HDTenEightyP/NetNews huggingface dataset:
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: A few questions (Stardot/V801/Michaelangelo) (PC)
Date: 2 Oct 92 16:48:32 GMT

KENNEY%NBECC.decnet@consrt.rockwell.com (NBECC::KENNEY) writes:

> - - are StarDot and V801 related?

I have no idea what NAV calls "V801", but the StarDot virus indeed has
such variant. In fact, it has variants with infective lengths 600,
789, and 801. Assuming that NAV calls StarDot.801 "V801", I suspect
that it has messed the two StarDot variants - StarDot.789 and
StarDot.801.

BTW, please not that this virus "pads" the files before infection in
such a way, that their size becomes a multiple of 16. Therefore, while
the length of the virus is 600/789/801 bytes, it can add more than
this amount of bytes to the infected files.

> - - how stealthy was Michaelangelo, and does it survive warm boots?

It isn't stealth at all, and it does NOT survive warm boots.

> - - can you tell where the start and end of an infected file are supposed to
> be algorithmically, so that one routine could trim off all length-variants of
> one or more virii?

Umm... it depends on the particular virus. For some viruses you can,
for some you cannot restore the original file exactly. The StarDot
viruses are one example of viruses, for which it is not possible to
restore the file size exactly. Another example is the good old
Jerusalem - you cannot disinfect more EXE files correctly.

Therefore, it is always a good idea not to rely on disinfection, but
simply to delete all infected files and to restore them from clean
backups.

> 	Since Stoned + Michaelangelo = bye-bye FAT, this is getting

No, Stoned + Michelangelo = bye-bye boot sector, not FAT. The FAT is
damaged only no some (almost not used today) hard disks, and for these
hard disks you don't need both viruses - either of them will do...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: rgasch@nl.oracle.com (Robert Gasch)
Newsgroups: comp.virus
Subject: Internet Worm SUMMARY (UNIX)
Date: 23 Sep 92 11:33:51 GMT


	A while back I requested references regarding papers about the
internet worm of November 89. Here is the promised summary of articles
which I have collected. These seem to be the major reports covering
the incident. There are doubtless a million other newspaper clippings
one could add to this list but I doubt that most of those would be
very informative as the articles below cover the subject in depth.

	The number after the authors name indicates the source I
obtained the particular article from. All of these articles are
availible from numerous sources so don't be surprised when you stuble
across these articles somewhere else.

	I'd like to apologize that it took me so long to compile this
list but I do not have direct FTP access and have to work via an FTP
server which slows things down. Lastly I'd want to thank all the
people who responded to my query and to all the kind souls that
actually sent me articles.

	The archives which I obtained the articles from are a good
place to nose around for other interesting things regarding security
and viruses. I found some worthwhile reading there.

	If anybody has any other articles which I did not catch then
please let me know as I'd like to read them myself.


Here's the list:
Eugene Spafford: 
	The Internet Worm Program: an Analysis (Purdue CS Technical
		Report TR-CSD-823) (1)
	The Internet Worm Incident (Purdue CS Technical Report
		TR-CSD-933) (1)
	The Internet Worm: Crisis and Aftermath (2)
		ACM, June 1986, vol 32, number 6 

Donn Seeley:
	A Tour of the Worm (3)
		- needs some hacking around before it will print on
		  a non-laserwriter

Mark Eichin and Jon Rochlins:
	With a Microscope and Tweezers: An Analysis of the Internet Virus
		of November 1988 (also knows as the MIT paper) (4)

The Cornell Commission (Ted Eisenberg, David Gries and others):
	The Computer Worm (5)
		Availible from Cornell (call 607-255-3324)

United States Court of Appeals (6)
	Document 928 F2D 504 - Court statement on Morris' appeal

Denning
	Computers Under Attack: Intruders, Worms and Viruses
	Addison Wesley Pub Co Inc. (ISBN: 0-201-53067-8)
	I've never seen this one so I can't judge if it's any decent
	but I've included it for sake of completeness.



Sources:
	(1) - ftp.cs.purdue.edu (/pub/spaf/security)
	(2) - any good technical library
	(3) - cs.utah.edu (/pub)
	(4) - cert.sei.cmu.edu (/pub/virus-l/docs)
	(5) - call or write cornell technical publications (607-255-3324)
	(6) - ftp.eff.org (/pub/cud/papers)

PS: European users may want to check out the archives in
	ftp.informatik.uni-hamburg.de

Cheers
- --> robert
rgasch@nl.oracle.com
From: cj@info.ucl.ac.be (Christine Jacqmot)
Newsgroups: comp.virus
Subject: Boot sector infected ! Virus ? (PC)
Date: 25 Sep 92 08:14:35 GMT

I think I got a virus on my PC but it is not detected by viruscan 8.5v91
from McAfee.

The boot sector has been modified with the following byte sequence:
08 01 00 02 00 02 00 00 F8 A0 00 1A 00 0E 00 1A

The effect is the following one:
whenever we try to read or write a floppy, the displayed message tells us
that there is "0 byte free, 0 byte allocated" on the floppy and then,
the contents of the diskette is lost.

The problems began after having used CDROM's which contain demo's of
products available in sharewares (but maybe this is pure coincidence!)

I'm afraid it will take some time before I will get the latest version
of McAfee's Viruscan.
Does someone know which anti-virus available on which anti-viral archive site
could help me ... if those problems are due to a virus, of course!

Thanks in advance

- ----

   Christine JACQMOT
   Research Assistant
   Universite Catholique de Louvain           Fax:   ++32 10 45 03 45
   Unite d'Informatique - Computer Sc. Lab.   E-mail: cj@info.ucl.ac.be
   2, Place Sainte-Barbe                      Tel: ++32 10 47 23 87
   B-1348 Louvain-la-Neuve
   BELGIQUE
From: msp2@midway.uchicago.edu (Michael S. Post)
Newsgroups: comp.virus
Subject: Thank you for help with Stoned (PC)
Date: 28 Sep 92 14:37:56 GMT

Thank you for all the help I have gotten with my virus problems.
Everything is now working and virus-free.

Although frustrating, I have now learned a lot about viruses, and so
maybe I'll recognize the signs a little sooner next time, and know a
little more about what to do....

Thanks again.

			-- Michael Post
			   mpost@math.ucla.edu
From: MISHRA@qut.edu.au
Newsgroups: comp.virus
Subject: VIRAX anti virus prgrm (PC)
Date: 29 Sep 92 02:11:00 GMT

Does anybody out there know the distributoers of an anti-virus program
called VIRAX in Australia.
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Anti-viral Documentation archive sites last changed 07 July 1992
Date: 1 Oct 92 18:54:01 GMT

Anti-viral Documentation archive sites	last changed 07 July 1992

cert.org
        Kenneth R. van Wyk <krvw@cert.org>
        Access is available via anonymous ftp, IP number 192.88.209.5.
        This site maintains archives of all VIRUS-L digests, alll
        CERT advisories, as well as a number of informational documents.
        VIRUS-L/comp.virus information is in:
                pub/virus-l/archives
                pub/virus-l/archives/predig
                pub/virus-l/archives/1988
                pub/virus-l/archives/1989
                pub/virus-l/archives/1990
                pub/virus-l/archives/1991
                pub/virus-l/archives/1992
                pub/virus-l/docs
                pub/virus-l/docs/reviews
        CERT information is in:
                pub/cert_advisories
                pub/cert-tools_archive

csrc.ncsl.nist.gov
        John Wack <JWack@nist.gov>
        This site is available via anonymous ftp, IP number 129.6.54.11.
        The archives contain all security bulletins issued thus far from
        incident response teams (CERT, CIAC, FIRST members).  It also
        contains many security-related publications and resource informa-
        tion about viruses and other threats, as well as archives of
        VIRUS_Ls and RISK forums.  The NIST computer security BBS is also
        accessible from this system by logging in to account 'bbs'.

lehiibm1.bitnet or ibm1.cc.lehigh.edu
        Ken van Wyk <LUKEN@LEHIIBM1.BITNET> new: <krvw@cert.org>
        This site has archives of VIRUS-L.  Access is through ftp,
	IP address 128.180.2.1 or by e-mail to LISTSERV@LEHIIBM1
	(or LISTSERV@ibm1.cc.lehigh.edu).
        The directory of interest is VIRUS-L.

uk.ac.hensa.micros
        HENSA/micros Managers <hensa@uk.ac.hensa.micros>
        Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
        NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
        FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
        Software archive for UK higher education sector. Anti-Viral stuff
        is not collected into a distinct area. Hostname is in UK format.
        (This site previously known as uk.ac.lancs.pdsoft.)

unma.unm.edu
        Dave Grisham <dave@unma.unm.edu>
        This site has a collection of ethics documents.
        Included are legislation from several states and policies
        from many institutions.
        Access is through ftp, IP address 129.24.8.1.
        Look in the directory /ethics.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Recent IBM Virus List? (PC)
Date: 2 Oct 92 17:35:50 GMT

mechalas@mentor.cc.purdue.edu (John Mechalas) writes:

> Where can I find a current list of known IBM viruses that is in the
> public domain?  I am looking for virus name, type, disinfectant
> method, and short description if possible.  I see a lot of lists, but
> most of them are either (a) old or (b) copyrighted.

Hmm, I don't know whether the thing that you want exists... You could
consider the following options:

1) Patricia Hoffman's VSUM. Shareware hypertext information about IBM PC
viruses. Contains A LOT of information. Drawbacks: most of the
information is incorrect and/or incomplete. Some of the virus variants
listed even do not exist. Available from many places, including ours:

ftp.informatik.uni-hamburg.de:pub/virus/progs/vsumx208.zip

2) The Computer Virus Catalog, published by VTC-Hamburg (i.e., us).
Very technical, describes viruses for different platforms (IBM PC,
Amiga, Atari ST, Macintosh). Freeware, but not public domain - we
still have the copyright and you must not modify it, if you give it to
others. Drawbacks: the IBM PC platform is not covered well. Only about
10% of the existing viruses for it are described. Available from

ftp.informatik.uni-hamburg.de:pub/virus/texts/catalog/msdosvir.zip

3) The comparative scanner tests for FindVirus, F-Prot, and SCAN. They
also list the standard CARO name of each virus, together with the
names given by the above scanners. The list is very complete - it 
lists ALL viruses from our virus collection. It is public domain - 
you can do with it whatever you want. Drawbacks: only lists the 
viruses. No further information about them is given, except that they 
are divided into boot/MBR and file infectors. Available from

ftp.informatik.uni-hamburg.de:pub/virus/texts/tests/naming.zip

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Macintosh Anti-viral archive sites last changed 17 August 1992
Date: 1 Oct 92 18:55:03 GMT

Macintosh Anti-viral archive sites	last changed 17 August 1992

dftnic.gsfc.nasa.gov
        Brian Lev <lev@dftnic.gsfc.nasa.gov> <SDCDCL::LEV> <LEV@DFTBIT>
        This site offers the "MacSecure" package, made up of John Norstad's
        Disinfectant, and a pair of locally developed HyperCard stacks:
        Joe McMahon's "Anti-Viral Doc" and Brian Lev's "MacHelper".
        Floppy disk:
                Advanced Data Flow Technology Office
                Code 930.4
                Goddard Space Flight Center
                Greenbelt, MD 20771 (Attn: Brian Lev)
        DECnet Copy from DFTNIC::CLDATA:[ANONYMOUS_FTP.FILES.MAC]
                BinHex (ASCII) format as MACSECURE31.HQX
                binary format as MACSECURE31.SEA
        Anonymous FTP from DFTNIC.GSFC.NASA.GOV (128.183.10.3)
                BinHex (ASCII) format as [.FILES.MAC]MACSECURE31.HQX
                binary format as [.FILES.MAC]MACSECURE3.SIT

eugene.utmb.edu
        John Perry <perry@phil.utmb.edu>
        This site can be reached through anonymous ftp.
        The Macintosh anti-viral archives can be found in the
        directory /pub/virus-software/macintosh.  The IP address is
	129.109.1.21.  A backup site is maintained at beach.utmb.edu,
        IP address 129.109.1.207.  Look in [ANONYMOUS.PUB.VIRUS.MAC].

ifi.ethz.ch
        Danny Schwendener <macman@ethz.uucp>
        Interactive access through DECnet (SPAN/HEPnet):
                $SET HOST 57434  or $SET HOST AEOLUS
                Username: MAC
        Interactive access through X.25 (022847911065) or Modem 2400 bps
        (+41-1-251-6271):
                # CALL B050 <cr><cr>
                Username: MAC
        Files may also be copied via DECnet (SPAN/HEPnet) from
                57434::DISK8:[MAC.TOP.LIBRARY.VIRUS]

rascal.ics.utexas.edu
        Werner Uhrig <werner@rascal.ics.utexas.edu>
        Access is through anonymous ftp, IP number is 128.83.138.20.
        Archives can be found in the directories mac/virus-catchers
        and mac/virus-docs.

src.doc.ic.ac.uk
	Lee McLoughlin <ukuug-soft@doc.ic.ac.uk>
	Automatically maintained mirror copy of the sumex archive.
	Anonymous FTP from src.doc.ic.ac.uk (146.169.2.1)
		cd mac/sumex/info-mac/virus
	Janet NIFTP (for UK users)
		Host: uk.ac.ic.doc.src
		User: guest
		Pass: your email address
Path: <PUB>mac/sumex/info-mac/virus
	ISO FTAM
		Janet Addr:     000005102000
		IXI Addr:       204334504108
		Internet Addr:  146.169.2.1
		User: anon
Path: mac/sumex/info-mac/virus
	Interactive
		Janet:  pad uk.ac.ic.doc.src (00000510200001)
		Internet: telnet src.doc.ic.ac.uk [146.169.2.1], User: sources
		ISO VT (see FTAM for addresses), User: sources

sumex-aim.stanford.edu
        Bill Lipa <info-mac-request@sumex-aim.stanford.edu>
        Access is through anonymous ftp, IP number is 36.44.0.6.
        Archives can be found in /info-mac/virus.
        Administrative queries to <info-mac-request@sumex-aim.stanford.edu>.
        Submissions to <info-mac@sumex-aim.stanford.edu>.
        There are a number of sites which maintain shadow archives of
        the info-mac archives at sumex:
        * MACSERV@PUCC               services the Bitnet community
        * LISTSERV@RICEVM1           for e-mail users (Bitnet)
        * listserv@ricevm1.rice.edu  for e-mail users (Internet)
        * FILESERV@IRLEARN           for folks in Europe

uk.ac.hensa.micros
        HENSA/micros Managers <hensa@uk.ac.hensa.micros>
        Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
        NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
        FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
        Software archive for UK higher education sector. Anti-Viral stuff
        is not collected into a distinct area. Hostname is in UK format.
        (This site previously known as uk.ac.lancs.pdsoft.)

wsmr-simtel20.army.mil
        Robert Thum <rthum@wsmr-simtel20.army.mil>
        Access is through anonymous ftp, IP number 192.88.110.20.
        Archives can be found in PD3:<MACINTOSH.VIRUS>.
        Please get the file 00README.TXT and review it offline.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: VIRSCAN detects Yankee-Doodle 2885 (PC)
Date: 2 Oct 92 18:12:39 GMT

mechalas@mentor.cc.purdue.edu (John Mechalas) writes:

> The PC-compatibles in our labs are using the IBM Anti-Viral package
> VIRSCAN, version 2.1.9.

>    Recently, we have been getting a handful of reports of the Yankee
> Doodle-2885 virus in some of our .EXE files.   So far we have been able
> to eliminate the viruses by replacing the infected files.
>    My questions are as follows:

>      1) Does VIRSCAN have a tendancy to cause a false positive 
>         for Yankee Doodle?  I think we really do have a virus, but
>         I'd like to check this option anyway.

At least the version that we have doesn't, but it is 2.2.3A.

>      2) I check F-Prot's virus base, but of course every virus is
>         labeled differently between scanners.  :)  Which version of
>         Yankee Doodle do we have, as in what does this strain do?

The standard CARO name of the virus that has probably infected your
computer is Yankee_Doodle.TP-44.A. F-Prot calls it "Yankee (TP-44)".
You could look in its virus help database under the entry "Yankee" or
"Vacsina" (both point to one and the same text), but have in mind that
the information about viruses in F-Prot's help database is very
limited.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: KENNEY%NBECC.decnet@consrt.rockwell.com (NBECC::KENNEY)
Newsgroups: comp.virus
Subject: A few questions (Stardot/V801/Michaelangelo) (PC)
Date: 24 Sep 92 02:00:00 GMT


	The PC anti-viral programs at my location have been getting
quite a workout lately, with 4 viruses appearing in the last 3 months.
(Joshi, Stoned, Stardot 789, and Michaelangelo) We use Virhunt as a
scanner/cleaner, and use Norton as an interceptor.  Norton AntiVirus
vs.  Stardot was notable, though.  Norton 2.0 (20all06.def) and 2.1
both identified this as V801 instead.  (Both Stardot and V801 are
non-destructive .COM and .EXE infectors, which come in varying
lengths: boring stuff, really.)  V2.0 said it couldn't clean it in a
error-laden text box; V2.1 tried to clean it, leaving unusable files
behind.  Virhunt cleaned all the files neatly.  Still, Norton did the
intercepts.  All of this has led to a few questions:

- - are StarDot and V801 related?

- - how stealthy was Michaelangelo, and does it survive warm boots?

- - can you tell where the start and end of an infected file are supposed to
be algorithmically, so that one routine could trim off all length-variants of
one or more virii?

	Since Stoned + Michaelangelo = bye-bye FAT, this is getting
very interesting.  (I've sent the Stardot to Norton, so maybe on their
next update...)		
						Good luck.   KpK
From: mechalas@mentor.cc.purdue.edu (John Mechalas)
Newsgroups: comp.virus
Subject: VIRSCAN detects Yankee-Doodle 2885 (PC)
Date: 24 Sep 92 19:09:53 GMT

The PC-compatibles in our labs are using the IBM Anti-Viral package
VIRSCAN, version 2.1.9.

   Recently, we have been getting a handful of reports of the Yankee
Doodle-2885 virus in some of our .EXE files.   So far we have been able
to eliminate the viruses by replacing the infected files.
   My questions are as follows:

     1) Does VIRSCAN have a tendancy to cause a false positive 
        for Yankee Doodle?  I think we really do have a virus, but
        I'd like to check this option anyway.

     2) I check F-Prot's virus base, but of course every virus is
        labeled differently between scanners.  :)  Which version of
        Yankee Doodle do we have, as in what does this strain do?

   Thank you for your help.


- -- 
John Mechalas                             [This space intentionally left blank]
mechalas@mentor.cc.purdue.edu
Purdue University Computing Center                 Help put a ban on censorship
General Consulting                                        #include disclaimer.h
From: msp2@midway.uchicago.edu (Michael S. Post)
Newsgroups: comp.virus
Subject: Stoned and disk problems (PC)
Date: 23 Sep 92 04:31:22 GMT

I just got a new 486DX, and I partitioned the hard drive, putting DOS
5.0 into one partition and OS/2 2.0 into the other.  Now, I am having
problems reading SOME of my high density 1.44" drives when I am in
DOS.  If I format a disk, and then type 'a:' to switch to the drive,
it tells me it can't read the disk.  Also, some of my old disks can't
be read.  In OS/2, I can read these same disks and format.  I
discovered that when my disks are write protected, they will continue
working if they already were.  As soon as I remove write protection,
and the a: drive is used, even just doing a dir, suddenly something is
damaged.

When I ran SCAN v.93, it said that it found [Stoned] in memory and
Michaelangelo in the partition.  Are these viruses causing the problem
with the disk drive, or is it something else?  Note: my 1.2Mb 5.25"
drive, b:, is working just fine.

I renamed autoexec.bat and config.sys, and still booting off of the
hard drive makes the stoned virus appear in memory.  Where is it
coming from when I turn on the machine?  The IO.SYS and MSDOS.SYS
files?  They went through the scanning program OK.  Could my purchased
install diskettes have a virus?

Thanks.  PLEASE, if you are responding, send a duplicate back to me.
Either reply to this address or send e-mail to mpost@math.ucla.edu.
Thanks again.

			-- Michael
From: ARTHUR@brfuel.bitnet
Newsgroups: comp.virus
Subject: Request on Brazil Virus! (PC)
Date: 1 Oct 92 16:44:16 GMT

Some subscrivers from a brazilian list have reported a virus that
erases the FAT and block the computer (PC). They related that the
following antivirus weren't able to find these virus:
- - Norton AntiVirus 1.5
- - Central Point Antivirus 1 U 2.2
- - Scan/Clean 7.6v80
- - Vshield v80

Could someone help us?

LUIZ ARTHUR PAGANI
DEPARTAMENTO DE LETRAS VERNACULAS E CLASSICAS
CENTRO DE LETRAS E CIENCIAS HUMANAS
UNIVERSIDADE ESTADUAL DE LONDRINA
LONDRINA - PARANA' - BRASIL
CAIXA POSTAL 6001 - CEP 86051-970
TEL: (0432) 21-2000 RAMAL 428
FAX: (0432) 27-6932
E-MAIL: ARTHUR@BRFUEL.BITNET
RESIDENCIA: R. PARANAGUA', NO. 2035, APT. 203 - CENTRO - LONDRINA
            CEP: 86.015-030
            TEL: (0432) 23-9956
From: tcthompson@ucdavis.edu (Teresa Thompson)
Newsgroups: comp.virus
Subject: Brazil Virus (PC)
Date: 2 Oct 92 06:20:07 GMT

HI, I'm helping some friends in Brazil, who are having some problems
with a new kind of virus, called "Brazil Virus".

They asked me to write this email to you , to check out if you have
any information on this new virus, and also if you know of any
programs that could detect it , before it reaches the hard drive and
locks up the computers.
 
If you have any information on this virus, or some idea that could
help them, please write an email to Gomide@APQ.FAPESP.BR . I'm sure
they'll appreciate it!

 THANK YOU VERY MUCH FOR YOUR HELP,

				Teresa Thompson
				Tcthompson@ucdavis.edu