cvut.cs writes...
>Please, can someone tell me, what has became with R.T.Morris (the
>author of The Internet Worm)? The last news I have is that he was
>found guilty of violating the Federal Computer Fraud and Abuse Act and
>sentenced to 5 years and $250.000. I am not sure this news is the
>final one. Was not there a court of appeal? I would also appreciate
>any further details.

	In my copy of Cyberpunk, I read that he was sentenced to three
years' probation, and had a fine of $10000, plus 400 hours of
community service. Now he is working as a programmer at a software
engeneering reasearch firm in cambridge, Massachussetts. There was a
court of appeal, on march 7, 1991, but conviction was upheld.
	That's all I know. If people know more, please tell us. Thank 
you...

Laurent Chardon.
From: ajchuah@mtu.edu (Low Profile)
Newsgroups: comp.virus
Subject: Outdated F-PROT?? (PC)
Date: 3 Nov 92 16:17:45 GMT

Frisk and all,
             I am currently using F-prot 2.04b on my machine and am
using Virstop.  I haven't had any problems until recently.  I wanted
to use F-prot 2.05 but since there was some mention on problems, i
decided to stick with 2.04b.  Anyway, now when i boot up my machine,
when it loads Virstop, it gives a message that sounds something like
"This version of F-prot is rather old and ..." overall what it is
trying to say is the version of f-prot i have is old and that i should
replace it.  Is this some form of virus, a way of your program
notifying me to switch or what?  This message comes on the screen
without fail for the past 2 weeks.  Any help would be great.  BTW,
what is the scope on the latest version of f-prot?  Thanx.

- -- 
- -------------------------------------------------------------------------------
|                           |    *BARK* *BARK* *BARK*  In Love with OS/2      |
| Alex J Chuah              |    38640Trident8900Cw1MViewSonic6ESVGAMonitor   |
| ajchuah@mtu.edu           |    64Kcache8MBof70nsOkidataML93onLPT1           |
| ajchuah@mtus5.cts.mtu.edu |    80MB+1.3GBHDAlwaysIN2000SCSIController       |
|                           |    ATIetc/ionCOM2Identity256GSScanner           |
- -------------------------------------------------------------------------------
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: Checking high memory with VSCAN (PC)
Date: 3 Nov 92 01:07:10 GMT

Hello Ian,

ianst@qdpii.comp.qdpi.oz.au (Ian Staples) writes:
[...message I wrote about memory regions deleted for brevity...]

>Hmmm... does this imply that once we all have OS/2 or whatever on 386s
>or better, and 32-bit applications addressing oceans of flat memory
>space then we will have to wait forever for SCAN or some other to scan
>the whole bloody lot when we boot up each morning?

Since OS/2 is a virtualizes memory in DOS sessions, you would only
have to check the memory allocated for that particular DOS
session--not all the memory available to the system.

Regards,

Aryeh Goretsky
Technical Support

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: riordan.cybec@tmx.mhs.oz.au (Roger Riordan)
Newsgroups: comp.virus
Subject: Greeting from Roger Riordan
Date: 4 Nov 92 08:21:29 GMT

Greetings to ALL!!

If all has gone according to plan I have an official mail
box at last.  My address is

      riordan.cybec@tmx.mhs.oz.au

I hope this will enable me to take a more active part in
proceedings from now on.

Roger Riordan.  CYBEC Pty Ltd              Ph: +61 3 521 0655
PO Box 205, Hampton. Vic 3188  AUSTRALIA   Fax +61 3 521 0727
From: int477k@lindblat.cc.monash.edu.au (Mr Brenton Judge)
Newsgroups: comp.virus
Subject: Syrian Brain II (PC)
Date: 5 Nov 92 03:47:37 GMT


	I had a call last night from a user whos machine was reporting
that whilst his executables existed in directory listings, when he
tried to run them DOS reported that it was a "Bad command or file
name", every time he ran a file from the HD, and then after that every
time he ran a file from the HD or his floppy.  After getting him to
upload the first executable that was run in his autoexec.bat from his
HD, it was easy to find a virus which had its name clearly marked out
as the Syrian Brain II virus.  I had a quick look at the virus, and
given the simplicity of the viral code (infect everything that the
user tries to run after virus hooks int 21H) and the number of errors
in the programming which would cause most of its messages to become
corrupt, I wondered if this was as the name suggests a Syrian virus,
or is it far more likely that its one made here.  Has anyone else ever
come across it?

	Brenton Judge
From: fc@turing.duq.edu (Fred Cohen)
Newsgroups: comp.virus
Subject: Happy anniversary to IT (PC)
Date: 10 Nov 92 11:34:34 GMT

IT has now run for 3 years without any known virus bypassing the
defenses.

Although we have made improvements over the last 3 years, it is
somewhat amazing to us that none of the over 1500 new viruses
discovered in the last 3 years has been able to bypass our version
from late 1989.  Many get part of the way through, and some get to the
point where the syst is allmost unuseable, but none have gone
undetected, and none have been unrecoverable!

Generic virus defenses seem to have become reasonably matured..

By the way, unlike the scanner developers, ASP has continued to
publish the details of how to design a strong generic virus defense.
AS a result, we have several strong competitors who are always chasing
us, and always outselling us.  The reality is that in this commercial
world, our software copyrights do not protect us from this, and since
Patents are too expensive and unstable in the software world of today,
the ONLY protection that works is the protection of being owned by a
big rich company.  (With the reverse engineering ruling of late, we
cannot even maintain any trade secrets in our software since or
competitors are freely allowed to disassemble our software and design
the same thing over using our methods).

For the above reasons, I daily deal with the problem of providing
information on how to build better defenses vs. protecting my income
by keeping our techniquers secret.  Unlike those at a University or a
big company, it directly impacts my income (in a negative way) every
time I publish a paper on virus defenses.  In my opinion, everyone
should submit their techniques to a refereed journal.  The reason is
simple.

	In the scanner world, a 6 month lead time is plenty, and that
is how long (at a minimum) it takes before your article gets published
in a journal.

	The only problem is the reviewers, who have historically
published my results (and probably others as well) in non-refereed
forums before my papers got to press.  If the reviewers (who are
anonymous) don't have the integrity to maintain the confidentiality of
papers before they are published, the system fall apart pretty
quickly.

	Oh well, I have digressed enough from my happy anniversary
message.  Have a nice malicious-virus-free day.
		FC

p.s. I wish I could edit out the spelling errors before sending these
mail messages - do you get all the ^h's on your screen too?
From: ferris@turtle.fisher.com
Newsgroups: comp.virus
Subject: Am I Infected? (PC)
Date: 2 Nov 92 20:45:45 GMT

I had the stoned virus and I was getting 1701 (or 1710, I forget)
error on bootup. Supposed to indicate a hard disk error, I think.

I replaced the hard disk and controller, virus scanned everything that
went into the new disk. Ran the machine for a couple days with no
problems, then, after leaving it powered down for two weeks, it came
up with the 1710 (or 1701, I for...) error again. Now it boots
erratically, but it will boot from a floppy, which it wouldn't do with
the old drive. (Won't access the hard drive after floppy boot.)

Am I stoned or hardware failured? Help, help, hellanddamnation.
From: tck@fold.ucsd.edu (Kevin Marcus)
Newsgroups: comp.virus
Subject: Re: VCL? (PC)
Date: 9 Nov 92 23:33:04 GMT

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
>harder to write a working virus creation tool than it is to create a
>working virus..

I'll agree there, but the point in the matter is that ANYONE can
develop a virus.  This means even people who don't know how to program
at all...
From: pahountis@alcoa.com (Julia Pahountis)
Newsgroups: comp.virus
Subject: Virus Protection on NFS Servers
Date: 4 Nov 92 15:27:44 GMT

Does anyone have any prevention techniques/recommendations to share
regarding virus protection on NFS file servers which are being
accessed by MACs, PCs and UNIX workstations?

I would appreciate any comments and ideas that you may have!

Thanks,

100 Technical Drive - Bldg. B
Alcoa Center, PA  15069
(412) 337-3744
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Info Grain of Sand Virus (PC)
Date: 11 Nov 92 21:55:55 GMT

dboer@let.rug.nl (Ale de Boer) writes:

> Can anyone give information about the Grain of Sand virus. TBSCANX
> noticed this virus while copying a file allegedly containing it. Scans
> with McAfee turned up nothing, nor did TBSCAN. I could not find any
> information about the GoS virus in VSUMX.

A more widely used name for this virus is Maltese Amoeba. In our tests
SCAN 97 was able to detect reliably the infected samples, so you
probably have a false positive. Just in case, try F-Prot 2.06a. It is
important to verify whether you really have this virus or it is only a
false positive, since the virus triggers on November 15 and destroys
the information on your hard disk.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: OS/2 system stopped due to virus (FAT partition)? (OS/2) (PC)
Date: 11 Nov 92 18:42:34 GMT

Hello Wey Jing Ho,

you write:
>My PC has just been infected by an unknown virus (both McAfee Scan
>Version 97 and CPAV failed to identify it/them). SCAN only report that
>all of the hard disk boot sectors have been modified (as compared to a
>CRC file created before the infection). I have both MS-DOS 5.00 and
>OS/2 (with the latest CSD) installed with DOS on FAT and OS/2 on HPFS.
[...deleted...]

If you are running an OS/2 Dual Boot system, SCAN will report that the
boot sector has been modified when you switch from DOS to OS/2.  This
is because OS/2 swaps the boot sector on the drive depending on which
operating system you are using.

Regards,

Aryeh Goretsky
Technical Support

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: MtE detection tests (PC)
Date: 2 Nov 92 18:12:38 GMT

Hello, everybody!

Here is the long awaited report about the MtE detection tests that we
performed at VTC-Hamburg.  It is rather longish, so maybe Ken should
consider splitting it into parts.  Normally, I should have put it for
anonymous ftp, instead of publishing it here, but the preliminary
results of the tests raised enough interest and discussions, so I
decided to publish it in a whole in this newsgroup.  Nevertheless, it
- -is- available for anonymous ftp as

ftp.informatik.uni-hamburg.de:pub/virus/texts/tests/mtetests.zip

[Moderator's note: Vesselin's MtE tests are also available from:
      cert.org:pub/virus-l/docs/mtetests.zip
I have broken Vesselin's tests down into multiple chunks and will be
posting each separately.  Thanks Vesselin!]

Enjoy.  Comments, questions, and suggestions are welcome.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: protonen@daimi.aau.dk (Lars J|dal)
Newsgroups: comp.virus
Subject: How good is Norton Antivirus? (PC)
Date: 11 Nov 92 10:01:55 GMT

How does Norton Antivirus compare to other virus programs, such as
F-prot and Vscan, apart from that Norton is commercial? Norton is
almost never mentioned here. Is that because it is commercial or
because the other programs are better?  Please note that I'm NOT
trying to start a flame war about "my scanner is better than your
scanner". It must be possible to give some unbiased measures of an
antivirus program, such as

Approximately how many viruses does it detect?  Does it detect all the
"important" viruses?  How often is it upgraded?

etc.

Thank you in advance!

+--------------------------------------------------------------------------+
| Lars J|dal                  | Q: What's the difference between a quantum |
| email: protonen@daimi.aau.dk|    mechanic and an automechanic?           |
|                             | A: A quantum mechanic can get his car into |
| Aarhus University           |    the garage without opening the door.    |
| Denmark                     |                    -- David Kra            |
+--------------------------------------------------------------------------+
From: Grant@DOCKMASTER.NCSC.MIL (Lynn R Grant)
Newsgroups: comp.virus
Subject: Denning Key Registration Virus
Date: 6 Nov 92 21:09:36 GMT

I think we are witnessing the first virus that doesn't require any
special code to operate.  Just look at the sci.crypt forum.  After
Dorothy Denning's talk at the last NCSC conference about registering
crypto keys with the goverment, there has been a tremendous response
(mostly angry) on sci.crypt; the other day I checked the forum and
there were 450 new postings since a day or two previous.  Now postings
are starting to be cross posted to the risks and privacy forums.

This is sort of like the IBM XMAS virus, but it doesn't take any code.
All you have to do is post a highly controversial item on a well-read
forum, and wait for the responses to bring the network to its knees.

Lynn Grant
Grant @ DOCKMASTER.NCSC.MIL
N8AF
From: riordan.cybec@tmx.mhs.oz.au (Roger Riordan)
Newsgroups: comp.virus
Subject: "LARRY ON A SCREEN" Virus (PC)
Date: 4 Nov 92 08:22:50 GMT

This virus was first reported (to our knowledge) by Brian Mariott,
Dept of Computer Science, University of Tasmania, on Virus L, on 7th
Oct.  They received it from a computer shop, which had found it on a
PC brought in by a customer.  We received a sample on Oct 20th.

It is a resident .COM & .EXE infector, adding 491 & 507 bytes
respectively.  Like Troi2, recently reported, it hides in the 2nd half
of the interrupt table, overwriting interrupts 80 to FF, and, like
Troi 2, it frequently crashed in our tests, again presumably because
it overloads the system stack.  It has one most unusual bug; it gives
a "Write protect error writing drive .." message (and usually hangs),
if you run a program from a write protected disk - even if the file is
already infected!

The virus uses the word 'GM' (474dh) as the signature.  This is found
at offset 4 in .COM files, and at offset 12h (the checksum field) in
the .EXE header.  The message below can be seen almost at the end of
infected files.

It includes a counter (set to 19 in our sample) which is decremented
each time a program is infected.  When the counter reaches zero the
message

                          Larry on a Screen

is displayed instead of running the program.

This virus does not pose a serious threat, as it does no deliberate
damage, and is so unreliable that most users will realise something is
wrong, even before they get the message.

VET 7.06 will detect this virus, and restore infected files.  It will
also detect and repair files infected with Shifter (also recently
found in Australia), and will detect a number of viruses recently
discovered overseas.

Roger Riordan.  CYBEC Pty Ltd              Ph: +61 3 521 0655
PO Box 205, Hampton. Vic 3188  AUSTRALIA   Fax +61 3 521 0727
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: KEY Press virus & McAfee v97 (PC)
Date: 11 Nov 92 00:41:03 GMT

Hello Vesselin,

you write:
[Or if the line starts with a ">>" then I wrote it.]
[...my comments about KeyPress variants deleted for brevity...]

>While you are at it, please also have in mind that:
>
>BetaBoys.Rattle is reported as Rattle [Rttl] and Mexican [Mex];
>Burger.* are reported as Burger [Burger] and FamilyQ [FQ];
>Cascade.1701.D is reported as JoJo [JoJo] and Yap [Yap];
>Crew.* (except Crew.1.C) are reported as Crew-2480 [2480] and FamilyM [FM];
>FaxFree.Topo is reported as Lamer [Lam] and Topo [Topo];
>Happy_New_Year.1600 is reported as Happy N.Y. [HNY] and Voronezh [Vor];
>Horse.1154.* are reported as 512 [512] and Horse [Hrs] (in some files only);
>Jerusalem.Mummy.1_2 is reported as Mummy [Mum] and FamE [FE];
>Jerusalem.Timor is reported as 1241 [1241] and Jerusalem [Jeru];
>Leprosy.G is reported as infected twice by Leper [OW];
>Leprosy.Plague is reported as Viper [Vip] and Plague [Plg];
>MShark is reported as FamN [FN] and FamM [FM];
>Murphy.Brothers is reported as Brothers [Bro] and 1530 [1530];
>Murphy.Tormentor.* are reported as LixoNuke [Lix] and Murphy [Murphy];
>
>Sorry for the long list, but I hope that it might help to some other
>readers too. Hope you'll fix that in your next version.

Well, they all are detected as viruses, which is a start.  I'll ask our
programmers if they can spend some time looking into that listing of viruses.

[...questions about reliability of Commander Bomber detector deleted...]
>Am I sure about -what-? That SCAN 97 does not detect Commander Bomber
>reliably? Yes, I am sure about it. It doesn't detect it reliably. It
>misses this virus in some of the infected files.
[...deleted...]

But it picks it up in some.  Which means the programmers are at least on
the right track, as far as a making a detector goes.  I'll ask them to look
at the detector for the it, then.  If they have any questions, can they 
contact you directly by email?

Regards,

Aryeh Goretsky
Technical Support

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR