HDTenEightyP/NetNews huggingface dataset:
From: ethanb@ptolemy.astro.washington.edu (Ethan Bradford)
Newsgroups: comp.emacs
Subject: Re: Window size on Mac with Telnet
Date: 8 Oct 92 07:57:25 GMT
Article-I.D.: ptolemy.ETHANB.92Oct7235725
Distribution: na
Organization: U. of Washington
To: milan@bcsaic.boeing.com (Milan Richter)

In article <84600@bcsaic.boeing.com> milan@bcsaic.boeing.com (Milan Richter) writes:

   Since I am not very familiar with customizing Emacs, can somebody tell me
   if it is possible, with the Telnet emulator, to have Emacs display more
   than 24 lines? If yes, what exactly do I need to do?

To get 52 lines, before starting emacs give the command
  stty rows 52
From: bob@MorningStar.Com (Bob Sutterfield)
Newsgroups: comp.emacs
Subject: Re: Emacs in VAX
Date: 16 Oct 92 20:16:29 GMT
Organization: Morning Star Technologies

In article <1992Oct16.062311.21841@nuscc.nus.sg> iscksc@nuscc.nus.sg (Mr Khoo Siau Cheng) writes:
   Is there a version of Emacs run on Vax?

Get prep.ai.mit.edu:pub/gnu/emacs-18.58.tar.Z.  If your VAX is somehow
accidentally running VMS, you'll probably need to use a UNIX machine
to uncompress it and unpack the tar archive, before you ship the
sources to the VMS system.
From: cotrozzi@ghost.dsi.unimi.it (Massimo Cotrozzi)
Newsgroups: comp.virus
Subject: is nav good ? (PC)
Date: 9 Oct 92 15:00:54 GMT

We recently got Norton Desktop 4 Windows and it installed nav ( anti virus )
in config && autoexec.
is it the best [de][anti]virus or I can find a better one ?
- -- 
- --------------------------------------------------------------------------
!  /|/|  /| \ /  ! Massimo Cotrozzi  Computer Science Dept. Milan Italy  !
! /   | /-|  \   ! cotrozzi@ghost.dsi.unimi.it      			 !
!/    |/  | / \  ! massimo@cdc835.cdc.polimi.it	                         !
From: smd@hrt216.brooks.af.mil (Sten M. Drescher)
Newsgroups: comp.virus
Subject: Re: The Hacker Files (Vol 5 #156)
Date: 6 Oct 92 23:31:16 GMT

ZMUDZINSKIT@uvax6.disa.mil (zmudzinski, thomas) writes:

   > ps would send a copy of this to DC Comics but no E-Mail address was given.

>     In issue #1 on the second page of "usr/hacker/mail" (what becomes
>   the letters section in later issues), in the upper right-hand corner,
>   Lewis Shiner (the creator of "THE HACKER FILES") says:

>		      Because   THE  HACKER  FILES   is   spe-
>		      cial,  you have an alternative.  I am in
>		      the process of setting up on-line letter
>		      columns   on   both    the   GEnie   and
>		      CompuServe    bulletin    boards.    The

>   Mr. Shiner must have been at least half-way successful as three of the
>   letters in issue #4 were posted through GEnie.  Try there.

	OK, but I have neither a CI$ nor a GEnie account.  I would
LIKE to have seen an email address to use.

- -------------------------------+---------------------------------------------
Sten Drescher                  | There are men who seem like more than men.
AL/HRTI                        | Living examples of what we could be if we
Brooks AFB, TX 78235           | tried.  They are men of courage, compassion,
- -------------------------------+ and justice.  On the other hand, there are
sdrescher@animal.brooks.af.mil | presidential candidates.
From: brian@probitas.cs.utas.edu.au (Brian Marriott)
Newsgroups: comp.virus
Subject: Virus alert: "Larry on a Screen" (PC)
Date: 9 Oct 92 00:14:49 GMT

A virus has shown up in Tasmania, Australia, which we haven't seen
reported before, and which isn't known by name to F-Prot 205 or TBScan
43 (although they both pick it up by heuristics).

We have only analysed it far enough to get its name and an ID string;
we don't know potential damage.

Name: Larry on a Screen
Infects: .EXE & .COM files (at least)
.COM files seem to grow by 491 bytes, .EXE files by a varying amount
( we saw 403 & 507 bytes ).

Signature strings: "Larry on a Screen"
Hex: "50cbbf00018b750181c6d90257b90500fcf3a481" 

Further information may be obtainable from: 
Russell Twining (R.Twining@eee.utas.edu.au) 
Brian Marriott (B.W.Marriott@cs.utas.edu.au) 

- ----------------------------------------------------------------------- 
Brian Marriott, Department of Computer Science, University of Tasmania
Mail: GPO Box 252C, Hobart, Tasmania 7001, AUSTRALIA. Ph: +61-02-202929
Internet: B.W.Marriott@cs.utas.edu.au	              Fax:+61-02-202913
From: mechalas@mentor.cc.purdue.edu (John Mechalas)
Newsgroups: comp.virus
Subject: Re: Recent IBM Virus List? (PC)
Date: 6 Oct 92 18:17:31 GMT

frisk@complex.is (Fridrik Skulason) writes:
>mechalas@mentor.cc.purdue.edu (John Mechalas) writes:
>
>>Where can I find a current list of known IBM viruses that is in the
>>public domain? 
>
>If you find one, let me know :-)

I will.  I promise.  :)

>Seriously, there is no list that is 100% up to date - with several new
>viruses arriving every day it is not possible.  You can get a
>reasonably good list from several sources, but no 100% complete.

Obviously there won't be a 100% complete.  :) But, according to the
FAQ for this group, for instance, it says that the catalogs at
informatik.de are incomplete for the IBM listings...is there a more
complete version?
   Your F-Prot database, for instance, is pretty close to what I am
looking for, but in a public-domain listing.

> I am looking for 
>
>      virus name: Yeah, me too  :-) ....unfortunately, there is still a lot of
>                  naming confusion in this field.

Understood.

>
>      type: I assume you mean "Reasident/Non-resident" and what it infects,
>	    right ?

Exactly.

>
>      disinfectant method: I am not sure what you mean by this - I don't
>            any publically avalible virus list described the method to
>            disinfect them.

I realized afterwords that this was not really a good question, but it
was too late to edit the article after I sent it.  :) I meant, can it
be removed by disinfectant software, or must it be replaced?  This is,
however, essentially irrelevant, since the best "cure" for an
infection is to *always* replace the offending files with clean
backups.  So just ignore this one.  :)

- -- 
John Mechalas                             [This space intentionally left blank]
mechalas@mentor.cc.purdue.edu
Purdue University Computing Center                 Help put a ban on censorship
General Consulting                                        #include disclaimer.h
From: 739chan1@gw.wmich.edu
Newsgroups: comp.virus
Subject: Re: How trojans work. (PC)
Date: 9 Oct 92 17:50:02 GMT

AHARDISON@intel9.intel.com (FIRED UP...ALL FIRED UP...PRG 2026) writes:
> Hello, My name is Andy Hardison and I am a BBS sysop with a problem.
> I was notified by a user of a program that scanned clean, but when
> run, caused a Michaelangelo infection.
> 
> Here is what I was told, Xyphr.zip was unzipped to form the game
> files, Xyphr.exe, .dat, etc.  When trying to run Xyphr, the computer
> would hang.  My user rebooted the computer with a CTRL-ALT-DEL.  Since
> he thought it was a memory problem, he ran Quarterdecks Manifest, mft.
> He thought he was running MFT.exe, but there was a 300 or so byte
> MFT.com file present.
> 
> He typed in MFT and his computer locked up again.  Upon a second
> reboot, with an actual powerdown, the computer lost some files.  He
> scanned with Fprot and McAfee.  Both reported Michaelangelo in the
> boot track.
> 
> Could someone out there explain to me how Michaelangelo could have
> gotten onto the system via this method of infection.  My user is more
> paranoid about virii than I am (I scan all incoming files, but do not
> run the executables).  He did not have an infected computer before
> running Xyphr, but did after the above mentioned sequence of events.
> Any help would be appreciated.

I would think that the program wrote the Michelangelo virus strings to
the partition table. Try running F-PROT on the file. It will detect
Boot sector/Partition table viruses even if they are not in their
respective places.  (e.g. in an image file) Don't erase the file; send
it to MCAFEE assosiates (makers of SCAN) or Fridrik Skulason (F-PROT).

__________________________________________________________________________
Chan Lee Meng          \  "Let us endeavour to live so that when we die,
739chan1@gw.wmich.edu    \   even the undertaker will be sorry."
X92chan3@gw.wmich.edu      \   - Mark Twain.
Western Michigan University. \
From: duck@nuustak.csir.co.za (Paul Ducklin)
Newsgroups: comp.virus
Subject: Re: more network security
Date: 4 Oct 92 17:39:55 GMT

Thus spake seborg@csrc.ncsl.nist.gov (Brian Seborg):
>Vesselin Bontchev writes:

>>As a conclusion, it is a bad idea to rely on virus disinfectors.
>>Just delete the infected programs and replace them with clean
>>backup copies.

>I am glad that you have finally reached this conclusion. :-)  We
>have been saying this for years!

Hey, Vesselin (and anyone else with enough suss to count, myself
[ahem] included..) has been saying this to anyone who'll listen (and
many who won't) for ages. I've never seen him suggest anything *but*
the deletion of infected files, in fact..

BTW: "reinstalling" infected binaries can indeed be painful these
days. It's no longer a question of copying .EXEs from original
floppies onto your HDD. We're seeing increasingly cryptic distribution
discs, with custom compression and no easy way to pull off a single
binary.  Once you've got a clean installation of a whopper-app (try
BC++ 3.1 with Application Framework if you're keen on ___big___) with
things set up how you like, try making an "as installed" copy to tape.
Could save you a lot of frustration if someone deletes one or two of
those seemingly redundant configuration/setup/hey-what's-this files..

- -- 
- --<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--
Paul Ducklin                                           duck@nuustak.csir.co.za

    CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa
From: duck@nuustak.csir.co.za (Paul Ducklin)
Newsgroups: comp.virus
Subject: Re: Is there a new virus (720Kdisks) ? (PC)
Date: 4 Oct 92 17:07:10 GMT

Thus spake U8945535@csdvax.csd.unsw.EDU.AU:
>I have heard a rumour that there is a virus that will prevent 720K
>disks from being read or formatted.  This virus apparently does not
>affect 1.44K disks.

The EXEbug virus (seemingly written in South Africa and now very, very
widespread here) has, as one of its most noticeable giveaways, the
side effect that floppies can't be formatted on a infected machine.
EXEbug's stealth replaces the INT 13 Format call with a
Do-Nothing-But-Say-You-Did call to "protect" the boot sector of discs.
So, when FORMAT verifies Track 0 (as it does, because of its
importance, thanks to the DOS floppy layout) it gets somewhat upset to
see that the boot sector didn't actually get succesfully formatted!
Result: "Track 0 is bad - diskette unusable". This side-effect will,
however, be observed on discs of all capacities.  Floppy disc drive
salesmen are having a great time right now, especially if they get to
keep the "failed" drive they're replacing :-)

A virus which doesn't affect (infect?) 1.44M discs and which prevents
720K discs from being read (ie: used..) would seem to be a seriously
brain-damaged virus indeed..

- -- 
- --<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--
Paul Ducklin                                           duck@nuustak.csir.co.za

    CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa
From: u906271@bruny.cc.utas.edu.au (Blow Me Down)
Newsgroups: comp.virus
Subject: FileSize Checking Program (PC)
Date: 7 Oct 92 14:16:35 GMT

Hi all,
	I'm looking for a program that saves a checksum of files on the PC and
	later checks for files changes automatically.
	I'm after a program that does something like CPAV (Central Point Anti-
	Virus). But I not using the virus checker.  Does anyone know of such a
	program?  If so, please E-mail me.

Thanks in Advance...
Chris
E-Mail : u906271@postoffice.utas.edu.au

- --------------------------------------------------------------------------
Chris Chew Hong Gunn      |    A Signature?
B.Sc/B.E (Third Year)     |    I'll have to think about it...
University of Tasmania    |    Email:  u906271@postoffice.utas.edu.au
Australia                 |            u906271@bruny.cc.utas.edu.au
- --------------------------------------------------------------------------
From: xrjdm@calvin.gsfc.nasa.gov (Joseph D. McMahon)
Newsgroups: comp.virus
Subject: Re: MacMag, the original data virus! (CVP)
Date: 6 Oct 92 18:50:42 GMT

rslade@sfu.ca writes:
> 
> Semantics aside, how could a data file affect the system at all?
>  
> Well, more and more programs have "macro", "script" or interpreter
> capability.  Thus the distinction between data and program blurs. 
> Hypercard stacks have "commands" as well as data associated with
> them.  Generally, these commands only govern the ability to "flip"
> from one "card" to another.  However, an extended command set, XCMD,
> allowed for additional functions beyond those normally available in
> Hypercard.  This was used to affect the system changes.

Calling MagMac a "data virus" disturbs me. I thought that the
definition of a data virus was a virus which is transported as a
non-executable and which is then transformed into an executable virus
when the file is used. This is a bit of a semantic clash, as I
understand the definition vs. the actual XCMD mechanism.

HyperCard XCMDs are executable resources of arbitrary function written
by a programmer in C or Pascal (masochists may use assembler, if they
wish).  They are installed as XCMD resources into a stack and provide
an extension to the normal command set provided in HyperCard
"scripts".

The phrase "arbitrary function" is the key here. The XCMD can provide
any function that a Macintosh application can; the viral XCMD was
simply a section of code which added another executable resource to
the System file.  There was no transformation of data into program;
all viral code was present inside the XCMD itself. Any HyperCard stack
containing the XCMD could have been used to spread the virus, simply
by invoking the XCMD by name.

I speculate that the stack was used as a vector because it took less
time to throw a "teaser" Trojan stack together that it would have to
make a throw-away application which would have been sufficiently
tantalizing to get people to download it.

Now, there have been true HyperTalk viruses, in which HyperCard
scripts were written to infect other stacks with the viral script, but
this really isn't a data virus either, because the virus is still an
executable program of sorts.

The closest thing I've seen to a real "data virus" were the "implied
loader" viruses, which subverted a Finder datafile into becoming a
means of replacing part of the System simply because the Finder opened
them.  But this still required an executable resource be present.

I don't think we've really seen a virus which transforms itself from
the executable to the non-executable realm yet. I emphasize "yet".

 --- Joe M.
From: seborg@csrc.ncsl.nist.gov (Brian Seborg)
Newsgroups: comp.virus
Subject: replies to some questions
Date: 9 Oct 92 20:49:11 GMT

Robert Kolker asks:
> Is a computer, in which the program is stored in a totally separate
> memory space from data, less prone to virus attack or n space from
> data less prone to virus attack or not.

Good question!  I guess the answer depends on whether that seperate
memory space is protected or not.  If the separate memory space is
write-protected, for example, imagine a program which resides on a
protected network drive, it is both external to the system, and
protected and is protected from virus infection from all users (with
the exception of administrators).  Now, if this program is not on a
protected memory device, or if it is copied to a non-protected memory
device, then it can be infected.  In the case where it is copied, the
original remains un-infected, but the new copy on the non-write
protected memory device would be infected.  I hope this answers the
question.  :-)

Andy Hardison asks:
(I will paraphrase for the same of brevity) A bbs user he has claims
to have run a program from his bbs which caused Michelangelo to infect
his disk. How could this happen?

Again, good question.  The only way this could have happened is that
the program in question would have to be a "dropper" program.  Dropper
programs are programs used to place other virus programs onto the boot
sector of a disk or into a host program (for executables).  While this
is possible, I would think that getting hold of such a program for
Michelangelo would be unlikely.  If you have the file, dis-assemble it
and see for sure.  It is more likely that your user did himself in by
infecting himself with the Michelangelo virus, and he is looking for a
scapegoat.  A good disassembly of the code would remove all doubt.
Since the Michelangelo is an MBR and boot-sector infector only, it can
neither be spread by a program being copied down from a bbs (unless it
IS a dropper), nor can it spread via a network.

Sincerely,

Brian Seborg
VDS Advanced Research Group
From: duck@nuustak.csir.co.za (Paul Ducklin)
Newsgroups: comp.virus
Subject: Re: network security
Date: 4 Oct 92 17:28:45 GMT

Thus spake seborg@csrc.ncsl.nist.gov (Brian Seborg):
>Vesselin Bontchev writes:
>>and StarShip, I think) will not
>>infect, if you don't have a hard disk - because they don't go

>Wrong about Tequila, it infects just fine.  Remember, it is a
>multi-partite virus and it does go TSR.

Vesselin is right, in fact. Tequila requires a hard drive. It doesn't
go resident when you run an infected file -- it merely "primes" the
MBR to load the virus next time you boot up from hard disc. No HDD, no
Tequila in memory..

Still, T.Tequila's gamble that you've got a hard drive on your PC is a
relatively safe one :-)
- -- 
- --<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--
Paul Ducklin                                           duck@nuustak.csir.co.za

    CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Recent IBM Virus List? (PC)
Date: 9 Oct 92 18:11:41 GMT

mechalas@mentor.cc.purdue.edu (John Mechalas) writes:

>was too late to edit the article after I sent it.  :) I meant, can it
>be removed by disinfectant software, or must it be replaced?  This is,
>however, essentially irrelevant, since the best "cure" for an
>infection is to *always* replace the offending files with clean
>backups.  So just ignore this one.  :)

Well, it is an interesting question.  Assuming the virus has been
accurately identified, there are several possible answers.

   1) The virus can never be disinfected - this is true for overwriting
      viruses.

   2) The virus can be removed, but the resulting program will not be 100%
      identical to the original.  For example, it may have grown by 1-15 bytes
      or a non-critical field in the EXE header may be changed (the checksum
      field, for example)

   3) The virus can usually be removed, but it may damage some programs, and
      that damage may not be detectable.  Jerusalem, for example.

   4) The virus can be removed, and the resulting program will be identical
      to the original one.

- -frisk
From: rslade@sfu.ca
Newsgroups: comp.virus
Subject: MacMag, the commercial virus (CVP)
Date: 8 Oct 92 17:05:58 GMT

HISVIRE.CVP   920905
 
                   MacMag virus - Commercialism
 
Surely the most renowned aspect of the MacMag/Brandow/DREW/
Compuserve/Macinvirus virus was that it holds the dubious
distinction of having been the first virus to infect commercial
software.
 
The president of a company producing educational material for
computer training visited Canada.  He was given a copy of the "Mr.
Potatohead" program.  (At a party, by one report.)  It was infected.
 
At home, he ran the program.  Once.  In his office.  Thus infecting
his computer.
 
The training company, MacroMind, some time later delivered some
training software to Aldus Corporation.  Aldus was, at that time,
preparing the release of its then new "Freehand" drawing product. 
Computers at Aldus were infected with the virus, and it eventually
spread to the production copy of the Freehand program.  Three days
production of the program were infected (by one report 7,000 copies,
by another 10,000).  An unknown, but fairly large number had already
been distributed by the time the infection was discovered.
 
At the time, MacroMind's customers included Microsoft, Lotus Apple
and Ashton-Tate.  Ashton-Tate consistently refused comment, the
others all, at various times, denied any infection, and none was
ever found coming out of those companies.
 
(Some other historical notes.  
 
John Markoff, with far less accuracy than he has shown of late,
reported that the virus was a product of the "Cult of the Sub-
Genius".  He also reported some amazingly inaccurate information
about the Sub-Genii themselves.  
 
We also have, in some of the reports of the virus, the first of what
has come to be standard in media reports of viral programs, the
warning to avoid shareware and only use commercial software.  Very
interesting that this particular canard should have started with
this particular virus.)
 
With the furor from the Compuserve reports, and the media attention
to the Aldus infection, it is unlikely that the virus was every
triggered other than by those who wanted to see the display.
 
copyright Robert M. Slade, 1992   HISVIRE.CVP   920905

==============
Vancouver      p1@arkham.wimsey.bc.ca   | You realize, of
Institute for  Robert_Slade@sfu.ca      | course, that these
Research into  rslade@cue.bc.ca         | new facts do not 
User           p1@CyberStore.ca         | coincide with my
Security       Canada V7K 2G6           | preconceived ideas
From: ZA9RA01@sysa.computing-services.manchester-poly.ac.uk (Bill Peel)
Newsgroups: comp.virus
Subject: Could FORM infect OS/2's BOOT.DOS file (OS/2)
Date: 9 Oct 92 08:40:31 GMT

A colleague has a PC which can dual boot to either DOS or OS/2. Both
Jim Bates's VISCAN and F-PROT v2.05 report that the file BOOT.DOS in
C:\OS2\SYSTEM contains a FORM image. After booting from a clean floppy
the size of BOOT.DOS reported by a dir is 512 bytes and the date/time
stamp is similar to that of other files in the directory (I know
viruses can fiddle this). The usual FORM message is not in the file.
My colleague says (I haven't had time to check this) that she cannot
find BOOT.DOS on any of the original OS/2 disks. On the hard disk it
is hidden/readonly.  Could any of the experts say whether this is a
real infection and if so how to recover from it. We have had
infestations of FORM on both floppy disks and DOS-only hard disks.

Thanks
         Bill Peel

PS For information, over the last 18 months we have cleaned up: Stoned,
Tequila (not pleasant), Yankee Doodle, Ping Pong, Green Caterpillar and
Dark Avenger/Eddie.

Dr W E Peel                                za9ra01@sa.cs.manp.ac.uk
Computing Services
Manchester Metropolitan University
Manchester M1 5GD
England