HDTenEightyP/NetNews huggingface dataset:
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: The Harmless Virus
Date: 5 Oct 92 13:43:11 GMT

WHMurray@DOCKMASTER.NCSC.MIL writes:

> This is a simple oversight, but writing the perfectly harmless virus
> requires this knowledge plus perfect knowledge of all other relevant 
> factors about every system in the population.  Such perfect knowledge
> is impossible.

The above is, of course, true, but it also holds for any program, not
just for viruses. It is not possible to write a perfect program, which
will not damage anything in any conditions, just because of the
reasons that you are listing. Some such "imperfect" programs are
significantly more widespread that some of the "research" viruses.
:-) The only advantage is that they don't replicate by themselves and
do not try to run on your computer without your permission...

(Note: I am not advocating the writing of "harmless" viruses, I am
just observing a fact.)

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: VIRSCAN detects Yankee-Doodle 2885 (PC)
Date: 5 Oct 92 13:48:32 GMT

chess@watson.ibm.com (David M. Chess) writes:

> I think F-Prot calls it "Yankee (TP-44)".  Not too atrociously
> different!  *8) It's not a fascinating virus; it infects COM and EXE
> files, and sometimes plays the tune Yankee Doodle at 5pm.  It also

Well, the understanding of the word "fascinating virus" is subjective,
of course, but for me this virus has one very interesting property -
it is able to repair itself from random errors, using a Hamming
self-correcting code.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: comp.virus
From: oleg@csufres.CSUFresno.EDU (Oleg Kibirev)
Subject: Re: A less virus prone architecture
Organization: California State University, Fresno
Date: Fri, 9 Oct 1992 23:14:17 GMT
X-Posted-From: csufres.cs.csufresno.edu
NNTP-Posting-Host: sol.ctr.columbia.edu

In article <0015.9210091201.AA28919@barnabas.cert.org> rjk@world.std.com (robert j kolker) writes:
>I was reading a book on the Babbage analytica engine the other day,
>and it occurred to me that a Babbage machine may be less virus prone,
>then a Von Neuman machine.
>
>A Babbage machine differs from a Von Neuman machine, in that its
>program is external stored on a medium separate from the data store of
>the machine. Thus the operands of a program are in store, but the
>program that transforms them is not. The Babbage analytic engine was
>patterned after the Jacquard Loom.
>
So, how does a program gets loaded to RAM? Viruses don't modify a process
in memory, they change a file on disk. To make system harder to infect, you'll
have to use separate disk storage for data and programs. Now, how do you write
compilers in this case :). 

Of course, a system impossible to program is absolutely resistant to viruses.

Oleg

>The question I put is this. Is a computer, in which the program is
>stored in a totally separate memory space from data, less prone to
>virus attack or not.
>
>I would appreciate your opinions on this question.
>
>Conan the Libertarian rjk@world.std.com
>"If you can't love the Constitution, at least hate the Government"
>
>[Moderator's note: Pardon my ignorance on this, but wasn't the Babbage
>machine a 19th century mechanical computing device, and isn't there an
>effort under way to implement (again, in hardware) one of his later
>machines?  Are there any software implementations of his designs?]
From: HIIND@delphi.com
Newsgroups: comp.virus
Subject: Re: FLIP (PC)
Date: 7 Oct 92 06:12:43 GMT

Vivek Swarup of moh.gov.on.ca writes:

>On 1 of our PCs CPAV detected some virus but could not tell us which
>one.  We obtained a copy of F-Prot V2.02 which indicated this system
>had a FLIP Virus.  We obtained a new version of F-Prot V2.05 which
>indicated the PC has the TELECOM Virus.  Shortly there after we had

The explaination of the FLIP report by Henry Tindall of ankar2.af.mil
was an excellent example of conflicts between different Anti-Viral
products when cross testing files although other conflicts arise when
different Anti-Viral products are run consecutively due to testing 
residue in system memory of which we believe to be the case in the
TELECOM report by F-Prot which led us to the discovery of these 
residue conflicts.  The following are the results of the testing of
a Norton Disk Doctor undo file from the removal of the STONED virus
from a floppy disk.  Similar results can be achieved using any file
and various products run consecutively without cold rebooting to a 
clean dos between tests.
Norton Anti-Virus           Nothing
Virex                       Possible Stoned Dropper
ViruScan                    Nothing
Central Point Anti-Virus    Nothing
F-Prot                      Signs of Cascade in Memory
F-Prot                      Signs of Telecom in Memory
Integrity Master            P1 active in Memory
Virex                       Stoned Active in Memory
Scan                        Nothing

The initial Virex result is a correct result, although the others
are semi-correct in their own ways.  Since it is almost impossible
for Anti-Virus developers to test for these types of inconsistancies
it makes it very important to cold boot between Anti-Virus Tests.
I hope to have full testing results available within the next month
for all interested parties.

H.
 I.                                  Marc Alon-Tolbert
Industries                           Internet: HIIND@Delphi.com
From: gt7187c@prism.gatech.edu (Thomas Oates)
Newsgroups: comp.virus
Subject: Is this a virus problem?? (PC)
Date: 8 Oct 92 00:08:03 GMT

Is there a virus out that can cause a computer not to boot when I/O
ports are installed?  Mine will not boot when I try it with an I/O
card installed. (tried 3 cards, so chances are it is not the card).

THe reason I think it could possible be a virus is that when it does
actually boot (with no I/O) it does virus-like things such as:
completely hanging for no apparent reason, incorrect dir listings of
a,b drives, repeating commands for no reason.

Can a virus actually do this?

I tried Norton antivirus with no success and also an 
older version of SCAN which found nothing.

So, could this be a virus or should I take the computer
in for a tune-up????

THanks,
  Thomas Oates
- -- 
Thomas Oates                 MS Windows...From the same people who
gt7187c@prism.gatech.edu                  brought you edlin...... 
Prodigy NGDR20A                   How you gonna do it??       
Georgia Institute of Technology           OS/2  IT!!!!!
From: ede140r@monu6.cc.monash.edu.au (N. Michelis)
Newsgroups: comp.virus
Subject: Re: Re[2]: NAVSCAN (PC)
Date: 6 Oct 92 14:40:57 GMT

pd@nwavbbs.demon.co.uk (Peter Duffield) writes:

>cjkuo@ccmail.norton.com writes:

>>Robert Slade reports:
>>>> Where can i get NAVSCAN?  or When its gonna be out?
>>
>>It is on Compuserve in the following locations: NORUTL, VIRUS, IBMSYS,
>>and UKFORUM.  It is available from the Symantec BBSs: 2400:
>>408-973-9598, 9600: 408-973-9834. 

>You will also find it for anonymous ftp on wuarchive.wustl.edu in the
>directory /pub/MSDOS_UPLOADS

What version is this.

Nav has released an upgrade for 2.0. Nav 2.1 is available and scan
1400+ virus It costs $30 (AUS) for the upgrade plus postage. Ring
symantec for more details.
From: rjk@world.std.com (robert j kolker)
Newsgroups: comp.virus
Subject: A less virus prone architecture
Date: 5 Oct 92 00:54:24 GMT

I was reading a book on the Babbage analytica engine the other day,
and it occurred to me that a Babbage machine may be less virus prone,
then a Von Neuman machine.

A Babbage machine differs from a Von Neuman machine, in that its
program is external stored on a medium separate from the data store of
the machine. Thus the operands of a program are in store, but the
program that transforms them is not. The Babbage analytic engine was
patterned after the Jacquard Loom.

The question I put is this. Is a computer, in which the program is
stored in a totally separate memory space from data, less prone to
virus attack or not.

I would appreciate your opinions on this question.

Conan the Libertarian rjk@world.std.com
"If you can't love the Constitution, at least hate the Government"

[Moderator's note: Pardon my ignorance on this, but wasn't the Babbage
machine a 19th century mechanical computing device, and isn't there an
effort under way to implement (again, in hardware) one of his later
machines?  Are there any software implementations of his designs?]
From: dl2p+@andrew.cmu.edu (Douglas Allen Luce)
Newsgroups: comp.virus
Subject: Re: A less virus prone architecture
Date: 9 Oct 92 17:54:12 GMT

Excerpts from netnews.comp.virus: 5-Oct-92 A less virus prone architec..
robert j kolker@world.st (1066)

> A Babbage machine differs from a Von Neuman machine, in that its
> program is external stored on a medium separate from the data store of
> the machine.

In the Von Neumann architecture, the program is a state machine, and the
data is the ticker-tape (or dual stack).  They are distinct entities,
and no definition is made on where they lay in storage.

In today's the Von Neumann computers, the actual "program" state-machine
is embodied in the hardware of the computer, while the "data" consists
of microcode, the OS, and application programs, as well as the data they
require.

Modern computers also emulate Babbage machines; there is generally some
ROM code in them that is unalterable by viruses.

It's very hard these days to make a distinction between program and data
on an arbitrary level of abstraction.

Doug
From: duck@nuustak.csir.co.za (Paul Ducklin)
Newsgroups: comp.virus
Subject: BIOS functionality at bootup (was the C: the A: saga..) (PC)
Date: 5 Oct 92 09:03:41 GMT

The trend amongst BIOS manufacturers to provide a CMOS-configurable
option to allow you to inhibit bootup from floppy disc has been rather
staunchly raved about of late in comp.virus. Yet Boot Sector viruses
continue unabated.

Unfortunately, the interface which allows you to select the BIOS bootup 
mode usually lets you choose, during CMOS setup, between "Boot sequence 
C: A:" and "Boot Sequence A: C:". Once you've chosen, you get no feedback 
during subsequent bootups to remind you of the configuration. If you go 
back to the "A: C:" sequence in order to let yourself boot from floppy, 
you need to remember to reselect "C: A:" next time.

Much better would be, when in "A: C:" mode, for the BIOS to ask for
confirmation before booting from A:. This would serve three purposes:
firstly, to remind you to switch back to "C: A:" mode; secondly, to
avoid accidental floppy bootup and, lastly, to assure you that any
bootup from floppy disc really was originated by the BIOS. A virus like
EXEbug boots from floppy by a devious route -- it alters the CMOS setup
to force bootup from your hard disc and then, after loading itself from
the hard drive into memory, switches over to boot from floppy if you
have one inserted. This means that what seems to be a clean boot is
actually no such thing! If the BIOS were to ask for confirmation before
initiating a floppy bootup, the subterfuge of viruses like EXEbug would
be obvious.

BIOS manufacturers, what say ye?

- -- 

- --<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--
Paul Ducklin                                           duck@nuustak.csir.co.za

    CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: CPAV false positives (was FLIP) (PC)
Date: 6 Oct 92 18:01:53 GMT

Unfortunately this is a fairly well known false positive.  Central
Point does not encrypt their signature search strings, either on disk
or in memory.  Therefore, wherever CPAV uses the same search string as
other scanners (as in the case of FLIP), CPAV will be identified as
being infected.  If you run the TSR scanner portion of CPAV and then
use another scanner, you will also find the "infection" in memory.

Incidentally, further to Microsoft's inclusion of portions of CPAV in
MS-DOS version 6, someone who has seen a beta copy indicates that
VSAFE will be included.  Fortunately, VSAFE is the activity monitor
portion, and does not do any signature scanning.
 
============= 
Vancouver      ROBERTS@decus.ca         | "Remember, by the
Institute for  Robert_Slade@sfu.ca      |  rules of the game, I
Research into  rslade@cue.bc.ca         |  *must* lie.  *Now* do
User           p1@CyberStore.ca         |  you believe me?"
Security       Canada V7K 2G6           |    Margaret Atwood
From: fc@turing.duq.edu (Fred Cohen)
Newsgroups: comp.virus
Subject: VCL operation (PC)
Date: 8 Oct 92 23:37:12 GMT

I have been trying to get VCL to operate on my system, and I think the
authors don't know how to write compatible code.  Does anyone know how
to get it to work on a 286 with a black and white screen (HGA)?  Or do
the virus creation lab people only design their VCL for those with
lots of money?  I suppose it's only for elite virus writers, and not
for the rest of us.

FC
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Virus Scanner Reviews (PC)
Date: 9 Oct 92 18:31:10 GMT

There were two reviews published in British computer magazines this
month.  One (in PCW) was badly done - in fact, my opinion is that they
should officially apologize next month.

They used an incredibly small set of virus samples, modified the
infectedd programs in order to disable the viruses, and checked which
programs were still able to detect the viruses.  When they discovered
that some of the anti-virus programs did not detect some of the
viruses, they considered this highly significant and an indication
that the programs were not protecting the users.  My program was not
included in that review, so I don't have any reasons to be upset,
but.....

The other review (in PC Direct) is surprisingly well done - I am
personally quite satisfied with my outcome there, but according to
that review some of the anti-virus programs on the market are,
well...not quite as good as they should be, to say the least. In one
case the review starts like this:

     It is rare to find a program as bad as ....... The poor impressions
     started on opening the box, to reveal the software on two write-enabled
     disks. We write-protected them before installation, but the install
     procedure wanted us to remove the write protection to enable any viruses
     found to be cured.
     ...
     The program is incredibly tedious to use, requiring several keypresses
     between each disk or virus and there is no option to produce a printed
     report
     ...
     The monitor claimed to have detected a virus every time we loaded
     Windows 3.1
     ...
     The distributors offer unlimited free upgrades via BBS...We called the
     bulletin board: this turned out to be the "The Dog and Disk BBS" and we
     were greeted with the information that "Richard was in the bar"

Now, I usually don't like to say bad thing about my competition :-)
but in this case I just could not resist...
From: fc@turing.duq.edu (Fred Cohen)
Newsgroups: comp.virus
Subject: Contact information for Fred Cohen and ASP
Date: 8 Oct 92 02:27:55 GMT


	Many readers of this forum have recently requested various
documents and information on recent advances in information protection
from me at my Brisbane computer mail address.  As I am now back in the
US, I have a new computer mail address.  Please address further
computer generated requests to:
	fc@turing.duq.edu
or physical mail to:
	ASP, PO Box 81270, Pittsburgh, PA 15217

		Thanks - FC
From: AHARDISON@intel9.intel.com (FIRED UP...ALL FIRED UP...PRG 2026)
Newsgroups: comp.virus
Subject: How trojans work. (PC)
Date: 7 Oct 92 02:10:30 GMT

Hello, My name is Andy Hardison and I am a BBS sysop with a problem.
I was notified by a user of a program that scanned clean, but when
run, caused a Michaelangelo infection.

Here is what I was told, Xyphr.zip was unzipped to form the game
files, Xyphr.exe, .dat, etc.  When trying to run Xyphr, the computer
would hang.  My user rebooted the computer with a CTRL-ALT-DEL.  Since
he thought it was a memory problem, he ran Quarterdecks Manifest, mft.
He thought he was running MFT.exe, but there was a 300 or so byte
MFT.com file present.

He typed in MFT and his computer locked up again.  Upon a second
reboot, with an actual powerdown, the computer lost some files.  He
scanned with Fprot and McAfee.  Both reported Michaelangelo in the
boot track.

Could someone out there explain to me how Michaelangelo could have
gotten onto the system via this method of infection.  My user is more
paranoid about virii than I am (I scan all incoming files, but do not
run the executables).  He did not have an infected computer before
running Xyphr, but did after the above mentioned sequence of events.
Any help would be appreciated.


						andy hardison

					Ahardison@intel9.intel.com
From: fc@turing.duq.edu (Fred Cohen)
Newsgroups: comp.virus
Subject: OS/2 version of Integrity Toolkit (OS/2)
Date: 5 Oct 92 06:46:23 GMT

Yes Vess, there is a Santa Clause

	Integrity Toolkit for OS/2 is called the Protection Toolkit,
and provides most of the current features of Integrity Tookit.  Soon,
it will exceed IT.  P.T. currently includes login by user ID
w/password, integrity shell and snapshot under DOS box, known virus
scanner, crypto-checksum, DOS box trap mechanisms, and the nice
management tool.  As soon as IBM sends us the driver information
(which they seem to want to withold untill other vendors have a 6
month lead on us), we will have disk-wide encryption using DES, ANSI
standard, and other user settable algorithms, full OS/2 integrity
shells, OS2 based access controls, network access controls, and lots
of other good stuf. - Thanks for the plug :)(:))=-_)* - how do you do
that thing?
FC
From: tyu@ecst.csuchico.edu ( )
Newsgroups: comp.virus
Subject: driver's licence
Date: 5 Oct 92 03:53:35 GMT

I just got my California driver's licence, the new one with the
magnetic stripe on the back where an officer of the law can
see my whole life story in one stroke.
Strictly for information purpose only, is their any viruses
out there, that could infect the magnetic stripe on my
CA. licence?   I could build a 'magnetic stripe read and write head.'
as long as it is legal in my state to do so.

ps. I have no intention of breaking the law, state or fed.
nor do I advocate any body breaking law 
This is for INFORMATION PURPOSE ONLY AND NOTHING ELES!!
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: FLIP (PC)
Date: 6 Oct 92 20:16:41 GMT

2007do@ankara2.af.mil (CS/DO;675-3254) writes:

>Vivek Swarup of moh.gov.on.ca writes:

>>On 1 of our PCs CPAV detected some virus but could not tell us which
>>one.  We obtained a copy of f-prot V2.02 which indicated this system
>>had a FLIP Virus. We obtained a new version of f-port (v2.05) which
>>indicated the PC has the TELECOM Virus. 

Both are wrong - What F-PROT is really detecting are virus signatures
left in memory by the Central Point programs.  The same applies to
several other anti-virus programs - they produce false alarms on the
Central Point anti- virus software.

PLEASE, PLEASE read the CPAV manual.  It specifically states that CPAV
is not compatible with other anti-virus programs. The problem is
really that CPAV contains various virus signatures, and unlike any
decent anti-virus program, it does not bother to encrypt them.

If you use CPAV, don't use any other anti-virus program.

(or better....don't use CPAV :-)....)

- -frisk
From: ARTHUR@brfuel.bitnet
Newsgroups: comp.virus
Subject: Brazil Virus! (PC)
Date: 6 Oct 92 23:27:44 GMT

I want to thank Brian Seborg, Vesselin Bontchev, McAfee, and Fridrick
Skulasson, who answered my request on Brazil Virus!

I've summarized the answers to the list where I read the report about
the virus. But I have not an infected copy.

LUIZ ARTHUR PAGANI
DEPARTAMENTO DE LETRAS VERNACULAS E CLASSICAS
CENTRO DE LETRAS E CIENCIAS HUMANAS
UNIVERSIDADE ESTADUAL DE LONDRINA
LONDRINA - PARANA' - BRASIL
CAIXA POSTAL 6001 - CEP 86051-970
TEL: (0432) 21-2000 RAMAL 428
FAX: (0432) 27-6932
E-MAIL: ARTHUR@BRFUEL.BITNET
RESIDENCIA: R. PARANAGUA', NO. 2035, APT. 203 - CENTRO - LONDRINA
            CEP: 86.015-030
            TEL: (0432) 23-9956
From: brian@probitas.cs.utas.edu.au (Brian Marriott)
Newsgroups: comp.virus
Subject: Virus alert: "Larry on a Screen" (PC)
Date: 7 Oct 92 02:05:17 GMT

A virus has shown up in Tasmania, Australia, which we haven't seen
reported before, and which isn't known by name to F-Prot 205 or TBScan
43 (although they both pick it up by heuristics).

We have only analysed it far enough to get its name and an ID
string;  we don't know potential damage.

Name: Larry on a Screen
Infects: .EXE & .COM files  (at least)
.COM files grow by 491 bytes, .EXE files by 403 bytes (or so it
seems on samples of one of each)

Signature strings: "Larry on a Screen"
		 Hex"50cbbf00018b750181c6d90257b90500fcf3a481"

Further information may be obtainable from:
Russell Twining (R.Twining@eee.utas.edu.au)
Brian Marriott  (B.W.Marriott@cs.utas.edu.au)

- -----------------------------------------------------------------------
Brian Marriott, Department of Computer Science,  University of Tasmania
Mail: GPO Box 252C, Hobart, Tasmania 7001, AUSTRALIA. Ph: +61-02-202929
Internet: B.W.Marriott@cs.utas.edu.au                Fax: +61-02-202913
From: MIN@rulcri.LeidenUniv.nl
Newsgroups: comp.virus
Subject: report on virus detection (PC)
Date: 4 Oct 92 22:18:08 GMT

Hello everybody,

August this year I completed a report on virus detection. This report
was the result of my traineeship at the Dutch National Criminal
Intelligence Center (CRI). The abstract of the report reads as
follows:

               An  evaluation  of  different  techniques  for  virus
               detection. The discussion is sufficiently general  to
               be  applicable to a  substantial number  of computing
               platforms.  All mentioned  practical  issues  concern
               the MS  DOS  operating  system.  Improvement  of  the
               operating   system   is   presented   as   the   most
               fundamental  and therefore  effective way  to  tackle
               the virus problem.

I have produced an ASCII version of the report, which should now be
available for interested readers, through anonymous ftp at
ftp.informatik.uni-hamburg.de, in the directory
pub/virus/texts/viruses The filename is virusdet.zip.

Any constructive criticism concerning the contents of the report is
welcome at my e-mail address.

Patrick Min
Leiden University
min@rulcri.leidenuniv.nl
From: x90mahdiarwi@gw.wmich.edu
Newsgroups: comp.virus
Subject: Question:NOVI anti virus (PC)
Date: 6 Oct 92 00:19:48 GMT

Hi there,

I do not know if this newsgroup is the right one for my posting.  but
anyway, I got together with a couple of friend last weekend, after a
long talk, mostly about computer. We came across to the virus topic.
One of them mention about this anti virus program called 'NOVI anti
virus', this one suppose need no upgrage, because the program can
upgrade themself. in other term, NOVI can find a new viruses and kill
it.  Out from my curiosity, I would like to know, if this anti virus
program really work.  If anybody know, or use it before. Please
e-mail.  thanks in advance.

- -Oemar-
x90mahdiarwi@gw.wmich.edu