HDTenEightyP/NetNews huggingface dataset:
From: DISALAN.ZMUDZINT@mailhub.ims.disa.mil (Tom Zmudzinski)
Newsgroups: comp.virus
Subject: Re: Comments on Recent Postings, Virus-L V5 #169
Date: 2 Nov 92 19:56:55 GMT

In VIRUS-L Digest V5 #169, "William Walker C60223 x4570"
<WALKER@aedc-vax.af.mil> said:

> This, as well as other, similar exchanges, has caused VIRUS-L, a
> discussion list I consider very valuable, to become increasingly
> irritating to read.  While there may be times that people need to
> speak out against something (e.g. Virus Simulator or CPAV's causing
> false positives), please keep the heat down and the professionalism
> up.

YAY, BILL !!!  Please, please, PULL-EASE !!!  Let's keep it:
DEFAULT=FLAME-OFF

Tom Zmudzinski                             ZmudzinT@CC.IMS.DISA.MIL

=-=-=-=-= The preceding was a paid fanatical announcement =-=-=-=-=
From: lieberzeit@vax.felk.cvut.cs
Newsgroups: comp.virus
Subject: What has became with R.T.Morris ?
Date: 3 Nov 92 14:29:11 GMT

Please, can someone tell me, what has became with R.T.Morris (the
author of The Internet Worm)? The last news I have is that he was
found guilty of violating the Federal Computer Fraud and Abuse Act and
sentenced to 5 years and $250.000. I am not sure this news is the
final one. Was not there a court of appeal? I would also appreciate
any further details.

Thanks, V. Lieberzeit

The Czech University of Technology      Internet: lieberzeit@cs.felk.cvut.cs
Faculty of Electrical Engineering       BITNET: LIEBER@CSEARN
Department of Computer Science		Tel.: +42 (2) 29 78 41, ext. 440
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: SCAN 95b doesn't find MtE in EXE files (PC)
Date: 11 Nov 92 22:22:31 GMT

cjkuo@ccmail.norton.com (Jimmy Kuo) writes:

> The argument for the second opinion says that if you detect the
> infected form of the children, you will know if something is going on
> in the computer.  Once something is known to be affecting the
> computer, theories related to integrity checking can take over.  Files
> such as those created above and certain files in reviewers'
> collections cannot spread in that convoluted form and need not worry
> endusers.  (A version of this argument applies to whether it is
> necessary to detect absolutely 100% of MtE mutations, i.e.  integrity
> checking takes over.)

I tend to disagree. First, according to the above argument, you can
always use an integrity checker to detect the second-generation
infections, so you don't need a scanner at all. In fact, one of the
arguments why the integrity checkers cannot replace the scanners
completely, is that when you notice the infection, you usually want to
find and remove all sources of infection, including the file that
brought the virus to your system. Also, scanners are useful for
scanning the software -before- you run it (something that the
integrity checkers cannot do), therefore, the user wants to be able to
find the viruses at that stage, not after the virus has been released
in the system.

Second, all the scanners mentioned by the original poster claim to be
able to scan inside LZEXE compressed files. Therefore, if those claims
are correct, they should be able to detect the virus.

Third, some scanner -were- able to detect the virus.

However, I agree with you, that in general the virus droppers (because
what the original poster has done has been exactly to create a
dropper) are not a serious problem.

> It should be the form that propagates that we worry about.  And though
> you didn't note it, I'm sure all the files infected by your creations
> were detected by all the packages above.  Thus end-users need not
> worry about your peculiar forms of MtE files because you're not going
> to put those files on anyone else's computer.  :-)

Problem is, it is perfectly possible to create an MtE-based virus,
converted in the way described in the original message, which will
propagate in THAT FORM. Recall that we already have several viruses
that are propagating in LZEXE or PKLITEd form...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: RADAI@vms.huji.ac.il (Y. Radai)
Newsgroups: comp.virus
Subject: Re: MtE ?? (PC)
Date: 2 Nov 92 15:10:10 GMT


 Holt Sorenson writes:
> MtE is the Mutation Encryption Engine developed by Dark Avenger. It
> changes filesizes, checksum, and other info that would make it
> possible to detect a virus in a file at runtime so that the virus can
> continue to hide on your computer.

Changes filesizes and checksums???  You've missed the entire point of
MtE!  MtE (Mutation Engine) is a method for converting a given virus
into a *polymorphic* one, i.e. one which looks different on each
infection, because of variable encryption and/or because of replace-
ment of some instructions by others which have the same effect.
  MtE consists of an .OBJ module which, when linked to a assembled
virus containing a call to it (and to a random-number generator
supplied in another module), causes the virus to become polymorphic.
  There are several specially designed scanners which claim to achieve
perfect detection on MtE'd viruses, and these claims are often correct
in the case of mutations in which the viral code is actually encryp-
ted.  But in some cases MtE does not perform an encryption, and some
scanners fail in such cases.  A few scanners succeed in detecting all
such viruses in some existing text suites, but it is apparently
impossible to obtain 100% detection on all possible MtE mutations
(i.e. even when the underlying virus is unknown) in those cases in
which an MtE encryption is not performed.

                                     Y. Radai
                                     Hebrew Univ. of Jerusalem, Israel
                                     RADAI@HUJIVMS.BITNET
                                     RADAI@VMS.HUJI.AC.IL
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: VCL? (PC)
Date: 2 Nov 92 14:59:11 GMT

hps@sdf.lonestar.org (Holt Sorenson) writes:

> VCL is a Borland IDE based "Virus Creation Laboratory" that creates

Don't blame Borland for what it not their fault. VCL is created with
Borland's TurboVision, that's why it resembles to Borland's IDE. What
you are saying seems to imply that Borland is somehow involved in the
creation of this stupid piece of malware that is VCL.

> poorly optimized, inefficient overwriting .COM and .EXE infectors.

It creates buggy, usually not running, not optimized at all, stupid
overwriting .COM infectors. Some of them can overwrite just all files
(*.*), but this does not mean that they can correctly infect EXE files
(i.e., without damaging them). It can also produce lame trojan horses.
It also tries to produce companion viruses, but they don't work.

> You can get ahold of it on most virus bbs's or from a virus writer or
> an anti-virus buff who would trust you with it. If you understand

The above is a totally unfounded flame against the honest anti-virus
researchers. You have already posted it twice. If you have any facts,
please speak up. But facts only, please.

> Assembly it is possible to patch the code and create virii and some of
> the code is sound enough to create a virus with.  Compared to the

You mean, if you are good enough in assembly language, you might find
the bugs in the viruses that VCL generates and eventually fix them. I
mean, fix the viruses, because you cannot fix the VCL program itself -
it's too buggy for that. But why bother? Anybody who is able to fix
those bugs should be able to write a virus himself, instead of using
the stupid things that VCL generates... :-)

> current technology available in the virus world it is outdated.

It has already been outdated, when it has been released... :-)

> Unfortunately, the author has promised to release a second version
> which is supposed to have several improvements that will make it more

Ah? Maybe he will be able to make a proper install program the next
time... The current installation procedure is buggy.

> fun for researchers to play with. I doubt it will create any serious
> problems though. The release will probably be in January or Feruary of

Of course, it doesn't create any serious problems. The only serious
problem is the trend - it's much harder to deal with 2,000 virus
creation tools than with 2,000 viruses... Fortunately, it is much
harder to write a working virus creation tool than it is to create a
working virus...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: PED8C@acadvm1.uottawa.ca (Paul Deveau)
Newsgroups: comp.virus
Subject: Need info on MONKEY virus (PC)
Date: 10 Nov 92 22:24:31 GMT

Hi: I haven't been reading this list in great detail lately, so please
excuse a question that has perhaps recently been answered.

Have any of you experienced the MONKEY virus?  It has been propagating
around here recently.  I have not been able to find much information
about this virus: How does it manifest itself?  What damage may it
inflict?  If any of you have details, would you be kind enough to
share them?

Thank you,

Paul
From: protonen@daimi.aau.dk (Lars J|dal)
Newsgroups: comp.virus
Subject: Re: Outdated F-PROT?? (PC)
Date: 11 Nov 92 09:54:57 GMT

Nobody seems to answered this, so I'll try...

ajchuah@mtu.edu (Low Profile) writes:

>Frisk and all,
>             I am currently using F-prot 2.04b on my machine and am
>using Virstop.  I haven't had any problems until recently.  I wanted
>to use F-prot 2.05 but since there was some mention on problems, i
>decided to stick with 2.04b.  Anyway, now when i boot up my machine,
>when it loads Virstop, it gives a message that sounds something like
>"This version of F-prot is rather old and ..." overall what it is
>trying to say is the version of f-prot i have is old and that i should
>replace it.  Is this some form of virus, a way of your program
>notifying me to switch or what?  This message comes on the screen
>without fail for the past 2 weeks.  Any help would be great.  BTW,
>what is the scope on the latest version of f-prot?  Thanx.

No, it is not a virus or anything like that. It is simply F-prot that
tells you that you are using an old version of the program and you
should get a newer if possible.  Why? Not because of new options, but
because the number of viruses grow fast. F-prot seems to be updated
bimonthly and every new version detects at least 50 (if not 100) new
viruses. Thus it is important to have a recently-updated program (of
course this goes for other antivirus programs as well as F-prot).  The
newest version is 2.06a. It is only a couple of days old, so maybe the
archive sites only have 2.06 (which is a week old).

+--------------------------------------------------------------------------+
| Lars J|dal                  | Q: What's the difference between a quantum |
| email: protonen@daimi.aau.dk|    mechanic and an automechanic?           |
|                             | A: A quantum mechanic can get his car into |
| Aarhus University           |    the garage without opening the door.    |
| Denmark                     |                    -- David Kra            |
+--------------------------------------------------------------------------+
From: P.E.Beaman@lut.ac.uk (Peter Beaman)
Newsgroups: comp.virus
Subject: Goblin Virus (PC)
Date: 4 Nov 92 14:04:49 GMT

This question is about the Goblin virus that was found by a Mexician
researcher on her diskette which was only one of a colection of discs
she brought o the Uk with her.

We erased the virus but I would like to hear from anyone else who may
have stopped this virus on their network/hard disc/disc.

I use Dr.Solomon's version 6. Toolkit to clean the boot sector which I
was told was the area affected.

Any views on Goblin much appreciated the Computer Centre here at LUT are 
also interested on any extra information

Peter Beaman
Social Psychology Technician
From: dboer@let.rug.nl (Ale de Boer)
Newsgroups: comp.virus
Subject: Info Grain of Sand Virus (PC)
Date: 4 Nov 92 13:23:02 GMT

Can anyone give information about the Grain of Sand virus. TBSCANX
noticed this virus while copying a file allegedly containing it. Scans
with McAfee turned up nothing, nor did TBSCAN. I could not find any
information about the GoS virus in VSUMX.

Best, Ale.
- -- 
________________________________________________________________
Ale de Boer, Department of English, University of Groningen
Oude Kijk in 't Jatstraat 26            E-mail: dboer@let.rug.nl
9712 EK  Groningen                      The Netherlands
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: SCAN 95b doesn't find MtE in EXE files (PC)
Date: 10 Nov 92 14:52:51 GMT

mcafee@netcom.com (McAfee Associates) writes:

> If VIRUSCAN did not pick up unencrypted copies of a virus, that means
> that we do not have a copy of the virus.  Readers may wish to note
> that sometimes the MtE produces an "unencrypted" virus, that is, one
> where no MtE encryption is performed.  In this case, no MtE virus
> would be found, and VIRUSCAN (SCAN) would have to look for the actual
> virus code.  If we do not have a copy of that particular MtE-based
> virus, then unencrypted copies will not be found until we receive a
> copy and analyse it.

There is an easy solution for this. It is so obvious, that I really do
not understand why you are not using it. The solution is to pick a
scan string from the unencrypted body of the MtE. This way you will be
able to find the unencrypted replicants - even if they contain a virus
not seen by you. It is enough that it uses the same version of the
MtE. And the encrypted samples (of an unknown virus) you should be
able to detect anyway - with your generic algorithm for detecting
MtE-generated decryptors.

The above solution is not 100% fool-proof. I mean, it will be possible
to write a virus, the unencrypted replicants of which will not be
detected by the above method. But -none- of the MtE-based viruses that
have been created yet are using this trick. Therefore, had you used
the simple method described above, you would have detected even those
MtE-based viruses of the existing ones that were unknown to you.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: ferris@turtle.fisher.com
Newsgroups: comp.virus
Subject: Virus or Hardware? (PC)
Date: 5 Nov 92 21:05:35 GMT

I had an infection of the stoned virus and my hard disk started giving
the 1701 error on bootup. I changed out the hard disk and controller
with a new, low-level formatted drive/controller. I scanned all
software for viruses and eliminated any that showed up. When the new
disk was loaded with the old files, I scanned it and found no viruses.

Now the new disk is giving me 1701's intermittently. Do I have a
hardware problem or a virus?

Thanks, Jeff
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: Re: MtE ?? (PC)
Date: 10 Nov 92 14:54:05 GMT

From:    Y. Radai <RADAI@vms.huji.ac.il>

>A few scanners succeed in detecting all
>such viruses in some existing text suites, but it is apparently
>impossible to obtain 100% detection on all possible MtE mutations
>(i.e. even when the underlying virus is unknown) in those cases in
>which an MtE encryption is not performed.

? Not sure why you say that.  Any unencrypted instance of a virus that
uses the MtE will contain the MtE itself in the file.  Just doing a
thorough scan for a signature from the engine will then detect the
infected file.  That's what we do, and it works.  (Of course, any
brand-new virus can have some brand-new method of encryption, and
therefore not be detected by a known-virus detector, but that's well
known, and has nothing to do with the MtE itself.)

DC
From: gary@sci34hub.sci.com (Gary Heston)
Newsgroups: comp.virus
Subject: Re: Checking high memory with VSCAN (PC)
Date: 2 Nov 92 20:26:45 GMT

ianst@qdpii.comp.qdpi.oz.au (Ian Staples) writes:

  [ about a discussion concerning potential high memory viruses ]

>Hmmm... does this imply that once we all have OS/2 or whatever on 386s
>or better, and 32-bit applications addressing oceans of flat memory
>space then we will have to wait forever for SCAN or some other to scan
>the whole bloody lot when we boot up each morning?

No. During boot, you'd simply install Virscan as your first step, and
let it trap anything that attempts to load while infected.

On booting, the memory contents are ignored and overwritten, so there's 
no need to scan it.

- -- 
Gary Heston    SCI Systems, Inc.  gary@sci34hub.sci.com   site admin
The Chairman of the Board and the CFO speak for SCI. I'm neither.
"...I looked out my window, and saw Kyle Pettys' car upside down, then I
thought 'One of us is in real trouble'." Davey Allison, re: a 150MPH crash
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Info on Commander Bomber and Starship? (PC)
Date: 4 Nov 92 11:15:52 GMT

pehmo@parker.ositech.fi (Petteri Jarvinen) writes:

> Has anybody dissected and analyzed these new advanced viruses like
> Commander Bomber and Starship? Virus Bulletin, perhaps?

I have seen several analyses of StarShip. Two excellent ones are by
Dmitry Gryaznov and Igor Muttik. Dmitry's analyse is published in
Virus News International (I think). Maybe Ken has Igor's description
on-line?

Commander Bomber is a damn hard thing... Something like the MtE, but
the MtE is about 2.5 Kb and this one is 4 Kb... :-( The virus itself
is relatively easy (I'll post a short description, if you are
interested) - just like the Dedicated virus is relatively trivial. The
hard thing is the code generation engine generates the small pieces of
code that transfer control to the main body... I have not "cracked" it
completely yet... :-(

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: gary@sci34hub.sci.com (Gary Heston)
Newsgroups: comp.virus
Subject: Re: Comment on the MtE wars (PC)
Date: 2 Nov 92 20:07:28 GMT

hobbit@ftp.com (*Hobbit*) writes:
>Obviously none of you are willing to publicly discuss the exact hows
>and whys of anyone's MtE-detection algorithm, for the usual reasons.
>So the entire discussion is so far based on percentage hit rate, which
>for me has significantly less meaning in terms of explaining WHY
>product A sucks and product B is so much better.  Is this just me, or
>does it smell like so much handwaving to anyone else, too?

No, not to me. I want to see a high hit rate from a large suite of 
test files, using every MtE-based virus known to generate the test
files. I'm not concerned with the algorithm, for a few reasons:

a) I'm not writing viral or antiviral code, so I have no use for it;

b) The authors of the antiviral products have invested a considerable
amount of work in them, and I see no reason to disclose that information
to their competitors (free information is a nice idea, but won't work in
other than a utopia, which we're not in...);

c) Disclosing how the scanners detect MtE would assist Darkie in finding
ways around detection, something I'm *not* in favor of;

d) There are independent surveys of the effectiveness of the scanners,
listing how well each of them do in identical environments. 

>Unfortunately I feel like I still have to slog through it all to find
>the occasional hard useful facts.

..Welcome to the net....  :-)

I find this group to be quite useful, due in great part to the excellent
job being done by KvW, and really appreciate his time and efforts. I
shudder to think what this group would be like if unmoderated....

- -- 
Gary Heston    SCI Systems, Inc.  gary@sci34hub.sci.com   site admin
The Chairman of the Board and the CFO speak for SCI. I'm neither.
"...I looked out my window, and saw Kyle Pettys' car upside down, then I
thought 'One of us is in real trouble'." Davey Allison, re: a 150MPH crash
From: BOORMABC@snyalfva.cc.alfredtech.edu (SysOp... TECH-Line BBS... Alfred)
Newsgroups: comp.virus
Subject: Michelangelo (PC)
Date: 6 Nov 92 03:55:00 GMT

Does anyone know how Michelanelo is transmitted.  We have a serious
problem at this institution with it's spread.

Basically my question is this: We know that it can transmit via a
5-1/4 disk in the A drive of a PC, but can it infect the boot sector
of a 3-1/2 floppy in the B drive?

Thank you.

Brian C. Boorman
SUNY College of Technology at Alfred
From: confused@cwis.unomaha.edu (stephen richard smith)
Newsgroups: comp.virus
Subject: scan with compressed drvs?? (PC)
Date: 2 Nov 92 07:57:36 GMT


   I couldn't find the FAQ post, I hope this isn't covered, If it is
please forgive me.  I have questions in relation to use of NAV. with
superstor. I know when I was using stacker I had to run NAV from
within a stacked drv to insure proper scan results due to problems
with stacker I have switched to superstor and while it(in my opinion)
is a more stable and superior compression prg. the documentation
sucks. I have called them and got half an answer (perhaps this is why
stacker is #1)
  MY QUESTIONS:
 1> should I run NAV from within the superstor container also- I
assume so as the basic concepts between the two are the same.
 2>can I run NAV from within a stacked container and get proper
results on a scan of a non stacked drv.
please Email answers to confused@cwis.unomaha.edu
 THANK YOU FOR YOUR TIME
SRS.

[Moderator's note: The VIRUS-L/comp.virus FAQ is available via
anonymous FTP from cert.org (192.88.209.5) in pub/virus-l OR by
sending e-mail to listserv@lehigh.edu stating "info virus-l".  A new
FAQ release is in the works and will also be posted to news.answers.]

__________________________________________________________________________
| the federal government is basically one enormous, ongoing meeting from |
| HELL-----Dave Barry                                                    |
- --------------------------------------------------------------------------
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: PS-MPC, similar to VCL (PC)
Date: 11 Nov 92 01:40:14 GMT

ACPS7115@RYEVM.RYERSON.CA (Mind Your Own Business!!!!) writes:

>Q: does McAFEE, for Frisk, have a scan string for the viruses made buy
>   the MPC?

Well, unfortunately there is no single string possible for all PS-MPC
generated viruses.  I have added detection of it, however, and I
believe version 2.06a (the latest F-PROT) gets them all - however, as
PS-MPC generates .ASM code, somebody could take the output and keep
modifying it, until my scanner misses it.  However, my heuristic
scanner would probably continue to detect it....

One note - even though the PS-MPC viruses are quite primitive, they
are "better" than the VCL viruses in one respect - they seem to work
properly.

- -frisk