HDTenEightyP/NetNews huggingface dataset:
From: mechalas@expert.cc.purdue.edu (John Mechalas)
Newsgroups: comp.virus
Subject: Re: F-PROT and Stoned variant (PC)
Date: 17 Dec 92 22:13:03 GMT

CHIP@BDSO.Prime.COM (Chip Seymour) writes:
>>From V5 #200:
>
>> We may have found a new variety of STONED on our campus. 
>> F-Prot 2.06a identified it as a STONED virus but refused to
>> remove it. 
>
>We've had three instances of the same problem here. In two cases FDISK
>/MBR corrected the problem with no adverse side-effects. The user in
>the third case is reluctant to run FDISK on a DOS 3.0 machine.
> 
>Anyone know what'll happen if we do that?

The MBR is DOS ver. independant.  Simply boot his DOS 3.0 machine with
a DOS 5.0 floppy, run FDISK /MBR, and you won't have any problems.

- -- 
John Mechalas                      | If you think my opinions are Purdue's, then
mechalas@expert.cc.purdue.edu      |      you vastly overestimate my importance.
Purdue University Computing Center |             Help put a ban on censorship :)
General Consulting                 |                       #include disclaimer.h
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Odd Virus? HELP (PC)
Date: 11 Dec 92 19:44:34 GMT

ctoth@magnus.acs.ohio-state.edu (Christopher M Toth) writes:

> sure I wasn't going to make backup copies of any virus. NAV told me
> that it had detected the Pakistani virus and another one called the
> Brain virus.

Very silly from the part of NAV, since Brain does not infect hard
disks...

> First of all, I thought the Pakistani virus was only a
> floppy disk infector.

Exactly.

> Anyway, I exited NAV after the warning and tired
> using NAV again as a second check, well, this time NAV comes up with
> NO viruses on my hard drive.

Hmm... Are you using some other anti-virus software, by (mal)chance?

> But when I checked my directory, I
> noticed that some of my files(50-60%) had their dates changed to dates
> ranging from 1955 to 1965. Can anyone help me out here??

Huh??? How can you achieve that?? As far as I know, the "year zero" in
MS-DOS is 1980 and you just cannot have a date before that... Speaking
about that, -how- do you know that the years have been in the 20th
century? The DIR command displays only the last two digits of the
year... Are you sure that the dates have not been from 2055 to 2065?

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: A.APPLEYARD@fs1.mt.umist.ac.uk
Newsgroups: comp.virus
Subject: disinfectors that leave ghosts of viruses (PC)
Date: 16 Dec 92 09:03:30 GMT


  OVERBERGER@GW.WMICH.EDU wrote: "... new variety of STONED ... infect the
partition table of infected DOS machines ... F-Prot 2.06a [and CLEAN]
identified it as a STONED virus but refused to remove it...
  FRISK@COMPLEX.IS replied: ... old problem ... disks ... infected with
stoned, and improperly disinfected by a program that just overwites a part
of the boot sector with valid code, leaving a part of the virus, so
[FRISK's] program gets a partial match...

  These 'ghosts' of killed viruses are perennial problem. It would be
useful if a FAQ entry could be made listing: (1) what variants of what
virus-removers leave ghosts and don't properly ghostbust after themselves;
(2) how a user can ghostbust after using such an untidy virus-remover, so
that he doesn't keep getting these false alarms.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Untouchable (PC)
Date: 11 Dec 92 21:44:35 GMT

RADAI@vms.huji.ac.il (Y. Radai) writes:

>   Regardless of the exact number, there's a strong possibility that
> Vesselin's first statement above will be misinterpreted by some
> readers, who might think that being able to handle only "one third of
> them" (i.e. of the *infection methods*) implies being able to
> disinfect only one-third of the *viruses*.  In case anyone did get

Yes, of course. One third of 17 known types of virus infection still
means an INFINITE number of unknown viruses that the product is able
to disinfect correctly.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: kmcvay@oneb.almanac.bc.ca (Ken Mcvay)
Newsgroups: comp.virus
Subject: INFO SOUGHT: FILLED virus (PC)
Date: 16 Dec 92 04:10:52 GMT

One of my leaf sites (news/mail) recently lost their data to FILLED -
the machine that went down (FAT out to lunch) was repaired by
reformatting the disk (high level, w/MS-DOS 5.0) and re-installing the
software.

When SCANV was run, it warned of FILLED three times, after the format
- - local rumour has it FILLED resides on an area of the disk DOS
doesn't read - at any rate, after three warnings, the system was shut
down.

I installed the latest versions of SCANV and CLEAN onto the system
today, and ran both from a write-protected floppy. No warning
appeared, and clean aborted with nothing to do. I did not try the
older version of SCANV again.

Is it gone? Is there a difference in the latest flavour of SCANV's
approach to FILLED that might cause a miss? FILLED is listed as a
stealth-type in the McAfee doc's, and I'd like to know more about that
as well - enough, at any rate, to be comfortable in thinking the
infection is gone.

If someone can point me towards an ftp site where I can find some
information re FILLED, I'd appreciate it, or it could be mailed to me
privately if it's 'old hat' - if not, here's fine :-)

- --
The Old Frog's Almanac - Public Access UseNet for Central Vancouver Island
     (604) 245-3205 (v32) (604) 245-4366 (2400x4) SCO XENIX 2.3.2 GT
 Ladysmith, British Columbia, CANADA. Just south of Tupperware Central...
                 Information is power - get connected
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Floppy Booting (PC)
Date: 15 Dec 92 21:35:26 GMT

mramey@u.washington.edu (Mike Ramey) writes:

>One of my questions is this: VSHIELD intercepts a keyboard reboot and
>checks for the presence of an infected diskette in the boot diskette
>drive; it does not allow booting from a (boot-sector?) infected
>diskette.  Does VIRSTOP have this function? 

I might mention that the FreeWare NoFBoot (one of the FixUtils) will
accomplish this by denying reboots if a floppy is in the A drive.
Since rarely do users really want to boot from a floppy, this can be
an effective defense (of course if they *really* want to boot from a
floppy, VSHIELD cannot stop a fast finger either...)

					Warmly,
						Padgett
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Posting Philosophy (PC)
Date: 18 Dec 92 16:09:16 GMT

Recently I have been posting too many things about CHKDSK.EXE and wish
to apologise to the readers. It does point out a desperate need
though.  (Yes, Virginia, we are back to a National Laboratory).

Consider all of the bandwidth that has been used to say three things:
1) What the risk was.
2) How do you tell if you are at risk.
3) What do you do about it.

And really this should have occurred sometime before 11-11-91 since it
was known then. For me, it was just chance that the disk purchased
just over a month ago did mot suffer the same fate (one partition is
within 100 "allocation units" of the danger mark). True, it has been
just in the last year that big disks became common and since most disk
compression routines use 8,192 byte clusters, they were not at risk
(though the day before yesterday I saw a system with a 600Mb STACKed
disk - guess what the number of clusters was ?)

But, if we had at any time a responsible posting giving the three
elements above as an "advisory", note would have been taken,
corrections made, and we would have gone on. It wasn't and disks had
to become corrupted before public notice was made and then knee-jerk
reactions were made (does this sound like Michelangelo).

NIST has apparently abandoned the PC. Magazines try but they are not
necessarily looking at the right things or looking the right way. So
it is relegated to us amateurs & like most things "you get what you
pay for".

				And a Merry Christmas to all,

							Padgett
             *
             |
            abc
           defgh
          ijklmno
         pqrstuvwx
        yzabcdefghi
       jklmnopqrstuv
           wxyz
            |
           ---
From: rslade@sfu.ca
Newsgroups: comp.virus
Subject: CHRISTMA Wannabes 2 (CVP)
Date: 11 Dec 92 22:03:00 GMT



HISVIRM.CVP   921022
 
                    CHRISTMA Wannabes - part 2
 
(continued from last week ...)
 
In December of 1988, VMS systems on DECNet networks were hit by a
worm based on a file called HI.COM.  COM files on VMS systems are
similar to the REXX exec files and MS-DOS "batch" files.  They are
"programs" in VMS DCL "source" code.  HI.COM used the fact that
DECNet nodes had, by default, a standard "anonymous" account that
could be used, by the network and other machines, to gain limited
access to a machine.  This account was able to start processes
running.  The process that HI.COM started was intended to replicate,
submit itself to other machines, to inform a specific account at a
specific site, and to wait until midnight on December 24th, 1988,
and then start mailing Christmas greetings to all users.  The
content of the message and the notification address seemed to
indicate a German author with access to an account in France.  The
first notifications of this infestation came from the NASA SPAN
network and the US Department of Energy's HEPNET.
 
HI.COM owed a number of features to the Morris worm.  One was a
"stealth" technique, whereby the file was copied into memory and
then erased from the disk.  Another stealth procedure used by HI.COM
was the use of a process name suggestive of normal mail routines.
 
Spring of 1989 saw a resurgence of interest in mutating the original
CHRISTMA on VM systems.  A modified version (BUL EXEC) was released
from the EARN backbone site in Turkey on March 8, ORGASM EXEC was
released from Pennsylvania State University on April 4, and HEADACH
EXEC found at the University of Ottawa on April 8.  DIR EXEC,
discovered November 1989, purported to be a version of the MS-DOS
DIR command for VM systems, but was a dropper for CHRISTMA.  There
was a Turkish version EXEC in November 1990, called TERM MODULE, and
a reposting of CHRISTMA EXEC to alt.hackers in December of 1990. 
The latest reported sighting was as GAME2 MODULE in January 1991.
 
The WANK/W.COM worm of October 1989, and its successor, owed most of
its inspiration (if you can call plagiarism inspiration) to the
Morris worm and HI.COM.
 
Finally, there was the XA1 Christmas Tree PC virus in March 1990. 
Although it owed no technical or programming detail to any of the
network worms, it seems to have been written "in memoriam".  It
contains (in German) the message, "And still it is alive : The
Christmas Tree !"
 
copyright Robert M. Slade, 1992   HISVIRM.CVP   921022

==============
Vancouver      ROBERTS@decus.ca         | "virtual information"
Institute for  Robert_Slade@sfu.ca      |   - technical description of
Research into  rslade@cue.bc.ca         |     marketing info disguised
User           p1@CyberStore.ca         |     as technical description
Security       Canada V7K 2G6           |            - Greg Rose
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Not a Stupid OS/2 Question (OS/2)
Date: 11 Dec 92 07:54:33 GMT

Kevin_Haney@nihcr31.bitnet writes:

>Yes, I too wish that F-PROT, otherwise an excellent product, could be
>modified to recognize the fact that it may be running on an OS/2
>machine

Well, that is reasonably easy to do.  However, what is really needed
is a way to find out if a given drive letter corresponds to a FAT or a
HPFS system.

F-PROT seems to work OK on HPFS systems (apart from problems with long
file names, like many other DOS programs), if it refrains from
scanning the boot sector.  This is on my list of things to do - but as
a temporary solution, just telling it not to scan the boot sector when
working on HPFS seems to work.

- -frisk
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: DOS CHKDSK bug (PC)
Date: 16 Dec 92 12:49:15 GMT

RPH0470@tntech.bitnet (Richard Hosker) writes:

> BTW, by my reckoning, the 65280-cluster limit represents a partition of
> about 130 MB.  No small bug, this... :-(

It is actually worse... The bug triggers on any partition with sizes
between:

	 127 and  129 Mb
	 254 and  258 Mb
	 508 and  516 Mb
	1018 and 1030 Mb
	2035 and 2061 Mb

It's a VERY serious bug and Microsoft deserves a serious flaming for
not telling us for more than a year! Yes, they knew about it one year
ago!

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: yoshida@microsupport.sas.upenn.edu (Dan P. Yoshida)
Newsgroups: comp.virus
Subject: VI-SPY 10.0 spitting out strange numbers... (PC)
Date: 17 Dec 92 18:41:36 GMT

VI-SPY 10.0
RG Software Systems, Inc.

Has anyone encountered this problem with VI-SPY 10.0?

I have vi-spy running from the autoexec.bat on a Northgate
386 that has a Stacker "stacked" drive.

On boot up, vi-spy starts to check for viruses, then it spits
out four numbers, <<3031>>,<<3120>>,<<E8F4>>,<<4549>>,
then the system freezes (need to hit the reset button).

- --dan

 =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
 |  Dan P. Yoshida                                       | University of |
 |--PC Specialist--  yoshida@mail.sas.upenn.edu          | PENNsylvania  |
 |--SAS Computing--  yoshida@quantum.sas.upenn.edu(NeXT) | o-o_o-o_o-o_o |  
 =--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Will the real MS-DOS 5.00 please stand up (PC)
Date: 15 Dec 92 17:45:57 GMT


	The recent CHKDSK problem brings up the question "Just how
many MS-DOS 5.00s are there are how can you tell ?" I must admit to
having been buried in antiquity with my studies of antediluvian boot
sectors but this controversy and the accompanying VER /R debacle
brought this up.

	First, I am sure that by now everyone knows that no matter
which version of MS-DOS 5.00 is booted (from the beta 5.00.409c (1990)
to the beta 6.00.0015 (1992)), VER /R returns "Revision A".

	Just checking through my stuff I have found three different
released versions of MS-DOS 5.00 dated 03-22-91, 04-09-91, and
11-11-91. All report simply MS-DOS 5.00 though various components are
different (all COMMAND.COMs COMPare the same @ 47845 bytes & VER is an
internal command).

	For completeness, I would like to know if there are any other
MS-DOS 5.00s out there and is there any differentiation between them
other than date (to spare the group, please reply privately to
padgett@tccslr.dnet.mmc.com, I will post any interesting discoveries).
Please only *real* Microsoft versions - I know of different DOS 5.0s
from IBM, COMPAQ and ZENITH for example.

					Warmly,
						Padgett
From: FRAHM@UCSU.COLORADO.EDU (Joel A. Frahm)
Newsgroups: comp.virus
Subject: Re: Is this a DOS virus? (PC)
Date: 10 Dec 92 00:44:25 GMT

echrstmn@lab4.smcm.edu (Evan Christman) writes:
>From: echrstmn@lab4.smcm.edu (Evan Christman)
>Subject: Is this a DOS virus? (PC)
>Date: 2 Dec 92 02:03:47 GMT
>
>	On one of our PC's we are observing some odd behaviour of our
>DOS files.  The symptoms are: certain DOS files, share, dosshell and a
>few others report that their size has been altered when I run a
>CHKDSK.  Also we have been getting non-fatal errors during Windows
>sessions.  In addition, one file reports that it has been "reallocated
>to block 505."  I have ran F-prot 206, and pro-scan on it.  When they
>read the files they report that the above files are "unreadable."
>	I was wondering if anyone else is experiencing the same
>behaviour, or if anybody has some ideas of what to look at.
	
	You may also check this out: If you have an IDE or SCSI or
some drive type like that, make sure the controller ROM memory
location is protected.  In system.ini, the command is EMMEXCLUDE
(address-address).  This will insure that Windows won't try to write
to that memory area, and thus send weird commands to the hard disk.
I've had this happen before, and the effects ar similar to what you're
discribing.

Joel.  (frahm@ucsu.colorado.edu)
Newsgroups: comp.msdos.programmer,comp.os.msdos.programmer,comp.sys.ibm.pc.programmer
From: 401yclee%vax9k.dnet@nchud1.nchu.edu.tw (My name is...)
Subject: REQUEST: (FAQ?) routines for multiharmonic sound on the speaker
Organisation: National Chung Hsing University, Taiwan
Organization: NCHU, TAIWAN 
Date: Tue, 15 Dec 1992 13:55:17 GMT

Hi, 

This message was originally posted in comp.binaries.ibm.pc two weeks ago, until
now, I found I'm posting to a wrong group. So here's the message (modified):

I'm trying to program my speaker to sound more pleasurably, (yes, I know this
has been a prehistoric feat). But I'm trying. The question is how can I program
the chip (8253) to let it send out more than one harmonic like those BEEP when
you do something dangerous to the programs.

Are there any PD source routines that can be retrived via ftp? I'll summarize
the responses, since somebody out there has send me a message telling me that
he/she is also interested in such.

Thanks in advance.

YC Lee
internet: 401yclee%vax9k.dnet@nchud1.nchu.edu.tw <- sorry about the odd format
		my account is not on the mail server campus wide.
From: sjm@bcrki65.bnr.ca (Stuart MacMartin)
Subject: Re: Find-a-Word / Crossword HELP
Keywords: Find-a-Word, Crossword
Organization: Bell-Northern Research Ltd., Ottawa, Canada
Date: Wed, 16 Dec 1992 14:07:57 GMT

In article <u910826.724466510@bruny> u910826@bruny.cc.utas.edu.au (Louis        siuoL) writes:
>HELP can anyone help me out with an efficient algorithm to generate word grids
>given a list of words? 
>I will need to be able to specify the grid size and the individual words.
>
>Some Shareware/PD source in TP 6/7 would be *very* nice!

Read rec.puzzles.crosswords.  A bibliography of articles about crosswords
was posted there.  Also, several people who read/post to the group are
interested in such things.

Stuart

--
: Stuart MacMartin                                    email: sjm@bnr.ca      :
: Bell-Northern Research                              phone: (613) 763-5625  :
: PO Box 3511, Stn C, Ottawa, K1Y-4H7, CANADA    Standard disclaimers apply. :
Newsgroups: comp.programming
From: mjg@ktbush.ogo.dec.com (Michael J. Grier)
Subject: Re: reentrant code
Reply-To: mjg@ktbush.ogo.dec.com (Michael J. Grier)
Organization: Digital Equipment Corporation
Date: Sun, 13 Dec 1992 22:13:14 GMT


In article <1992Dec13.051634.14815@linus.mitre.org>, crawford@boole.mitre.org (Randy Crawford) writes:
|>
|>>The problems of reentrancy are a bit different from concurrency. 
|>
|>True, but reentrancy is irrelevant unless concurrency in some form (like
|>context switching) is involved.
|>

   Untrue.  Consider a module which implements an abstraction of a queue
or other searching structure, which provides a service for iteration on the
data structure.  If you specify the service such that the caller provides
a function to execute for each element in the structure, there is again
a need for reentrancy controls of some fashion.

   The reentrancy controls may be as simple as documenting, "Do not attempt
to modify the data structure from the callback function.  If you do, the
world may come crashing down about your ears."

   On the other hand, you might try to do something more intelligent and/or
pro-active in the area, either setting a "busy" flag for the data structure,
and/or making a copy of the data before beginning the iteration process.
This takes time and memory.  [I prefer to provide both sorts of interfaces -
ones which are faster but have more operational constraints, and safer ones
which cost more.]

   My point is that reentrancy isn't a Boolean valued quality of a particular
service/procedure/function.  You may be reentrant from a signal point of
view, but not from a multi-threaded point of view.  My first example does not
use concurrency according to any definition with which I am familliar.

|>
|>| Randy Crawford        crawford@mitre.org        The MITRE Corporation
|>|                                                 7525 Colshire Dr., MS Z421
|>| N=1 -> P=NP           703 883-7940              McLean, VA  22102
|>

------------------------------------------------------------------------
I'm saying this, not Digital.  Don't hold them responsibile for it!

Michael J. Grier                           Digital Equipment Corporation
(508) 496-8417                             mjg@ktbush.dec.com
Stow, Mass, USA                            Mailstop OGO1-1/E16
From: ak014@cleveland.Freenet.Edu (Bill Novak)
Newsgroups: comp.programming
Subject: Mimic the ALT-CTRL-Period keypress
Date: 12 Dec 1992 08:34:16 GMT
Organization: Case Western Reserve University, Cleveland, Ohio (USA)
NNTP-Posting-Host: slc4.ins.cwru.edu


Any ideas on how I can mimic the Atl-Ctrl-Period keypresses on
an IBM PC?

While running one program, I want to drop to DOS and - using
the Alt-Ctrl-Period - start execution of a second (previously
loaded) program...

What can I poke & where?
Newsgroups: comp.programming
From: roberts@angelo.amd.com (Dave Roberts)
Subject: Re: Binary to ASCII encodings (was Re: A better mousetrap)
Organization: Advanced Micro Devices, Santa Clara, CA
Date: Fri, 11 Dec 1992 20:13:18 GMT

In article <1992Dec9.132902.7930@unipalm.co.uk> tim@unipalm.co.uk (Tim Goodwin) writes:

>uuencode uses a fixed 3-byte -> 4-character encoding, for a 1.333
>swell factor.  (There is also some additional overhead, for example the
>line feed at the end of each line, and the "M" at the beginning of
>each.)

Just a quibble.  The "M" at the beginning of the line isn't an "M" per
say.  It's actually a length of the number of character in the line
that has been encoded in the same fashion as the six bits of normal
data are.  It so happens, however that most (all?) of the programs
that do uuencoding use the same line length.  If you look at the last
line of the encoded file, however, (the one before the "end" line)
you'll see that it probably isn't as long as the others and doesn't
have an "M", but rather something else as the first character.

In other words, if you're writing a decoder, don't look at the first
character of a line as an "M", look at it as a length.  It makes
everything general, and if anybody writes an encoder that uses a line
length different than "M" (which I suppose is legal), yours won't be
the decoder that breaks.

Dave Roberts
david.roberts@amd.com


Newsgroups: comp.programming
From: acgoldis@athena.mit.edu (Andrew C Goldish)
Subject: Programming contest
Organization: Massachusetts Institute of Technology
Date: Tue, 15 Dec 1992 21:31:25 GMT

  I am a relatively new subscriber to this newsgroup and did not get most of the
information about the programming contest.  Can you send over the complete file
with the details?

							A. Goldish
							acgoldis@athena.mit.edu
Newsgroups: comp.programming