HDTenEightyP/NetNews huggingface dataset:
From: WHMurray@DOCKMASTER.NCSC.MIL
Newsgroups: comp.virus
Subject: The Harmless Virus
Date: 29 Sep 92 02:46:25 GMT

Padgett Peterson notes that:

>Problem is that many viruses do not attach themselves properly to files &
>overwrite part of the file or lose the original pieces. Once this happens
>the file cannot be reconstructed. Unlike the movies where every virus does
>exactly what it is supposed to, in the real world virus code is incredibly
>buggy. Possibly this is because those people who could write one without
>without bugs won't 8*) - but don't count on it. (do you hear an echo
>here ?)

I would like to suggest that the problem is more fundamental than
simply one of skill.  Writing a perfectly harmless virus requires a
perfect knowledge of the environment.  Not only must the writer
understand the execution environment perfectly, but he must also 
understand the population perfectly.

Padgett observes:

>For instance, Michelangelo is known to foul up 720k floppies, not
>deliberately,
>but because it *assumes* that all non-360k floppies are the same.

This is a simple oversight, but writing the perfectly harmless virus
requires this knowledge plus perfect knowledge of all other relevant 
factors about every system in the population.  Such perfect knowledge
is impossible.

____________________________________________________________________
William Hugh Murray                     203-966-4769
Information System Security             203-326-1833 (CELLULAR)
DOCKMASTER
                                        MCI-Mail: 315-8580
                                        TELEX: 6503158580
                                        FAX: 203-966-8612
                                        Compu-Serve: 75126,1722
49 Locust Avenue, Suite 104             PRODIGY: DXBM57A
New Canaan, Connecticut 06840
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: TSR runtime scanner needed (PC)
Date: 2 Oct 92 16:07:43 GMT

monta_l@dist.dist.unige.it (Marco Gualdi) writes:

>similar program, so the sources are agreed. I have a lot of problem
>with the Stanco virus (a local production, I suppose). Bontchev, Frisk
>and McAfee know it, but no scanner recognize it, jet.

Uh, F-PROT 2.05 recognizes it, although it gives a false alarm in one
case (PKLITE'd BACKUP.EXE, I think)....sorry, fixed in 2.05a.

- -frisk
From: b645zjy@utarlg.uta.edu (STEPHEN HUFNAGEL)
Newsgroups: comp.virus
Subject: Possible Virus (PC)
Date: 4 Oct 92 03:52:00 GMT


   Hi.  Does anyone know if there is a bug in VSHIELD ver 3.9 in
detection of virus programs?  The reason that I am asking is that
VSHIELD ver 3.9 recently detected the "Crypt-1" virus in one of my
programs.  Unfortunately I do not have the disinfecting program that
goes along with VSHIELD ver 3.9, and other virus dectection programs
that I have used do not dectect anything wrong with the program.  Some
of the other programs that I have used to detect it are: VSHIELD ver
5.1c, SCANV ver 8.7b, F-PROT ver 2.05, and Norton Anti-Virus.
   What ever VSHIELD ver 3.9 is detecting is apparently not spreading
as the problem is not detected in any other program of mine.  And the
program that is detected to be infected is a few hundred bytes smaller
that the original one (VSHIELD does not detect the problem in the
original or copies of the original).

    If anyone has any suggestions as to how to get rid of this
possible virus, please contact me at: B645ZJY@UTARLG.UTA.EDU

    Also if anyone has any documentation on the "Crypt-1" virus,
please E-mail that to me also (I have been unable to find any
information on it).

   B645ZJY@UTARLG.UTA.EDU
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: Maltese Amoeba (PC)
Date: 1 Oct 92 02:30:08 GMT

Jerry Reno asks:
>Does anyone know anything about the Maltese Amoeba virus? I've
>been out of it for a bit, and just got a memo from a software
>company (John Wiley & Sons) informing me that some of their disks
>were infected.

>The letter only suggests that the virus "may, unfortunately,
>affect files on your hard drive" and that it is only detectable
>by the Norton Anti-Virus (Version 2.0).

It will not detect as such if the August, or later, defs update is
used.

>Being from a department (MSU Dept. of Statistics) that does not
>have acces to NAV, I'd really like to know if anyone has more
>information.....

Get a copy of NAVSCAN (freeware for individuals) and try it out at
home.

Jimmy Kuo                                       cjkuo@ccmail.norton.com
Norton AntiVirus Research
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: TSR runtime scanner needed (PC)
Date: 2 Oct 92 18:04:23 GMT

monta_l@dist.dist.unige.it (Marco Gualdi) writes:

> I need a TSR runtime scanner with the ability to scan for a single
> userdefined virus signature. 

Try TbScanX. You can get it from Simtel20 or its mirrors:
oak.oakland.edu:pub/msdos/trojan-pro/tbscnx31.zip (unless a later
release is available, of course).

> I'm able to compile e/o assemble a
> similar program, so the sources are agreed.

No sources, sorry.

> I have a lot of problem
> with the Stanco virus (a local production, I suppose). Bontchev, Frisk
> and McAfee know it, but no scanner recognize it, jet.

F-Prot 2.05 recognizes it too well, alas... It even reports a false
positive in some PKLited files. :-( Should be fixed in version 2.05a.

BTW, both F-Prot and SCAN allow the user to use scan strings defined
by him/herself. However, if you decide to do so, be careful not to
fall in the same trap that Frisk did - it is very difficult to select
a scan string for this virus that will not cause false positives,
since the virus is PKLited itself...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Unix security archive sites last changed 21 August 1992
Date: 1 Oct 92 18:55:33 GMT

Unix security archive sites		last changed 21 August 1992

cert.org
	Ken van Wyk <krvw@cert.org>
	Accessible through anonymous ftp, IP number 192.88.209.5
	A number of directories can be found in ~ftp/pub/tools.

funic.funet.fi
        Jyrki Kuoppala <jkp@cs.hut.fi>
        Accessible through anonymous ftp, IP number 128.214.6.100.
        Directory pub/unix/security contains programs to help in
        security, pub/doc/security contains various documents about
        security in general and unix security (like the worm
        documents)

wuarchive.wustl.edu
        Chris Myers <chris@wugate.wustl.edu>
        Accessible through anonymous ftp, IP number 128.252.135.4.
        A number of directories can be found in ~ftp/usenet/comp.virus/*.
From: monta_l@dist.dist.unige.it (Marco Gualdi)
Newsgroups: comp.virus
Subject: TSR runtime scanner needed (PC)
Date: 28 Sep 92 14:46:42 GMT

Hi folks!

I need a TSR runtime scanner with the ability to scan for a single
userdefined virus signature. I'm able to compile e/o assemble a
similar program, so the sources are agreed. I have a lot of problem
with the Stanco virus (a local production, I suppose). Bontchev, Frisk
and McAfee know it, but no scanner recognize it, jet.

_______________________________ | According  to the  latest  official  figures,
__/~\_______/~\____/~~~~~~~\___ | 43% of all statistics are totally worthless.
__/~~\_____/~~\___/~\_____/~\__ | _____________________________________________
__/~~~\___/~~~\___/~\_____/~\__ |       Marco Gualdi    MaGu on irc
__/~\/~\_/~\/~\___/~\__________ |        (monta_l@dist.dist.unige.it)
__/~\_/~~~\_/~\___/~\__/~~~~\__ | _____________________________________________
__/~\__/~\__/~\___/~\_____/~\__ | To be sure of hitting the target, shoot first
__/~\_______/~\___/~\_____/~\__ | and, whatever you hit, call it the target.
__/~\_______/~\____/~~~~~~~\___ | _____________________________________________
From: U8945535@csdvax.csd.unsw.EDU.AU
Newsgroups: comp.virus
Subject: Is there a new virus (720Kdisks) ? (PC)
Date: 25 Sep 92 05:43:22 GMT

Does anybody know of a virus that causes problems with 720K disks

I have heard a rumour that there is a virus that will prevent 720K
disks from being read or formatted.  This virus apparently does not
affect 1.44K disks.

I have tried several machines and several new disks and I can't work
out what the problem is.  It would be kind of reassuring if it was
simply a virus (maybe not a simple cure though!)
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: A few questions (Stardot/V801/Michaelangelo) (PC)
Date: 25 Sep 92 20:22:53 GMT

There seem to be some common mythconceptions here that I'll try to clear up.

>From:    "NBECC::KENNEY" <KENNEY%NBECC.decnet@consrt.rockwell.com>
(actually several postings on this but these questions were intelligently
phrased).

>- - how stealthy was Michaelangelo, and does it survive warm boots?

It is (not was) not "stealthy" at all and does not survive warm boots (but 
don't rely on it). In fact it is rather stupid but that does not make it
any less dangerous.

>- - can you tell where the start and end of an infected file are supposed to
>be algorithmically, so that one routine could trim off all length-variants of
>one or more virii?

If the virus is "well written" and does not "intend" destruction this might
be true. Unfortunately this is not the case.

For instance, Michelangelo is known to foul up 720k floppies, not deliberately,
but because it *assumes* that all non-360k floppies are the same.

Problem is that many viruses do not attach themselves properly to files &
overwrite part of the file or lose the original pieces. Once this happens
the file cannot be reconstructed. Unlike the movies where every virus does
exactly what it is supposed to, in the real world virus code is incredibly
buggy. Possibly this is because those people who could write one without 
without bugs won't 8*) - but don't count on it. (do you hear an echo here ?)

Of course buggy code is not only the provence of virus writers, I have been 
amazed at how bad "professional" software has gotten lately including
a couple of releases that IMHO should never have made it out of Alpha testing -
I mean stuff that will not work on certain platforms. Recently one piece
of commercial software was distributed containing 286 reserved instructions
an advetised for "all PCs". Another version 1.0 from a major house allowed
you to change the colours on everything *except* the active window. Sheesh.

>	Since Stoned + Michaelangelo = bye-bye FAT, this is getting
>very interesting.  (I've sent the Stardot to Norton, so maybe on their
>next update...)		

Not quite, I can always fix this combination without much trouble and no FAT
damage (well some overpopulated floppies maybe) but have heard a number of 
reports that if you add Norton's Disk Doctor  to the mixture, partitions 
have been lost, particularly HUGE ones.

					Warmly,

						Padgett
From: MISHRA@qut.edu.au
Newsgroups: comp.virus
Subject: lanprotect (PC)
Date: 29 Sep 92 02:13:00 GMT

Can anybody out there give me some info on LANPROTECT

thanx!
From: rxa21@po.CWRU.Edu (Ranjit Annamalai)
Newsgroups: comp.virus
Subject: Mcaffee Scan (PC)
Date: 23 Sep 92 05:49:19 GMT

I know I have a virus becauase Central Point Software Vsafe TSR can
detect it when it modeifies my *.com and *.exe but nothing I have run
(Untouchable 1.1 Mcaffee Scan and some numerous other scanners) have
not been able to find it I wanted to get the latest version of Mcafee
Scan to see if it can find it.  It is obviously a stealth virus
because it changes the file but does not tell any other program that
it is doing so.  I have other numersous signs that it is active and
after a few weeks it changes the boot sector of my HD luckily
Untouchable can restore it and I have a few more weeks to live.  I
gave this virus to my uncle in India and it totally TRASHED his
computer and has scared the living hell out of me because I have
detected the same signs of the virus on my computer as I did on his.
He did not give it to me because I never copied anything from him. But
I left $$$ of software with him because I assumed that they all had
the virus.  I would like any and all viruscanners good or bad.  I do
have FTP access and I would appreciate any help.  As of this moment I
am sending the files that I believe are infected to Central Point
Software and to Fifth Generation to see if they can find anything.

Ranjit
- -- 
Ranjit Annamalai
rxa21@po.cwru.edu
~!@#$%^&*()_
From: mgflax@phoenix.princeton.edu (Marshall G. Flax)
Newsgroups: comp.virus
Subject: Re: Information on CPAV and McAfee (PC)
Date: 23 Sep 92 14:31:35 GMT

sengteik@iti.gov.sg (Chua Seng Teik (RC)) writes:
>I am doing an evaluation on some Anti-Virus packages and I have
>narrowed down to 2 products namely Central Point AntiVirus and
>McAfee's suite of products. 

And not F-Prot?????  I'm very surprised.

marshall
- -- 
=========== 5 Joyce Lane, Woodbury, NY 11797, 516-364-9331,9379 ===========
============ PGP 2.0 Public Key available by finger or request ============
===== c/o Jack Gelfand,Psych Dept,Princeton U.,NJ 08544,609-258-2930 ======
= Original material(c) 1992, Marshall Flax <mgflax@phoenix.Princeton.EDU> =
From: hotpoint@cs.concordia.ca (BRUTON raymond)
Newsgroups: comp.virus
Subject: Ping Pong imitation (PC)
Date: 2 Oct 92 19:22:44 GMT

Just a note, this may save somebody some headaches.

	I recently had what looked like the ping-pong virus with a
squished ball (the normal curser) while running Soft-PC on an apple
Powerbook.  I tried unzipping FP-205.zip using PKZIP v1.93a alpha
version, it would hang and the curser would go ping-pong fashion.  I
checked the disk with F-Prot205 and it was OK.  I went back to the
official version of PKZIP v1.10 and it would unzip OK.  My PKZIP
v1.93a would work fine on the same file of a normal 486-33 desktop
system.  It looks like some illegal instruction occurred on the
Soft-PC powerbook configuration.
	One thought on this though, with the emerging of mixed
technologies, could the Soft-PC's system areas be affected by viruses
and could they be repaired in the regular ways and I don't think that
I am able to do the standard procedure of booting from a non-infected
floppy for scanning.

				hotpoint@cs.concordia.ca
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: Maltese Amoeba virus (PC)
Date: 29 Sep 92 20:05:16 GMT

samsung!ulowell!cps.msu.edu!reno@uunet.UU.NET (Gerald L Jr Reno) asks
about the Maltese Ameoba virus, and Vess gives a good summary of what
it does.  A tiny bit more non-technical information: it's also known
as the "Grain of Sand" virus (by us at IBM) and the "Irish" virus (by
McAfee Assoc and perhaps others).  It's been in IBM's virus scanner
since last November or so (version 2.1.6 and after).  There was a
small wave of reports around the turn of the year, but I don't think
we've seen any lately.  DC
From: ian@bvsd.co.edu (Ian Nelson)
Newsgroups: comp.virus
Subject: TBav50 beta or just regular tbav50 (PC)
Date: 23 Sep 92 21:18:10 GMT

Is there an FTP site that has TBAV 5.0beta (or non beta if it's done
yet)?  adv(tnx)ance,

Ian Nelson
- -- 
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.0
mQBYAiqtYqEAAAECWKssWKoVxXAu9S0A/rKepT1GT+PJjv+lHh1LyIYwI9gzfnoq
ydwdKIJ81qIDgkMAliSIOWZiGSYbXszmmspRDenRARe15NOEM36pGQAFE7ABh7Qc
SWFuIE5lbHNvbiA8aWFuQGJ2c2QuY28uZWR1PrABAw==
=bpll
- -----END PGP PUBLIC KEY BLOCK-----
From: swarupv@gov.on.ca (Vivek Swarup)
Newsgroups: comp.virus
Subject: FLIP, TELECOM, SCREAMING FIST and MBR type Viruses using F-prot (PC)
Date: 24 Sep 92 13:31:30 GMT

Our PCs are scanned using Central Point Anti-Virus (CPAV) upon boot.
On 1 of our PCs CPAV detected some virus but could not tell us which
one.  We obtained a copy of f-prot V2.02 which indicated this system
had a FLIP Virus. We obtained a new version of f-port (v2.05) which
indicated the PC has the TELECOM Virus.  Shortly there after we had
difficulties booting the PC.  After considerable work, we renamed the
CONFIG.SYS and were able to boot the system.  Meanwhich similar
difficulties occured on another system on which f-prot indicated a
Flip Virus then a Telecom Virus and then a Screaming Fist Virus
existed before it became un-bootable.  We have rectified these
systems.  F-prot is reporting many other systems the FLIP oe Telecom
Virus.  Of course, we ensured CPAV was removed before re-running
f-port.

Any insight into either these viruses, Stealth Viruses or f-prot would
be appreciated.  If you are aware of magazines or articles we can
subscribe to or any good books, especially on Stealth Viruses, please
let me know.  In Advance, thanks for your help.

Vivek
swarupv@moh.gov.on.ca

PS. I am a new user to Internet, News, and vi. 
    Having fun (at times) but am primarily on the learning curve.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: virus dissection (PC)
Date: 23 Sep 92 08:26:00 GMT

seborg@csrc.ncsl.nist.gov (Brian Seborg) writes:

> Patricia Hoffman's VSUM lists the 1530 virus as CB-1530 (according to
> her July 1992 version).  Your description seems to more closely
> resemble the 1963 virus.  Both of these viruses are related to the
> Dark Avenger Virus so this may account for McAfee's seeming mis-

Two points: First, as Frisk mentioned, it was a completely new virus
(Alexander), not even belonging to the Dark_Avenger family. Second,
1963 (Necropolis) and the Dark_Avenger viruses have nothing in common.
They are completely different, belong to different families, infect in
a different way, use different tricks, and are written by different
people.

> to see if in fact you have the same beast.  Patricia's VSUM should be
> helpful in determining if you are at least talking about a similar
> virus or not.

I disagree. VSUM is full of errors and not helpful at all to provide
correct, technical virus information. In fact, I challenge anyone to
find an entry in VSUM, which has no errors and/or omissions...

Some comments about the "virus research algorithm" that you described
(I'll save the bandwidth and will not quote it here). Have in mind that
some viruses are very capricious and you have literally to feed them
with a spoon, in order to make them replicate. The Rythem virus
infects only files that are not in the root directory. Dr_Watson
infects only AUTOEXEC.BAT. Some of the Astra viruses infect only
device drivers. Some viruses (Tequila and StarShip, I think) will not
infect, if you don't have a hard disk - because they don't go
resident when you run an infected file, but only modify the MBR and
wait until the user reboot... There are some other pitfalls. We have a
huge amount of files here, about which we cannot easily decide whether
they are viruses, trojans, buggy programs, or just innocent tools.
They all refuse to replicate on the systems we have tested them, but
this does not imply that they will not replicate on some other
systems. The only way to solve the problem is to disassemble each one
of them and see what it does. And this is a LOT of work...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Amiga Anti-viral archive sites last changed 17 August 1992
Date: 1 Oct 92 18:52:28 GMT

Amiga Anti-viral archive sites		last changed 17 August 1992

eugene.utmb.edu
	John Perry <perry@phil.utmb.edu>
	This site can be reached through anonymous ftp.
	The Amiga anti-viral archives can be found in the
	directory /pub/virus-software/amiga.  The IP address is 129.109.1.21.
	A backup site is maintained at beach.utmb.edu,
	IP address 129.109.1.207.  Look in [ANONYMOUS.PUB.VIRUS.AMIGA].

ms.uky.edu
        Sean Casey <sean@ms.uky.edu>
        Access is through anonymous ftp.
        The Amiga anti-viral archives can be found in /pub/amiga/Antivirus.
        The IP address is 128.163.128.6.

uk.ac.hensa.micros
	HENSA/micros Managers <hensa@uk.ac.hensa.micros>
	Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
	NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
	FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
	Software archive for UK higher education sector. Anti-Viral stuff
	is not collected into a distinct area. Hostname is in UK format.
	(This site previously known as uk.ac.lancs.pdsoft.)
Xref: sparky comp.msdos.programmer:58 comp.sys.ibm.pc.misc:13114
From: nejib@eecs.umich.edu
Newsgroups: comp.msdos.programmer,comp.sys.ibm.pc.misc,comp.ibm.pc.hardware
Subject: Interrupts on IMB PC -- (386 DX 33 Mhz)
Date: 27 Sep 92 19:04:33 GMT
Organization: University

I have a timer board ( Intel 8254) which generates interrupts (if you must
know, the cheap setup is as follows: the three counters of the 8254 are
cascaded and their final output is hooked to an 8255 I/O chip, on the same
board, which is hooked to IRQ7). The problem is that upon initialization the
counter's output goes from high to low and the PIC ( 8259 ) buffers (?) an 
interrupt. So, immediately after the IRQ7 is enabled an unneeded interrupt 
is generated.

My question is: Is there a way of telling the PIC (8259) to forget about
the last interrupt request on IRQ7; disabling the interrupt won't do
it, since, apparently, it is buffered.

Thanks in advance; and would you please answer me by e-mail, since I do
not read this group often.


                             --Nejib
From: ct@dde.dk (Claus Tondering)
Newsgroups: comp.programming
Subject: Re: Daylight saving time (UK)
Date: 5 Oct 92 08:14:31 GMT
Organization: Dansk Data Elektronik A/S

seggers@semyam.dinoco.de (Stefan Eggers) writes:

>In  germany it [Daylight saving time] goes from 2:00 AM to 3:00 AM
>(in spring) or 3:00 AM to
>2:00  AM  (in  fall).  It starts on easter sunday and ends on the last
>sunday in september.

No. It starts on the last Sunday in March, which may or may not be
Easter Sunday.
-- 
Claus Tondering
Dansk Data Elektronik A/S, Herlev, Denmark
E-mail: ct@dde.dk
Newsgroups: comp.programming,comp.lang.c,comp.lang.pascal,comp.lang.objective-c
From: tholle16@ursa.calvin.edu (Tim Hollebeek)
Subject: Re: NO NUMBERS! (or even SHORT INTS!)
Organization: Calvin College
Date: Mon, 28 Sep 1992 04:41:48 GMT

jfr@RedBrick.COM () writes:

>So I suggest a coding standard: numbers should be barred from use in
>variable and type names.  Only letters can be used.  Numbers can only
>appear where you define manifest constants (#def, const, etc.) to 
>names and inside strings (where they generally do no harm).  

>Any comments?

yes.  what about if i use two strings named string1 and string2?
I know I could use an array, or name them better, but alot of times it
is more convenient just to number them, e.g.

void Line(x1,y1,x2,y2)
int x1,x2,y1,y2;
{
   ...
}

just my $0.02.


--
--------------------------------------------------------------------
*******     Tim Hollebeek  ==> tholle16@ursa.calvin.edu      *******
The best thing about growing older is that it takes such a long time.
Newsgroups: comp.programming,comp.lang.c,comp.lang.objective-c,comp.lang.pascal