HDTenEightyP/NetNews huggingface dataset:
From: KARGRA@GBA930.ZAMG.AC.AT
Newsgroups: comp.virus
Subject: re: os2-stuff (OS/2)
Date: 23 Dec 92 07:36:37 GMT

Hi Vesselin,
as pointed out in point 10 at least *.dll and *.drv files contain code which
cannot be executed by the user, but is loaded and executed as any other *.ov?
As there are viruses which infect overlays, they can be infected in a similar
way. However, if the virus is not specialized on these newer formats, they
shurely will be destroyed. BUT: Si vis pacem, para bellum. (If you want peace,
prepare for war.) I hope things will stay too complicated for most virus-
writers for the next 5 x 10^9 years.
Silly me! Forget about point 4...
Yesterday I downloaded the newest versions of McAfees OS2-scanning software.
There is a os2-specific version for netscan, so I'll try this one too, though
I do not expect it will work, as there is no network here on my poor, lonesome
home-pc. :)
Sorry for missing point B8. I'll look it up immediately. Thanks for info.
The only mention of the /EXT= switch of F-Prot I found in NEW.206. It is
definitely missing in COMMANDS.DOC. I just looked up all textfiles. Even
READ_ME.DOC :-)
As I go on vacation, I hope to report my results in January.

         A                                             A
        AXA                                           AXA
        OOO        M E R R Y   C H R I S T M A S      OOO
        OVO                                           OVO
         V                    and a                    V
         I                                             I
        ---         H A P P Y   N E W   Y E A R       ---
        I I                                           I I
        I I             WITHOUT MICH et al.           I I
        I I                   Alfred                  I I
        ---                                           ---
From: ygoland@edison.SEAS.UCLA.EDU (The Jester)
Newsgroups: comp.virus
Subject: Viral Code Access
Date: 6 Jan 93 08:44:34 GMT

I REALLY don't mean to start this debate again but my personal
experience have left me with little choice:

The Situation:I am trying to get ahold of a certain virus because it
implements certain features which are of central importance to a paper
I'm writing. (Note:I am trying VERY hard to leave out all details
because I want this to be a discussion of topic and not a hidden
request, something the moderator has made clear he will not stand for
and a request I intend to respect.) The problem is that for all
intents and purposes I am a 'nobody'. I am a Junior at U.C.L.A.'s
school of engineering and getting my degree in computer science and
engineering. In addition just about everybody has a dead on
prohibition against giving anyone their viral code, even though they
got it from someone. So I have been totaly unable to get a copy of
this virus.

Solution:One researcher who shall rename nameless suggested that I
call a virus exchange board in order to get a copy of the virus. In
other words that I go skulk around with the miscreants who keep many
of you employed so I can get the material I need for my paper. However
its not just a matter of dealing with the lowest of the low. Many
viral exchange bbses require you to upload a new virus in order to
access their collection. Should I go out and write some hyper deadly
virus so I can get into their collection in order to look at the
virus that every researcher and his brother already has but is to
scared to give out? Maybe I should just write a moderatly deadly
virus? A dude? What?

Is this how the anti-viral community wants to run itself? Is this
'open and free exchange of information'? 

[Moderator's note: This is obviously a touchy subject.  I stand by my
policy of keeping requests for live viruses off of the group.  At the
same time, I certainly recognize the need to get virus samples to the
appropriate people for analysis purposes.  I welcome thoughts and
discussions on this issue.]

				Yaron (The Jester) Goland
- -- 
"Only the blind see in color."
"Any union based upon pigment is foolish ignorance designed to
give power to those few who enjoy power's taste above the common
welfare."
From: HAYES@urvax.urich.edu
Newsgroups: comp.virus
Subject: McAfee libel suit (From Risks-l Digest...)
Date: 31 Dec 92 21:43:39 GMT

Hi.

Following is a cross-post from risks-l digest.  Does anyone know more
about what exactly happened?  And are they (if any) any legal problems
for the end users?

BTW, found nothing in the local paper <sigh>...

In any cases....  Happy New Year to all!

Claude.

- ------  begin forwarded message ---

RISKS-LIST: RISKS-FORUM Digest  Thurs 31 December 1992  Volume 14 : Issue 20
 
        FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS
   ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator
 
Date: Thu, 31 Dec 92 11:31:38 PST
From: Peter G. Neumann <neumann@csl.sri.com>
Subject: Antiviral technology target of legal action
 
The Washington Post has an article by John Burgess (at least some of
which appears in today's San Francisco Chronicle) discussing a federal
judge's order to McAfee Associates of Santa Clara CA, to stop
distributing their Pro-Scan Version 2.31 and ViruCide Version 2.33 and
derivative products.  Imageline Inc. of Richmond VA (maker of
PicturePak and ValuePak) has sued McAfee Associates for libel, fraud,
and other misdeeds, because those antiviral products mistakenly
identify Imageline products as containing viruses.  Stay tuned for
further details.

- ----- end forwarded message ---

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Claude Bersano-Hayes     HAYES @ URVAX                 (Vanilla BITNET)
University of Richmond   hayes@urvax.urich.edu     (Bitnet or Internet)
Richmond, VA  23173
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Export restrictions of anti-virus software?
Date: 7 Jan 93 21:10:21 GMT

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:

>A check with Ottawa resulted in the statement that F-PROT was export 
>restricted (controlled) as shareware did not meet the criteria of this 
>general "software" note... Therefore SCAN by McAfee also would not 
>meet the requirements.

Extremely silly, of course....not that it affects either us or McAfee, of
course - we export our programs to Canada, not from there, but I find it
extremely hard to believe that anybody takes this regulation seriously.

Of course, there is not that much Canadian anti-virus software around, is
there :-)

- -frisk
Fridrik Skulason      Frisk Software International     phone: +354-1-694749
Author of F-PROT      E-mail: frisk@complex.is         fax:   +354-1-28801
From: RADAI@vms.huji.ac.il (Y. Radai)
Newsgroups: comp.virus
Subject: Re: Good and bad viruses (was FC on virus creation)
Date: 7 Jan 93 15:57:22 GMT


  Suzana writes:

> With properly defined computer virus there shoudln't be doubts what is
> a good and what is a bad virus. Or should be ? Let's suppose that bad
> virus is intended to cause some unwanted function in system. Some
> programs (even antiviral) can do the same thing, (what is unwanted
> function anyway ?) but they cannot propagate. Good virus can
> propagate, but it is supposed to not invoke anything unwanted. But, by
> definition good virus can mutate, so can become bad virus.

But it doesn't *have to* become a bad virus.  And if it does become
one, then by most people's definitions it probably wasn't really a
good virus to begin with.

>                                                            Also, good
> virus on one system can be bad virus on another system (causing some
> unwanted function).

Correct in principle, but not too likely to occur in practice.

>                     Could all bad viruses be good viruses ? Yes,
> because without them many A-V producers would loose their source of
> money.

I think a lot of readers will find that a rather amusing example of
"goodness" of a virus.  Are you serious?

>        Can all good viruses be bad viruses ? Yes, because they are
> viruses (something very suspicious).

Only because there are (at least) two different meanings of the word
"virus".  If you play on that, you can prove almost anything.

>                                      Confusing ? Not to anyone who
> ever met chinese philosophy and principles of Yin and Yang. Shortly,
> good and bad are inseparable and dependent one of the another (you
> can't define good without defining bad and vice versa).

Even if you can't define "good" without defining "bad", that doesn't
imply that one *becomes* the other, or that there is no distinction
between them.  In my opinion, this is a very confused philosophy.

> So, what to do ? Let's throw (unnecessary) philosophy ....

Excellent idea ....

                                     Y. Radai
                                     Hebrew Univ. of Jerusalem, Israel
                                     RADAI@HUJIVMS.BITNET
                                     RADAI@VMS.HUJI.AC.IL
From: vpcsc11@sfsuvax1.sfsu.edu (student)
Newsgroups: comp.virus
Subject: Known virus that tweaks PC date function? (PC)
Date: 5 Jan 93 22:57:57 GMT

In the office where I work, we recently purchased a 286 clone..  Over
the past few weeks, the computer's internal clock has been losing
days.  The first time, it stuck on Thanksgiving.  A week later, it
hung on December 7th (Pearl Harbor Day).  A few weeks later, it stuck
on Christmas Eve.

Has anyone heard of a virus that would produce these symptoms?  If
not, does anyone have any other ideas about how to fix the problem?

Please respond via e-mail to:  vpcsc11@sfsuvax1.sfsu.edu

Thanks!
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Untouchable (PC)
Date: 7 Jan 93 20:27:19 GMT

bill.lambdin%acc1bbs@ssr.com (Bill Lambdin) writes:

> UTScan
> Detection is fair
> removal leaves a lot to be desired.
>  
> I would place F-Prot, VIRx, and Scan in front of it.

> UTRes
> Detection is fair.

I has improved much since then. And I even don't have the latest
version...

> UTPeriodic
> This is one of the best integrity checkers that I have seen. I would put 
> it in the same league with Victor Charlie's Bit Checking, or Integrity 
> Master.

I have not seen a recent version of Victor Charlie, so I cannot
comment on that. (I saw on a few years ago and it was very poor, but I
have heard that the product has been completely redesigned.) Integrity
Master is undoubtedly the best shareware integrity checker around, but
it is still MUCH worse that the integrity checker in Untouchable...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: Does anyone have info on DAME (PC)
Date: 29 Dec 92 06:47:00 GMT

Quoting from Dave Mickle X5205 to All About Does anyone have info on on 
12-20-92

DM> We've got a PC which is displaying a message to the effect it's
DM> infected by the "DAME" virus.  Don't know what symptoms there are in
DM> addition to the message.  We're going to do a low level format, but
DM> would like to know what we've contracted.

I don't know of a DAME virus.
 
Did yje virus display that information, or did McAfee's Scan report this?
 
If this was reported by Scan, it found a a virus that uses the DAME
(Dark Avenger Mutation Engine). The DAME also known as MtE is a
routine that causes the virus to mutate.
 
Bill

- ---
 * WinQwk 2.0 a#383 * Viruses often make my FAT go on a crash diet.
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Amiga Anti-viral archive sites last changed 17 August 1992
Date: 3 Jan 93 01:04:21 GMT

Amiga Anti-viral archive sites		last changed 17 August 1992

eugene.utmb.edu
	John Perry <perry@phil.utmb.edu>
	This site can be reached through anonymous ftp.
	The Amiga anti-viral archives can be found in the
	directory /pub/virus-software/amiga.  The IP address is 129.109.1.21.
	A backup site is maintained at beach.utmb.edu,
	IP address 129.109.1.207.  Look in [ANONYMOUS.PUB.VIRUS.AMIGA].

ms.uky.edu
        Sean Casey <sean@ms.uky.edu>
        Access is through anonymous ftp.
        The Amiga anti-viral archives can be found in /pub/amiga/Antivirus.
        The IP address is 128.163.128.6.

uk.ac.hensa.micros
	HENSA/micros Managers <hensa@uk.ac.hensa.micros>
	Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
	NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
	FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
	Software archive for UK higher education sector. Anti-Viral stuff
	is not collected into a distinct area. Hostname is in UK format.
	(This site previously known as uk.ac.lancs.pdsoft.)
From: U33515@UICVM.UIC.EDU
Newsgroups: comp.virus
Subject: Re: CHRISTMA EXEC (IBM VM/CMS)
Date: 22 Dec 92 22:14:20 GMT

Howdy!

About 6-8 months ago I received a "ZEBRATELL EXEC", this was the
CHRISTMA with a new hook.   ( It sent tells with each letter a
different color )     My copy of ZEBRATELL does not erase itself.

I did read the code and send it, with a warning, to our systems
administrators, they were able to prevent it from spreading to
or from our node.

Happy Holidays,

Tom Kirke                        |     All standard and non-standard
U33515@UICVM.CC.UIC.EDU          | disclaimers, declaimers, and claimers
U33515@UICVM.CC.UIC.EDU@INTERNET#|                apply.
APPLELINK:HARDBALL               |

We have discovered a *therapy* (NOT a cure) for the common cold,
                  play tuba for an hour.
From: haverkam@uni-duesseldorf.de (Wilhelm Haverkamp)
Newsgroups: comp.virus
Subject: Info on Vascina and 1701/1704 in Novell networks wanted (PC)
Date: 30 Dec 92 08:51:28 GMT

Who has got experiences with Vascina and 1701/1704 viruses on Novell
networks (SFT 286, V. 2.15)?  What would be the correct reaction of
the system administrator?  Any help will be appreciated. Please mail
directly to me.  Best wishes for 1993.  Wilhelm
From: David_Conrad@MTS.cc.Wayne.edu
Newsgroups: comp.virus
Subject: Re: VSHIELD, VIRSTOP, ... comparison ? (PC)
Date: 23 Dec 92 10:16:52 GMT

In VIRUS-L v5i207 Nemrod_Kedem@f101.n9721.z9.virnet.bad.se (Nemrod Kedem) write
s:
> > 3) VShield uses much more memory than VirStop.
>
>But may be loaded to high memory, and then needs less then 1K of
>conventional memory.
 
Implying that Virstop cannot?!  Virstop can be loaded high, and then
requires no conventional memory.
 
And still, VSHIELD will use more high memory that Virstop, reducing the
number of other things you can have loaded high simultaneously.
Even with loadhigh in DOS 5.0, smaller is still better when it
comes to memory-resident programs.
 
Regards,
David R. Conrad
David_Conrad@mts.cc.wayne.edu, dave@michigan.com
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: NEW MPC On the way (PC)
Date: 5 Jan 93 18:22:37 GMT

ncoast!arnold@usenet.INS.CWRU.Edu writes:

> again about a week after the anouncement.  I have also been told that
> McAFEE can already detect all the virus created with the MPC.  Note:

At least version 99 of SCAN cannot.

> There is a new Mutation Engine out called TPE, it E It is from Italy
> or Somewhere near in, and supposedly it is better an MTE.  I don't

TPE seems to be from the Netherlands, according to my information...
There is already at least one virus that uses it; we are calling it
Girafe. TPE is smaller than MtE - about 1.6 Kb, compared to the 2.5 Kb
of MtE. At first look it seems indeed more polymorphic, because there
are no fixed things like JNZ backwards as in the decryptors generated
by the MtE. However, if you take a closer look, you'll see that it is
actually less polymorphic and if you ignore the noise instructions in
the decryptor, the total number of possible decryptors seems to be
less than in MtE... Of course, further analysis is needed in order to
confirm that.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: aryeh@mcafee.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: Vshield vs Virstop (PC)
Date: 7 Jan 93 01:22:10 GMT

Hello Bill Lambdin,

You write:
[regarding VSHIELD's ability to check validation (CRC) data created by SCAN]
 
>2. These CRCs will not detect stealth infectors because stealth viruses 
>   disinfects infected files when an infected file is opened for any 
>   reason.

VSHIELD (or SCAN) will detect the change in a CRC made by a stealth
virus provided the stealth virus is not resident in memory to
interfere with checking.

Regards,

Aryeh Goretsky
Technical Support

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET: aryeh@mcafee.COM
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | IP# 192.187.128.1
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
From: markt@harlqn.co.uk (Mark Tillotson)
Subject: Re: Arbitrary precision with large bases
Organization: Harlequin Limited, Cambridge, England
Date: Thu, 7 Jan 1993 12:48:34 GMT

emcoop@bnr.ca (hume smith) writes:
> not quite true - see aho/hopcroft/ullman.  f1*f2 can be done
> in O(n log(n)) where n=max(log(f1), log(f2)).  there's a rather large
> constant involved though... it may be better to implement the two
> and find out empirically when to switch methods.
> 
Not _quite_ right, the complexity of Schoenhase-Strassen(?) multiply
algorithm is O(N.log(N).log(log(N))).  It must count as one of the 10
neatest algorithms I know!  You do need to implement both methods,
because for really large N, it has to recurse to do the
sub-multiplications (this recursion is responsible for the log(log(N))
term).  When the numbers are small enough (each level of recursion
deals with numbers which have a number of digits roughly the
square-root of the number of digits in the higher level), you switch
to long-multiplication.

I believe a tight implementation can start to win over straight long
division when the numbers get to be a few hundred digits long.   When
the numbers get to be hundreds of millions of digits, it is the only
practical way!!

I believe there is a proof that no multiplication method can be better
than O(N.log(log(N))) or some such.


------------------------------------------------------
|\  /|          | ,  M. Tillotson       Harlequin Ltd. \
| \/ |  /\| |/\ |<   markt@uk.co.harlqn  Barrington Hall,\
|    |  \_| |   | \  +44 223 872522       Barrington,      \
I came, I saw, I core-dumped...            Cambridge CB2 5RG \
From: bevan@cs.man.ac.uk (Stephen J Bevan)
Newsgroups: comp.programming
Subject: Re: Programming by Description of Output...
Date: 4 Jan 93 16:32:18 GMT
	<BEVAN.93Jan1134444@panda.cs.man.ac.uk>
	<1993Jan4.045009.2471@cs.cornell.edu>
Organization: Department of Computer Science, University of Manchester
In-reply-to: karr@cs.cornell.edu's message of 4 Jan 93 04:50:09 GMT

In article <1993Jan4.045009.2471@cs.cornell.edu> karr@cs.cornell.edu (David Karr) writes:
   A denotational semantics of a programming language is a formal spec of
   the language itself; strangely (or perhaps not so strangely), such specs
   *are* executable in Standard ML.

[ Shouldn't that be "in, for example, Standard ML" since almost any
  (programming) language can be used as the meta-language for a
  definition? ]

1. Many (most?) denotational definitions are not as abstract as they
   could be, i.e. they often overspecify the language.  This is
   particularly true of denotational definitions of the context
   conditions (static semantics if you prefer) of languages.

2. I've seen some denotational definitions executed (I've even written
   some), but I've never seen an _executable_ definition of "real"
   language containing some form of parallelism.  This is not to say
   it can't be done; examples to the contrary are welcome.

bevan
Newsgroups: comp.programming
From: pt@geovision.gvc.com (Paul Tomblin)
Subject: Fillet Mode
Reply-To: pt@geovision.gvc.com
Organization: Not officially GeoVision Systems Inc., Ottawa, Ontario
Date: Tue, 5 Jan 1993 03:25:07 GMT

In article <BzKv0M.1I3@geovision.gvc.com>, I wrote:
| I'm trying to figure out the algorithm for this, but I thought I'd ask
| first:
| 
| I want to generate lines with fillets - ie. line segments joined by
| fixed-radius arcs.  I.e. I'd like to be able to get a user to enter a
| radius, and then digitize a polyline, and I'd change all the corners to nice
| arcs.
| 
| Given: Corner points of a polyline, and a fillet radius
| Generate: the parameters for the arcs at each corner point (ie. radius,
| start point, end point, or 3 points that define the arc)
| 
| If anybody can email an algorithm for this, I'll be happy to share my final
| code.

I got two really helpful replys via email.  I have no idea if people posted
responses, because my newsfeed went down for 3 weeks soon after asking.

One was from Rich Wells (wells@cdsmn.mn.org), who sent me a description of
an algorithm in geometric terminology.

Another was from Michael Jones (mtj@babar.asd.sgi.com), who, not suprisingly
considering where he works, sent me some code that uses SGI mathematical
libraries.  However, it isn't too hard to figure out what the various
PF.*_VEC3 functions do to 3d vectors - especially if you understand Rich's
description.

Thanks to both of them.  I shall be translating Michael's code into our own
Geographic Macro Language for this program I'm writing.

If anybody wishes a copy of these responses, or has some other code they'd
like to share, you can email me.

-- 
Paul Tomblin, pt@compass.gvc.com
(This is not an official opinion of GeoVision Systems Inc.)
"No matter what you've lost - be it a home, a love, a friend - like the 'Mary
Ellen Carter' rise again." - Stan Rogers - "Mary Ellen Carter"
Newsgroups: comp.programming
From: markt@harlqn.co.uk (Mark Tillotson)
Subject: Re: Locating duplicates
Organization: Harlequin Limited, Cambridge, England
	<1993Jan5.150010.27104@ulysses.att.com>
	<MARKT.93Jan7122729@wundt.harlqn.co.uk>
	<1993Jan8.051051.18788@organpipe.uug.arizona.edu>
Date: Tue, 12 Jan 1993 17:48:30 GMT

dave@cs.arizona.edu (Dave Schaumann) mentions (when talking of my
hashing method for duplicate-detection):
> If you choose the number of buckets at run-time based on the number
> of elements, you might as well just use the "radix sort" solution
> already posted.

But a radix sort needs buckets proportional to the _range_ of integers
involved, or else will require multiple passes over the data, for
instance 100 buckets and input with a range of 1 million means 3
passes are required, and 3 sets of buckets.  In practice with 32 bit
(or even 64 bit) integers, there isn't going to be a great deal of
difference between hashing and radix sorting.  Generalising the
problem (say to spotting duplicated strings) will tend to favour
hashing. 

However if you want guaranteed performance, avoid the hash table
method because it's worst case becomes O(N^2)...

------------------------------------------------------
|\  /|          | ,  M. Tillotson       Harlequin Ltd. \
| \/ |  /\| |/\ |<   markt@uk.co.harlqn  Barrington Hall,\
|    |  \_| |   | \  +44 223 872522       Barrington,      \
I came, I saw, I core-dumped...            Cambridge CB2 5RG \