HDTenEightyP/NetNews huggingface dataset:
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: Re: Vshield vs Virstop (PC)
Date: 9 Dec 92 18:53:26 GMT

> From:    mcafee@netcom.com (McAfee Associates)

> Isn't VIRSTOP a program by IBM for internal use by IBM employees only?

No, you're thinking of VSTOP, which is used internally in IBM, and is
also available to people who buy the IBM Anti-Virus Service Offering.
The most recent incarnation of this code is as the DOS Session Shield
component of IBM AntiVirus/DOS and IBM AntiVirus/2 (it's no longer
called "VSTOP" there).

VIRSTOP is something else, I'm not sure exactly what.

- - -- -
David M. Chess                     /    Invest for the Nanotech Era:
High Integrity Computing Lab      /              Buy Atoms!
IBM Watson Research              /
From: a2js@loki.cc.pdx.edu (Jahed Sukhun)
Newsgroups: comp.virus
Subject: Stoned Virus (PC)
Date: 14 Dec 92 18:32:02 GMT

I am using a FPROT 2.06a.  When I am checking the hard disk for
viruses, FPROT comes with a message:

          A NEW VARIANT OF THE STONED VIRUS WAS FOUND. 
          NO ATTEMPTS TO DISINFECT.

It doesn't give a name to it or anything.  

I have FPROT set to the following settings:

     *    Method                                  Yes
     *    Search                                  Yes
     *    Action                                  Disinfect/Query
     *    Targets

          -    Boot Sector viruses           Yes
          -    File viruses                  Yes
          -    Trojans and Joke programs     Yes
          -    User defined Strings          Yes
          -    Packed Files                  Yes

     *    Files                                   All files

Any suggestions

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Jahed Sukhun, User Support Analyst    +    a2js@loki.cc.pdx.edu +
                                      +                         +
Portland State University             +    (503) 725-3112       + 
Office of Information Systems         +                         +
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Fake Dir-II (PC)
Date: 11 Dec 92 17:20:26 GMT

Stefano_Turci@f108.n391.z9.virnet.bad.se (Stefano Turci) writes:

> F-prot says that it is possibly a new variant of Dir-II, and it doesn't say 
> that the file is infected by Dir-II, however I am a little worry about it 
> because.....I am the author of that program. :-)

> I wrote that program using assembler, and I found the piece of source code 
> that produces the above warning:

> - ------------------------------------------------        
>         mov     bx,offset message
>         mov     cx,46d
> decrypt:
>         xor     byte ptr [bx],0ffh
>         inc     bx
>         loop    decrypt
> - ------------------------------------------------

> I can only suppose that the virus uses a very similar decrypting routine, 
> however I think there is something wrong in the way used by F-prot to search 
> for new variants of Dir-II.

[stuff deleted]

Hmmm.... The worst of all is that the real working virus (Dir_II)
*doesn't* contain such piece of code... Except... Well, there is one
"variant" of this virus, which tries to be polymorphic and uses
something similar to the above to variably encrypt/decrypt itself...
However, as pointed out by the Russian anti-virus researcher Dmitry
Gryaznov, this variant of Dir_II will never work, due to some serious
bugs in it... Maybe F-Prot should just not try to detect it?

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: pd@nwavbbs.demon.co.uk (Peter Duffield)
Newsgroups: comp.virus
Subject: Re: Dangerous bug in CHKDSK that comes with MS-DOS 5.0 (PC)
Date: 10 Dec 92 14:35:19 GMT

mramey@u.washington.edu writes:

>How can you tell if you have MS-DOS version 5.00a or not ?
>
>I called Microsoft and requested the updated version for my computer
>labs, even tho' we have not encountered the failure conditions yet.  I
>was told that in MS-DOS version 5.0a, the date on COMMAND.COM is
>11-11-91.  I have not yet received the updated version, so I cannot
>confirm that.  (My current DOS-5 COMMAND.COM date is 4-09-91.)  If I
>learn anything different, I will post it.

There is an undocumented switch to the "ver" command...  If you type 
"ver /r" it will give you not only the version number but the revision
as well. Mine gives the following response...
 
    C:\>ver /r

    MS-DOS Version 5.00
    Revision A
    DOS is in HMA


Peter
- -- 
Peter Duffield                          pd@nwavbbs.demon.co.uk (Internet)
Voice: +44 244 545669                   BBS:  +44 244 550332   8,N,1
North Wales Anti-Virus Support BBS, FidoNet: 2:250/201, VirNet: 9:441/110
===  PGP 2.0  ==  public key available on request  ==  Key ID 991AB1  ===
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: VSHIELD, VIRSTOP, ... comparison ? (PC)
Date: 11 Dec 92 22:04:01 GMT

mramey@u.washington.edu (Mike Ramey) writes:

> Is it possible that the three of you (McAfee, Frisk, and Slade) could
> cooperate to produce a point-by-point comparison of VSHIELD and
> VIRSTOP?

It is just not possible to do such a detailed comparison, because
there are features present in only one of the products.

> One of my questions is this: VSHIELD intercepts a keyboard reboot and
> checks for the presence of an infected diskette in the boot diskette
> drive; it does not allow booting from a (boot-sector?) infected
> diskette.  Does VIRSTOP have this function?  What other differences
> are there?

No, VIRSTOP doesn't have such feature (yet). Other differences are:

1) VShield can check the authentication codes added to the files by
SCAN /AV (it is a BAD idea to modify other people's files!) and refuse
to run those that are not "checksummed". Unfortunately, this feature
can be trivially bypassed (i.e., it is trivial to write a virus that
adds a correct checksum to the file it infects).

2) VShield can scan a file while it is being copied. VirStop does not
have such a feature yet, although Frisk is promising it since a long
time.

3) VShield uses much more memory than VirStop.

4) VShield can be swapped out to the disk, in order to reduce the
amount of memory used. This slows down the loading of the programs.
VirStop does not have such an option (although Frisk intends to
implement it), but then the memory requirements for VirStop are much
more modest.

5) VShield implements some kind of access control - you can tell it
which programs are allowed to run.

6) VShield can be removed from memory (very BAD idea!).

7) VShield can be installed before a network shell is loaded. With
VirStop, you must either install the program after the network shell,
or run without protection. Frisk is expected to fix that problem soon.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Untouchable (PC)
Date: 11 Dec 92 21:47:17 GMT

RADAI@vms.huji.ac.il (Y. Radai) writes:

> When I said that companion viruses began to appear only in 1990, I
> meant those which appeared in "the wild".  Correct me if I'm wrong,
> but I don't think that was true of TP_Worm (at least in 1989 and
> probably regardless of date).

Sigh... It depends on the definition of "in the wild"... It has been
"in the wild" in the Technical University of Sofia, at least for a
short time...

Side note... Till now we all thought that PATH companions are just a
theoretical attack and no such viruses exist yet. Looking carefully at
the source of the TP Worm, I see that it has been not only the first
companion virus, but also the first PATH-companion... When it is first
started on a clean system, in its "initial burst", it spreads a lot of
its spoofing bodies in up to 10 randomly selected directories from the
PATH variable...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: g.s.byron@stirling.ac.uk (Mr Gordon S Byron)
Newsgroups: comp.virus
Subject: MAC-disk replication-virus?? (Mac)
Date: 10 Dec 92 11:45:36 GMT

A user brought my an external 40 MB Hard Disk yesterday which she said
"wouldn't work". After using various SCSI tricks I got the dosk to
mount. It replicated itself 6 times on the desktop? It wouldn't mount
my internal drive, so I still have to figure out how to get both
drives up in order to get the data off and then reformat. Just want to
check with Virus-L people whether this behaviour has ever been seen
and whether it conforms to any descriptions of ugh, virus thanks,
gordon
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Does anyone have info on DAME? (PC)
Date: 16 Dec 92 23:18:46 GMT

MICKLE@csmcmvax.bitnet (Dave Mickle x5205) writes:

>We've got a PC which is displaying a message to the effect it's
>infected by the "DAME" virus.  Don't know what symptoms there are in
>addition to the message.

>We're going to do a low level format,,

   Why ?

   That's like curing a cold by shooting the patient.

>but would like to know what we've contracted.

Without further information it is hard to tell.  What program reports
this ?  Is it just one file ? many files ? Memory ?

- -frisk
From: as194@cleveland.Freenet.Edu (Doren Rosenthal)
Newsgroups: comp.virus
Subject: Virus Simulator MtE Available (PC)
Date: 15 Dec 92 14:46:52 GMT


          ------------------------------------------------                     
  
 
              Virus Simulator MtE Supplement Available
 
          ------------------------------------------------                     
  
 
     An  MtE virus simulation test suite generator is  available 
     suitable   for   use   by   general   end   users,   system 
     administrators  and  educators. These safe  and  controlled 
     virus  simulations set off MtE virus detectors for  testing 
     and demonstrations without the danger associated with their 
     malicious virus counterparts.
 
     Virus  Simulator  (introduced earlier) and this  new  Virus 
     Simulator  MtE Supplement are not intended to  replace  the 
     comprehensive   collection   of  real  virus   samples   as 
     maintained  by Rosenthal Engineering and  other  anti-virus 
     product   developers  for  testing.  Virus  Simulator   MtE 
     Supplement  produces safe and controlled dummy  test  files 
     that  enable users to verify that they have  installed  and 
     are  using  their MtE virus detecting  programs  correctly, 
     additionally  affording  an  opportunity  for  a   practice 
     training drill under safe and controlled conditions. 
 
               Rosenthal Engineering
               3737 Sequoia
               San Luis Obispo, CA USA 93401
 
     Doren Rosenthal          
 
     =============================================================
From: MEWETT@qut.edu.au
Newsgroups: comp.virus
Subject: info on cansu virus (PC)
Date: 16 Dec 92 01:21:00 GMT

Rescently we have had an outbreak of the 'Cansu' or 'V' virus, but we
appear to have the situation under control.

However I am trying to do some research on this virus for a virus
research / information group and would greatly appreciate any
information any one could supply.


	Sincerely Scott Mewett

Scott Mewett
Computer Virus Information Group (CVIG)
mewett@qut.edu.au
Queensland University of Technology
FAX (07) 221 2384  Ph (07) 864 2095
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: SCAN for OS/2 uploaded to mcafee.COM... (OS/2)
Date: 17 Dec 92 15:26:59 GMT

aryeh@mcafee.com (McAfee Associates) writes:

> - -     Since OS/2 operates in a protected mode environment it can
>       only check its own area of memory or "memory image" for
>       viruses.  Viruses in a DOS session or VDM will not be
>       detected in memory by OS2SCAN.

This is not actually a problem. Since the scanner runs in its own area
of memory, protected from the other processes, it cannot be fooled by
a stealth virus and cannot be made to spread a fast infector on all
files it scans... In fact, I am wondering why a memory check is
performed at all by an OS/2-based scanner...

> - -      OS2SCAN checks "extended filenames" and HPFS-partitioned
>        drives as well as DOS (FAT) drives.

Do you know any way in which a known DOS virus can infect an extended
filename on an HPFS partition?

> - -      The /SAVE switch does not modify the OS2SCAN.EXE file.
>        Instead, it creates a SCAN.INI file.

That's good news! It would be a good idea to make SCAN for DOS act the
same way! This will be one self-modifying program less...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: CHIP@BDSO.Prime.COM (Chip Seymour)
Newsgroups: comp.virus
Subject: Re: F-PROT and Stoned variant (PC)
Date: 15 Dec 92 15:18:29 GMT

>From V5 #200:

> We may have found a new variety of STONED on our campus. 
> F-Prot 2.06a identified it as a STONED virus but refused to
> remove it. 

We've had three instances of the same problem here. In two cases FDISK
/MBR corrected the problem with no adverse side-effects. The user in
the third case is reluctant to run FDISK on a DOS 3.0 machine.
 
Anyone know what'll happen if we do that?

(The virus came from a local high school.)

Chip Seymour
Computervision Corp.
Bedford MA
From: ephraim@Think.COM (Ephraim Vishniac)
Newsgroups: comp.virus
Subject: Re: MAC-disk replication-virus?? (Mac)
Date: 10 Dec 92 14:55:14 GMT


   A user brought my an external 40 MB Hard Disk yesterday which she said
   "wouldn't work". After using various SCSI tricks I got the dosk to
   mount. It replicated itself 6 times on the desktop? It wouldn't mount
   my internal drive, so I still have to figure out how to get both
   drives up in order to get the data off and then reformat. Just want to
   check with Virus-L people whether this behaviour has ever been seen
   and whether it conforms to any descriptions of ugh, virus thanks,
   
If a disk's SCSI ID is set to 7 (same as the host), the disk responds
at every SCSI ID (0-6) because the initiator asserts both addresses.
So, you'll see such a disk seven times on the desktop.

Ephraim
From: Martijn_Janssen@f16.n314.z9.virnet.bad.se (Martijn Janssen)
Newsgroups: comp.virus
Subject: Re: Newest and best scanner? (PC)
Date: 3 Dec 92 18:16:00 GMT

- -->......They've really made a good job with these packages,
- -->Vesselin, but I'd like someone else's opinion....maybe I'm
- -->wrong.....

Sure they made a really good job on that latest version of Thunderbyte
5.01.  What for sure is a nice thing, is that there is a cleaner
included.

- -->....ciao!
Bye Bye.

Martijn.

- --- FMail 0.92
 * Origin: EarthQuake BBS Amsterdam +31-(0)20-6939665 (9:314/16)
From: riordan.cybec@tmx.mhs.oz.au (Roger Riordan)
Newsgroups: comp.virus
Subject: Origin of Plague virus. (PC)
Date: 17 Dec 92 22:21:58 GMT

m.oleary@qut.edu.au asks

> Just finished reading an old computer magazine which claims that a
> Brisbane virus "expert" created the plague virus.  I thought this
> virus was created in the USA.  Any information on the accuracy of 

This report was written by a journalist who totally misinterpreted a
comment made by the gentleman in question, who was invited to add a
little local colour to a seminar addressed by John McAfee.  It was an
incredibly sloppy piece of reporting, and has no foundation whatever.
The victim is currently suing the magazine, and claiming some millions
of dollars damages.

Roger Riordan                     riordan.cybec@tmxmelb.mhs.oz.au

CYBEC Pty Ltd.                                 Tel: +613 521 0655
PO Box 205, Hampton Vic 3188   AUSTRALIA       Fax: +613 521 0727
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: re: A user's view of IBM's antivirus/2 (OS/2)
Date: 11 Dec 92 16:30:20 GMT

> From:    ygoland@edison.SEAS.UCLA.EDU (The Jester)

> In conclusion, IBM's AntiVirus/2 is the friendliest anti-viral program
> I have seen. Its easy to install, set up, and use.

Glad you liked the program!   We're pretty proud of it.  I think
it's still the only OS/2 anti-virus program that has disinfection
features, an easy GUI interface, and all the rest.  Brag, brag!  *8)

>                                                  But it's integrity
> Management features leave alot to be desired.

> this program does not list all files that have changed and how they have
> changed.

The short answer to this is that it's an anti-virus program, not
a change-management or integrity-management program.  But that's
a cop-out.  We did test internally a program that showed you every
file that had changed (with hints as to which changes were most
likely to be a virus).  A few people liked it a lot, but most people
found it basically just noise.  Since programs change a *lot*, and
very very few of those changes are caused by viruses, people got
very tired of reading the change reports.  Most users didn't want
to know about a change unless it was caused by a virus.  They
didn't want to be told that SETVER.EXE had changed (because they
added a SETVER entry), or that 123.EXE had changed (because they
upgraded), or that their boot record had changed (because they
changed a volume serial number).

If enough people tell us that they want their anti-virus program
to also help with change management, we'll certainly consider
how to do that.  But in general change management and virus
protection seems to be mostly distinct; the vast majority of
changes are non-viral, and if you want to know about them
anyway it's probably because you have some other interest
besides viruses.

As usual, I'd love to hear from anyone who has different data;
if there are large classes of users who want to know about
every change on their machines, we'd like to help them, too.

>                                      Right now when you run a virus
> check you only get a message if something goes wrong, nothing else
> shows up. Thats great!

That's it exactly.  If enough people also want to see an entry in
the log for every file that has changed, we'll look into making it
an option.  My fear is that, even if we say otherwise in big
letters, people will assume that if an anti-virus program even
mentions a file, that file must have a virus in it!  *8)

DC

- - -- -
David M. Chess                  |  IBM AntiVirus/DOS and /2, in the U.S.:
High Integrity Computing Lab    |    Retail:        1-800-551-3579
IBM Watson Research             |    Site Licenses: 1-800-742-2493
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Batch file to "fix" CHKDSK.EXE (PC)
Date: 18 Dec 92 15:41:48 GMT

In an idle moment I put together the following batch file to convert
the 04-09-91 version of CHKDSK.EXE from MS-DOS 5.00 to the 11-11-91
model (only a three byte change after all). No guarentees but it seems
to work ok on my PCs. Please follow the instructions exacticalylylyly.

					Merry Christmas, Y'all,

						Padgett

- ---------------------cut here ---8<-------------------------------------
@echo off
echo CHKFIX.BAT by Padgett. Patch for early MS-DOS 5.00 CHKDSK.EXE that has
echo   been reported to corrupt disks having over 62,000 allocation units
echo   when the /F switch is used.
echo.
echo This program is FreeWare but no guarentee of any kind is made. Use
echo   is entirely at your own risk. Please read all messages carefully.
echo.
echo If at all possible, obtain the "official" MS-DOS release. This program 
echo   has not been authorized by MicroSoft in any way.
echo.
echo The original CHKDSK.EXE must be in the current directory. On conclusion 
echo   a new program CHKDSK2.EXE will be created with the same changes as 
echo   found in the MS-DOS 5.00 CHKDSK.EXE dated 11-11-91.
echo.
echo This program also expects that DEBUG will run from the current directory.

if not exist chkdsk.exe goto endit
if exist chkdsk2.exe del chkdsk2.exe

dir chkdsk.exe 
echo.
echo IMPORTANT: use *only* with the 16,200 byte version of CHKDSK.EXE
echo   shipped with the original DOS 5.00 dated 04-09-91 or its exact
echo   duplicate. Ctrl-C will exit.
echo.
pause

echo Creating CHKFIX.DAT (will be deleted when done).

echo s1l1 ">>> 4F <<< original value in 283F">chkfix.dat
echo e283f>>chkfix.dat
echo 7f>>chkfix.dat
echo s1l1 ">>> 8B <<< original value in 2841">>chkfix.dat
echo e2841>>chkfix.dat
echo 32>>chkfix.dat
echo s1l1 ">>> F9 <<< original value in 2842">>chkfix.dat
echo e2842>>chkfix.dat
echo ed>>chkfix.dat
echo w>>chkfix.dat
echo q>>chkfix.dat

copy chkdsk.exe c2.e >nul
echo Creating new CHKDSK2.EXE
debug c2.e <chkfix.dat
echo If the value in brackets ">>>  <<<" is not the same as the current value
echo   two lines below it, do not use the resultant CHKDSK2.EXE. If the
echo   change value (following line) is the same as the current value, you
echo   already have the updated version
ren c2.e chkdsk2.exe
echo.
echo CHKDSK2.EXE created, cleaning up directory
del chkfix.dat >nul
:endit
- --------------------------end CHKFIX.BAT-------------------------------------
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Vshield vs Virstop (PC)
Date: 11 Dec 92 09:09:59 GMT

>BTW, one tip. The detection rate of Virstop is exactly the same as of
>F-Prot in Quickscan mode - they are using the same mechanism. Maybe
>I'll do tests on our virus collection with F-Prot /quick one of these
>days...

Well, VIRSTOP (or Quick scan) will not detect as many viruses as
F-PROT Secure scan.  It will miss all MtE viruses for example, and
most of the viruses which cannot be found using a signature-based
approach. While Secure scan will detect around 99% of all viruses,
Quick scan may detect only around 90% (however, it will detect a much
higher percentage of "in-the-wild" viruses).

>> Virstop seems awfully small to have all
>> those signatures inside itself, 

Well, 12K isn't exactly small....and of that only 2K is code, the rest
is the signatures.  Of course, by using the /DISK command-line switch
you can get VIRSTOP's memory usage down to 2K, as the cost of a small
delay when running any program.

- -frisk
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: VSHIELD, VIRSTOP, ... comparison ? (PC)
Date: 11 Dec 92 09:27:55 GMT

mramey@u.washington.edu (Mike Ramey) writes:

>One of my questions is this: VSHIELD intercepts a keyboard reboot and
>checks for the presence of an infected diskette in the boot diskette
>drive; it does not allow booting from a (boot-sector?) infected
>diskette.  Does VIRSTOP have this function? 

No, not yet.  However, I am working on adding several features to
VIRSTOP, which are lacking from it.  They are:

   option to scan files during copy (done, being tested now)
   option to scan boot sectors when disks are accessed (almost finished)

- -frisk