HDTenEightyP/NetNews huggingface dataset:
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: PKZIP V2.04C (PC)
Date: 15 Jan 93 06:11:58 GMT

btf57346@uxa.cso.uiuc.edu (Byron "Bohr" Faber) writes:

> Just a note: With all the talk going around that pkzip204c is NOT
> infected with a virus, I'm not suprised somebody has really infected a
> copy and uped it.

Why? Most people -still- think that it is infected. Others have at
least heard the rumours and will be cautious...

> You might be able to fool a few to many people.  I think that the "anti-
> virus" community should be carefull of what they are telling people.

Well, we, the anti-virus people -are- careful. Unlike PKWare, who only
posted the size and the date of the file (something easily forgeable),
in my report I posted VALIDATE checksums of the file that I verified
to be virus-free. OK, it is possible to forge them too, but it
requires much more effort... Nevertheless, if somebody still does not
feel secure enough, I can post a MD5 digest of the archive that I
verified to be virus-free.

Besides, the new PKZIP/PKUNZIP is so horribly buggy, that I wouldn't
advise anybody to use it - data loss may occur and much more likely to
bugs than to a virus... :-)

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: HAYES@urvax.urich.edu
Newsgroups: comp.virus
Subject: new PKZIP problems? (PC)
Date: 18 Jan 93 12:41:20 GMT

Hello.

Just received a lot of mail on the BBS where I moderate the virus
awareness sub-board, all related to the new PKware PKZIP/PKUNZIP, now
distributed as PKZ204C.EXE (self-extracting archive) and the update
files for Symantec Norton's ANTIVIRUS (two files).
  
Seems that the new PKUNZIP finds a virus, the _maltese amoeba_ and
then stops de-archiving.  I myself downloaded the two files, unzipped
them with no problems, and verified them with both McAfee's Scan
(v.99) and Frisk's F-prot.  No virus found by both AV programs.

Two questions:
a) Does anyone know which type of AV PKware now adds to their program?
b) Are there other reports of similar behavior from PKzip/PKunzip?

Thanks in advance,  Claude.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Claude Bersano-Hayes     HAYES @ URVAX                 (Vanilla BITNET)
University of Richmond   hayes@urvax.urich.edu     (Bitnet or Internet)
Richmond, VA  23173
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: New way of opeing files??? (PC)
Date: 15 Jan 93 05:50:16 GMT

antkow@sis.uucp (Chris Antkow) writes:

>  Apparently, there is a new way of opening files which some AV
> Utilities don't catch. I've heard that the NuKE group is starting to
> use function AX,6C00h/INT 21h to open files...

First, the method is not new - it was introduced in DOS 4.0. Second,
it is not backwards compatible - if a virus uses it, it will not run
under DOS 3.30 and below. Third, there are already viruses using this
function (or intercepting it) - since quite a lot of time... :-)
Fourth, the knowledge of the members of the NuKE group about the
internals of DOS is not very impressive, if one takes a look at the
incredibly boring and silly viruses they continue to produce...

> Can anyone confirm the
> use of this function and are there any AV programs that trap this
> function?

I don't know, but why bother? First, even if a monitoring program
traps this function, it can be easily bypassed, using one of the many
tunneling techniques. Second, with this function it is possible only
to open or create (i.e., destroy) a file. If the virus wants to infect
it, it has to Write to it, and most monitoring programs I am aware of,
do trap the write operation...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: re: DOS Viruses under HPFS (OS/2)
Date: 18 Jan 93 21:16:43 GMT

>From:    antkow@sis.uucp (Chris Antkow)
>
> If you are testing a virus in a DOS window and it "goes off" so to
>speak (If it has a destructive nature...), will it trash the entire
>system, or just mess up the DOS window (Theory states that it should
>only mess up the DOS window... But can someone vouch for this?)

I'm not sure what theory you're referring to here!  *8)

If the virus does its damage by doing something that works in the DOS
box (like erasing all your 8.3-named files, say, or otherwise munging
with the data in them), it will work in the DOS box.  If it tries to
do something that doesn't work in the DOS box (writing to the hard
disk by direct BIOS calls is generally off, I think, for instance), it
won't work.  But remember that OS/2 is still designed as a single-user
system, and if you run a program that tries to do X, the system will
generally assume that X is what you want done, and do its best to do
it.  I wouldn't run viruses on my production system if I were you...

DC
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Math Models of Polymorphic Viruses
Date: 14 Jan 93 11:25:41 GMT

ygoland@edison.SEAS.UCLA.EDU (The Jester) writes:

> The picture of this process is a tree graph where each node is a
> mutation of the root with a theoretically unlimited number of
> children (You can just increase K to some arbitrary size when you
> wish to increase the number of mutations) each of which is itself a
> node with children and so on and so forth. Further more the graph
> does NOT have to be directed. It is possible for a child to produce
> its parent given the appropriate key. 

The graph obviously IS directed, with the different keys marking the
directed edges. You probably mean that the graph does not have to be a
TREE, i.e., there might be loops.

> The question is:Given functions VX() and VY(), can I determine if
> they are both members of the same tree? Further, if this problem

More exactly, the question is: given nodes VX and VY, it there a way
to determine whether a node VZ exists, from which there are paths to
both VX and VY?

> The application of this problem is obviously to polymorphic viruses.
> V() is the polymorphic virus function and K is whatever the virus is
> using to determine its next mutation. So if I have some known virus
> VX() and I scan the system, I can compare code against VX() and
> determine membership.

Also, it might be possible to apply the solution to the problem of
measuring polymorphism... For instance, polymorphism could be measured
as average length of the loops in the graph, or as average
"valentness" of the nodes, etc.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: ianst@qdpii.comp.qdpi.oz.au (Ian Staples)
Newsgroups: comp.virus
Subject: Cansu virus plague revisited (PC)
Date: 16 Jan 93 11:37:36 GMT

Further to my earlier post on this recent outbreak, a couple of other
questions have arisen:

When using CLEAN (v.99) to remove the Cansu virus from floppies things
normally work as you would expect.  BUT, every now and then a disk bobs
up (only with 5 1/4" in our experience) which CLEAN thinks it can't cure.

The message is something along the lines of "Cansu virus detected in
boot sector, can not be safely removed."

What gives?  Why do some (most) work okay but some don't?  Furthermore,
once this message appears CLEAN then thinks it can detect the virus in the
memory of the PC ("Warning: Virus active in memory.  Power down...etc.").

This seems to be the same "problem" that occurs with reading the directory
of an infected disk or with using SCAN (v.99) on an infected disk - the 
virus, or at least it's signature - is left in memory and the subsequent
CLEAN operation aborts as a result.

Incidentally, CLEAN also has a somewhat confusing message when it is being
run with the /MANY option.  If the virus is detected and removed on a floppy
and the next disk is in fact okay, CLEAN will give a message that it has
found one virus but that there is no virus on the new disk.  We eventually
worked out that it is probably just giving a cumulative count of what it
has found as you feed disks through the drive.  BUT, the first time you
see the message in an atmosphere charged with suspicion, concern, and
a great deal of ignorance, it is pretty bloody confusing!  I think McAfee
could do a bit better than that.

Any comments from people who know out there?


- -- 
Ian Staples                       | Internet : ianst@qdpii.comp.qdpi.oz.au
c/- P.O. Box 1054,                | Fax      : +61 (0)70 923 593
MAREEBA  Queensland  4880         | Voice    : +61 (0)70 921 555
Australia.                        | Home     : +61 (0)70 924 847
From: CSCRDW%CURIE@vaxtm1.rtpnc.epa.gov (Ron Whittle)
Newsgroups: comp.virus
Subject: Re: How to measure polymorphism
Date: 20 Jan 93 19:35:17 GMT

> ncase You Have Not Tried It TPE 1.1 Is Very Very Good..I have not
> Found a Pattern That Can be scanned with a simply Wild Card Scanner
> Yet..I think it is better than MTE..And I believe it is totaly
> Polymorphic..

For it to be totaly Polymorphic (by my definition), it must not alter
the actual instructions, just rearrange the order.  I suppose that we
could include the substitution of like instructions as polymorphism,
also.  Is this what TPE does?

Ron Whittle
cscrdw%curie@epavax.rtpnc.epa.gov
From: at974@cleveland.Freenet.Edu (Larry Bennett)
Newsgroups: comp.virus
Subject: Request for info: "ANSI bombs" in text files (PC)
Date: 19 Jan 93 18:16:38 GMT


The documentation for PKZIP v2.04c contains the following item.

It sounds awful strange to me.  If I type out a text file that contains
one of these "bombs" do I face the risk of introducing a virus into
my system?

If anyone can give me some insight into this, I would appreciate it if you
could respond via email.  Thanks.

==============================================================================

PKSFANSI.COM
 
PKSFANSI (PK Safe ANSI) is a Terminate and Stay Resident program that disables
ANSI Keyboard Key Reassignments, thereby preventing "ANSI bombs" embedded in
any text file (such as README files) or output by any program.
 
Normally, ANSI sequences that redefine the keyboard could be hidden inside ANY
text file or program, and could be executed completely unnoticed until it is
too late.  PKSFANSI intercepts calls to the ANSI.SYS or other ANSI device
drivers, and filters out any keyboard reassignments, while allowing other ANSI
sequences through unaltered.
 
If a keyboard key reassignment is attempted, PKSFANSI will intercept the
sequence and discard it.  PKSFANSI also will BEEP to alert you that a
reassignment was attempted.
 
PKSFANSI requires less than 1k bytes resident RAM, and should work with any
ANSI driver, such as the standard ANSI.SYS driver, NANSI, ZANSI, DVANSI, etc.
Note that if you use a memory resident ANSI driver, such as the DESQview
DVANSI.COM driver, PKSFANSI should be loaded after the ANSI driver is loaded.
 

==============================================================================

- -- 
[~~~~~~~~~~~~~~~~~~~~~~~~~_   /| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~]
|   Larry Bennett         \'o.O'     usr2059a@cbos.uc.edu          |
|   Madeira, Ohio  USA    =(___)=    at974@cleveland.freenet.edu   |
[___________________________ U ____________________________________]
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: Re: Untouchable (PC)
Date: 15 Jan 93 23:06:00 GMT

Quoting from Vesselin Bontchev to All About Re: Untouchable (PC) on 
01-13-93

VB> I has improved much since then. And I even don't have the latest
VB> version...

I had 1.1 myself, and FGS sent me an update notice, and I dowmloaded the 
1.13 upgrade from their BBS. All they updated in the 1.13 version was the 
TSR, and scanner.

VB> I have not seen a recent version of Victor Charlie, so I cannot
VB> comment on that. (I saw on a few years ago and it was very poor, but 
VB> have heard that the product has been completely redesigned.) Integrit
VB> Master is undoubtedly the best shareware integrity checker around, bu
VB> it is still MUCH worse that the integrity checker in Untouchable...

I have both the commercial, and share ware versions of Integrity Master 
5.0, and I found the Integrity checking to be pretty good. I would like it 
better if Victor Charlie stored the database of CRCs on a rescue diskette.
 
Personally; I like Integrity Master better than the integrity checking in 
Untouchable for the following reasons.
 
1. IM creates two CRCs per file
2. integrity Master creates can create CRCs for all files instead of just 
   the subset of executable files.

Granted Integrity Master can be improved. In fact I'm trying to talk 
Wolfgang into updating the scanner in IM to detect boot sector droppers.
 
Untouchable doesn't detect droppers either, and I consider them to be a 
fairly large security hole.
 
Prevention is always the best policy.
 
Bill

- ---
 * WinQwk 2.0 a#383 * JERUSALEM (Phenome) activates any Saturday
From: pmm34393@uxa.cso.uiuc.edu (Paul M. Minutillo)
Newsgroups: comp.virus
Subject: Re: Problems with PCs (PC)
Date: 14 Jan 93 21:39:18 GMT

Thanks to those who responded to my original post. I contacted the
McAfee people concerning my problems and apparently I have a virus
that is not caught by Scan v. 99. Here are the symptoms: Every
executable or com (maybe others) that is run, increases in size the
first time it is run if the virus is in memory. Every so often I get a
sharing violation on drive C (my hard drive), sometimes I get overflow
or divide errors. I don't think anything is being deleted, but a
couple of executables won't run because they have been modified. For
the most part I can still run everything. I never get errors while
within programs, but after I exit a program and try to do something
else I will occasionally get a sharing violation error. If anybody has
any other virus program or knows of a way to get rid of this please
let me know.  If there was a way to compare an infected program and a
non-infected one to find what is different, would I be able to take
the difference, plug it into Scan and delete that part from my
executables? As before, please respond by e-mail.

- -- 

Send e-mail to: pmm34393@uxa.cso.uiuc.edu
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: Re: Clash between FDISK/MBR and scanners (PC)
Date: 14 Jan 93 19:24:13 GMT

> From:    padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)

> ps It is my understanding (David ?) that OS/2 uses selection through a
>    replacement of the DBR (OBR ?) *not* the MBR and requires a more complex
>    approach...

There are two multi-boot arrangements available with OS/2.  One
(called "Dual Boot") works about as you say: when you boot the
machine, it comes up under whatever OS you last had.  If you want the
other one, you use the BOOT command, which swaps OSBRs (not the MBR)
and reboots.  The other one is Boot Manager, which sits in the
bootable partition on the disk, gets control from the (normal) MBR,
puts up a menu asking what OS you want to boot, and when you answer it
loads and executes the corresponding OSBR.  Neither of them does
anything to the MBR when you change OS's, that I'm aware of.  Note
that I'm anything but an Official IBM Spokeshacker on this subject,
though.  I just have a messing-about knowledge of it.

- - -- -
David M. Chess                                          mI' jIHbe' jay'!
High Integrity Computing Lab                            loD tlhab jIH!
IBM Watson Research                                          -- qama''e'
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: how to get rid of the Naughty Hacker-1? (PC)
Date: 14 Jan 93 17:06:33 GMT

cournoye@ere.umontreal.ca (Cournoyer Louis-Georges) writes:

>Norton anti-virus as reported the presence in my computer's memory of
>the virus Naughty Hacker-1. The Nav program says to boot with a disk
>which has the same system, which in this case is ms-dos 3.3. That i
>have done...

>however, doing so, the nav program is not able to recognize the virus...

>What should i do?

Well, one suggestion might be "Get another A-V" program :-)

>Another funny thing is happening: if i take the ansi.sys out of my
>config.sys file, the nav isn't able to find the virus...

It looks to me as if this might be a false alarm, but I was not aware of
NAV causing this particular false alarm.  You could start by calling them,
and checking if this is a known problem with the version of NAV that you are
using.

- -frisk

Fridrik Skulason      Frisk Software International     phone: +354-1-694749
Author of F-PROT      E-mail: frisk@complex.is         fax:   +354-1-28801
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: LAT details
Date: 17 Jan 93 21:32:00 GMT

Some have asked me about certain aspects of LAT, and I have decided to 
send one public message insead of multiple messages via Email.

1. I started LAT because of the hype in advertizing. I bought two less 
than adequate anti-virus programs, and I thought other users might like to 
see some fair and unbiased reports on anti-viral software before they buy. 
I have no vested interest in any of these companies, and I am not paid to 
compile this report.

2. LAT is an acronym it means "Lambdin's Accuracy Tests"

3. The chart is scanner certification pure an simple. I have the scanners 
passively  scan for viruses on the hard drive.

4. VCheck from Victor Charlie only detects the 60 or 70 most common 
viruses, and the authors of Victor Charlie "Alan Dawson, and John DeHaven" 
request that VCheck not be included in scanner certifications such as the 
chart in LAT.

5. The testing of scanners and the recommendations of generic virus 
detection software is two different tests.

First I extract a subset of my viruses to diskette. This subset contains 
specimens from all types of viruses.
 
Direct infectors, viruses that run as TSR, companion infectors, stealth 
viruses, polymorphic, boot sector infectors, etc.
 
Then I install this generic virus detection software to another diskette, 
then go into my CMOS and deactivate my hard drive temporarily,

I run the generic detection software, then run a virus, run a few small 
files so these files will be infected, then run this generic virus 
detection software If it detects the virus. I go through the same steps 
with another virus. It usually takes a few hours to fully evaluate one of 
these products. After the software has prooven that it can really detect 
new or unkmown viruses without relying on signature scanning, I put it in 
the list of generic virus detection software that I recommend.

Since there are several different ways to detect viruses with generic 
methods, It isn't easy to use a % scale like I use for the scanner 
certifications.
 
1. Integrity checking as used in Integrity Master, Untouchable, and Victor 
Charlie.
 
2. TSRs like PC-Rx and PC-cillin that looks for virus like activities.
 
Hooked interrupts
Access to the boot sector
access to the partition table
programs loading as TSR
tampering with executable files
and more.

3. trying to get infected on purpose like Victor Charlie

Bill

- ---
 * WinQwk 2.0 a#383 * Hacked version of Telegard TG29EALP.*
From: martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences)
Newsgroups: comp.virus
Subject: Re: Export restrictions of anti-virus software?
Date: 16 Jan 93 00:20:52 GMT

>From postings by Vesselin, Aryeh, and Frisk, I am informed 
that it would be against Canadian Law for me to "export" anti-
virus "shareware".

The Monkey virus, which originated in Canada, has been found in 
the US and in England.  The Killmonk program, an embarassingly
simple little snippet of code, also written in Canada (I haven't
been out of the country for months, something we Edmontonians notice
mid-winter), is one of few "convenient" ways of removing the Monkey
virus from a hard disk.  Killmonk is "freeware".  The entertaining
question of my week is "Am I breaking my country's Law by 
distributing Killmonk to persons and ftp sites outside Canada, 
to help them get rid of a virus that exported itself to them
from Canada?"   :)

Nothing like a little legal mirth to warm the winter spirit.

Tim.

 -------------------------------------------------------------
  Tim Martin                   *
  Spatial Information Systems  *   These opinions are my own:
  University of Alberta        *      My employer has none!
  martin@cs.ualberta.ca        *
 -------------------------------------------------------------
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: OS2SCAN99 checked (OS/2)
Date: 14 Jan 93 12:00:49 GMT

KARGRA@GBA930.ZAMG.AC.AT writes:

> OS2CLEAN: at least I found no problems, when I tried to clean my system from
> [JERU].

Are you -absolutely- certain about that? You see, Jerusalem makes some
silly assumptions about the format of the EXE files. As a consequence,
it destroys some EXE files it infects (e.g., WordPerfect). It is my
understanding, that it will destroy all Windows applications, and I
think that OS/2 applications have a similar structure. Therefore, no
disinfector would be able to recover such files, although some
intelligent disinfectors warn the user that these files are destroyed.

> Is there a reason, why you still
> don't scan *.DLL?

At least I do not know any virus that could infect them... And since
SCAN is able to detect only known viruses, it doesn't make sense to
scan objects that the known viruses do not infect...

> You added new extensions, of which I never thought, they
> would contain executable code (*.PIF). So I learned some new things. If

The .PIF files contain a pointer to an executable file. Therefore, it
is possible to apply a companion-type attack to them - change the
pointer to another executable that contains the virus body and let the
virus itself execute the original program. However, no such virus
exists yet, which means that there is no need for a scanner to scan
these files. They should be checked by the integrity checkers,
however.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: DOS Viruses under HPFS (OS/2)
Date: 14 Jan 93 17:24:35 GMT

antkow@sis.uucp (Chris Antkow) writes:

> Being a virus researcher myself, I find it sometimes suicidal to test
>out and disassemble new stealth and polymorphic class viruses on my
>DOS based PC. I'm deathly paranoid that it's going to escape on one of
>my floppies and infect the rest of my house... Even though I know my
>ASM a bit better than the average Joe, who knows what might happen.

Well....what you need is a "clean room" - say, a setup like the one I
saw at Symantec - a room full of XTs, ATs etc, and several guys
working full-time in there analysing/testing viruses...and not allowed
to take them out of the room.

Realizing that this might not be practical in your case, I would
suggest a special, dedicated machine, just for running viruses.

If that is too expensive, consider adding a switch to the outside, to
make the disk read-only while you are looking at the viruses.

- -frisk

Fridrik Skulason      Frisk Software International     phone: +354-1-694749
Author of F-PROT      E-mail: frisk@complex.is         fax:   +354-1-28801