HDTenEightyP/NetNews huggingface dataset:
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: re: Virus Armour (PC)
Date: 4 Sep 92 15:56:09 GMT

>From: suresh@papaya.iss.nus.sg (Suresh Thennarangam - Research Scholar)

>While this seems somewhat plausible I wonder if Intel's chip designers
>didn't make the 80x86 processors smart enough to detect memory changes
>in the vicinity of the current instruction and reload the pre-fetch
>queue in response.

They didn't.

>Well, if not then this is a hazard for programs that modify themselves
>during runtime.

Yep, it is!  Don't do that...   *8)

DC
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Anyone for a Feist ??? (PC)
Date: 7 Sep 92 19:15:44 GMT

ISB202REID@redgum.qut.edu.au (Did somebody say Coffee ??????) writes:

> The virus I found wasn't the feist virus.  I viewed the file using a
> simple file viewer and found the string "No Frills 2.0" towards the
> end.

Ah, so it's the No_Frills virus.

> F-prot 2.05 does NOT have this virus in its database however the
> heuristic scan does say that is almost certainly a virus.

Indeed, F-Prot doesn't know about it. However, now Frisk has a copy of
it, so let's hope that it will be included in the next version. The
virus seems to be in the wild, but is still local to Australia.

> Clean 95 incorrectly identifies it as Feist.

Since version 91 the words "Clean" and "identifies" should not be used
together... :-)

> No Frills is not in Scan 95 virlist.txt either.

The contents of VIRLIST.TXT has nothing to do with what SCAN 95
actually outputs as virus names. The virus properties listed in that
file also are not entirely correct...

> Question: What does No Frills do and can it be removed.

It doesn't do anything remarkable. A memory resident COM & EXE fast
file infector. Avoids infecting files like SC*.E* and CO*.C*.
Infective length is 843 bytes. No payload (at least I didn't notice
one). The easiest way to remove it is to delete the infected files.

If there is a need for a more detailed description, I'll post one.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: F-Prot & SuperStor (PC)
Date: 4 Sep 92 00:13:08 GMT

Andy Clark, <Andrew_Clark.sdb-e@rx.xerox.com>, asks:
> Has anyone used F-Prot's F-Driver.SYS with SuperStor from DR-DOS6.
>
> I tried to install this but got the message INT 13h modified....
>
> I am sure that I do not have a virus, and am assuming the INT 13h is
> used for disk access (which superstor would need to modify to redirect
> disk accesses to itself)

I am not familiar with SuperStor, but i would indeed expect it to
modify Int 13h.  So you should make sure that SuperStor does this
before F-Prot is loaded.  I would expect SuperStor to be a device
driver, in which case you would just move the line, in CONFIG.SYS,
"device=f-driver.sys" below the line loading the SuperStor software.

> Second: IBM PC question.
> Can anyone advise me whether there is a virus that modifies the
> seconds field in a files time value to 62. I seem to recall that there
> is a virus which does this.

There are several viruses that do this, and some virus protection
software may even do this to all your files so that such viruses think
that they are already infected.

> If there is then how do I remove it? what does it do etc.

Try running F-PROT, this should recognise most viruses that do this.

I hope this is of assistance,
Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: gscobie@castle.edinburgh.ac.uk (G J Scobie)
Newsgroups: comp.virus
Subject: Netware Rights again (PC)
Date: 10 Sep 92 09:14:18 GMT

I have been reading with interest the discussions concerning Netware
Rights and thought I would throw my own observations into the ring :-)

Certainly on page 227 on the Concepts manual for netware 3.11 it states:

"Attribute security overrides rights granted with trustee assignments
and can prevent tasks that effective rights would allow".

So what does this mean in reality? Let us suppose I have all rights in a
directory and to the files contained there. If I flag a file as
read-only, netware 3.11 automatically adds the delete-inhibit and the
rename-inhibit attribute to this file. Now although I have the erase
permission any attempt to delete this file will give me an access denied
message. 

Now futher down page 227 of the concepts manual it states that:

"If users have the Modify right for the directory or the file, they can
change the attributes and complete any task allowed with their effective
rights."

Fair enough. I have the modify right, so what happens if I just remove
the delete-inhibit attribute? Although the file is still flagged as
read-only, I have erase permission so I can delete it. 

This is explained again on pages 230-231. This situation holds for
supervisors as well. By default the system files are installed with the
delete-inhibit attribute set, in order to prevent supervisors from
accidentally deleting files. 

So where does this leave us? Certainly attribute security in this
instance, overrides rights granted with trustee assignments, and is
explained quite clearly in the manuals. Perhaps confusion has arisen
regarding the read-only attribute in netware and that under DOS. 

As for viruses, I feel that we should all assume that if a user has
certain rights then a virus will have those rights as well. Infection of
files on a server is an issue notably in users home directories, and
anyother area that they have more than read/filescan permission.
Supervisors - if they are at all worried - should cold-boot from a known
clean source before commencing work with supervisor status. 

It worries me that perhaps too much has been made of the "default
configuration" of netware servers. I can't think of any system which
comes pre-set for maximum security. It is not a specifically novell
problem. 

To conclude, I work on the basis that the security as far as viruses are
concerned are only as good as the rights users have to their areas of
the servers disks. If a virus can infect my applications volume where
everyone has only read and filescan permission set as a trustee
assignment then I would appreciate being told about it as soon as
possible.

Thanks for all the great work on this board. Its appreciated more than I
can say.

Cheers 

Garry Scobie
Senior Computing Officer
EUCS
Edinburgh University
From: Felix.Lafontaine@f23.n367.z1.FIDONET.ORG (Felix Lafontaine)
Newsgroups: comp.virus
Subject: is there a SCAN95? (PC)
Date: 30 Aug 92 13:26:00 GMT

HH> From: HAYES@urvax.urich.edu
HH> On a local BBS, a file called SCAN95.ZIP was uploaded, with the
HH> it was fetched from McAfee Associates BBS - as well as some
HH> files.  The upload was reported to me by the SYSOP of the
HH> What are these files (beside SCAN their names escape me)?
HH> versions?  Up- dates?
HH> the net,

 At this moment the latest McAFee software are version 95B or C,
depends if it clean or scan. Not remember know but you can check
with them at 1-408-988-4004 (BBS)

- --  
Internet: Felix.Lafontaine@f23.n367.z1.FIDONET.ORG
UUCP: ...!myrddin!tct!psycho!367!23!Felix.Lafontaine
Note:psycho is a free gateway between Usenet & Fidonet. For info write to
     root@psycho.fidonet.org.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: A new virus????? HELP! (PC)
Date: 11 Sep 92 08:34:04 GMT

scholl@gaul.csd.uwo.ca (Cam Scholl) writes:

> Anyways, here's what is happening.  Every once in a while, my system
> will try to access a file, only to find out that somehow, it has been
> damaged!  This has happened to Windows 3.1 program manager groups,

Could be done by a virus, of course, but it doesn't sound like a virus
problem to me... Most people seem to think that destruction of
information is the most indicative symptom of a virus infected. In
fact, the most important property of the viruses is their ability to
spread. Only some of them intentionally cause a noticeable corruption
of data. Remember, the main goal of the virus is to spread. And, if it
destroys data in a noticeable way, you are likely to notice it and to
remove it, therefore it will not be able to spread further...

> Shortly thereafter, I ran into the same problem...  After much
> investigation, I have found that the virus seems to only attack files
> with their archive bit set, meaning they've been changed since the

This is quite indicative. Most viruses are clever enough not to modify
any file attributes. What you are actually observing should be
interpreted in the opposite way - not that something is modifying your
files with archive bit set, but that something is modifying your
files in a standard way (via the documented MS-DOS functions), which
sets the archive bit.

My guess is that you don't have a virus. Probably some kind of faulty
application.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on request. **   Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Self-checking programs (PC et al)
Date: 8 Sep 92 18:53:44 GMT

<beaurega@ireq.hydro.qc.ca>, writes:

> I would like to write a program that will check if it is per se
> holder of a virus.  The method I have in view :
>
> Compile the program.
> Compute the checksum of the program.
> Put the checksum in the program.
> When starting the program : Stop the program if the checksum has been altered.

While this is one good layer for checking, as a stand-alone it leaves
much to be desired since it relies on being able to trust itself. The
problem is that if yours is the only program doing sel-checking then a
virus could spread quite far before your program picks it up.

Another problem is that certain classes of viruses will either not
bother you program or will use different methods that will have your
algorithm work when you compute it. Spawning, Companion, & Path
viruses are all examples that will defeat a self-checking program that
does nothing else.

Also you have the situation of every copy of your program using the
same mechanism - all a virus has to do is to know what to change your
checksum to.

For this reason and for efficiency, I prefer a single TSR for this
purpose with a unique seedfor each machine (so that each PC has a
unique checksum for any particular application).

Of course, to protect against a directed attack, the TSR needs
extensive protection but IMHO this is more efficient approach. I am
glad to see that a significant number of AV vendors are using it.

					Warmly,
						Padgett

BTW, some years ago I found that it was possible to generate/validate
an algorithmic checksum at about 50k bytes/second on a 4.77 Mhz PCXT.
This includes disk access time since I did not trust what was in
memory.  A very powerful and fast mechanism would checksum 100% with
two different methods and validate the length of the file as well.
From: RZOTTO@NYX.UNI-KONSTANZ.DE (Otto Stolz)
Newsgroups: comp.virus
Subject: Re: F-PROT reports Bugsres 3 Jokes program? (PC)
Date: 8 Sep 92 15:57:11 GMT

On 03 Sep 92 02:34:40 +0000 Dana E. Keil
 <dana%are.Berkeley.EDU@ucbvax.Berkeley.EDU> said:
> F-PROT [...] reports that a file
> named bugres.com is infected with a virus named "bugsres 3 jokes
> program". I can find no mention of this virus anywhere in F-PROT
> documentation (nor elsewhere).

This is not a virus, but a jokes program (trojan). Sub-menu "Targets:"
in Menu "Scan" clearly says so; if you do not want to scan for trojans
and joke programs, move the cursor under the pertinent entry in the
submenu, and press the space bar. Cf. file SCAN.DOC which comes with
F-PROT.

Best wishes,
                    Otto Stolz <RZOTTO@DKNKURZ1.Bitnet>
                               <RZOTTO@nyx.uni-konstanz.de>
From: rslade@sfu.ca
Newsgroups: comp.virus
Subject: (c) Brain - part 4 (CVP)
Date: 3 Sep 92 23:17:01 GMT



HISVIR9.CVP   920810
 
                        (c) Brain - part 4
 
Technically, the Brain family, although old, has a number of
interesting points.
 
Brain itself is the first known MS-DOS virus, aside from those
written by Fred Cohen for his thesis.  In opposition to his, Brain
is a boot sector infector.  One wonders, given the fact that the two
earliest viral programs (for the Apple II family) were "system"
viri, whether there was not some influence from these earlier, and
similar, programs.
 
Brain is the first example of "stealth" technology.  Not, perhaps,
as fully armoured as other, later, programs, but impressive
nonetheless.  The intercepting and redirection of the system
interrupts had to be limited in order for the virus to determine,
itself, whether or not a target was infected.
 
The Den Zuk and Ohio variants use the trapping technology which can
be used to have a virus survive a warm boot.  Although they do not
survive, the fact that the <Ctrl><Alt><Del> key sequence is trapped,
and that another piece of programming (in this case, the onscreen
display) is substituted for the reboot code proves the point.  The
virus could be made to survive and to "fake" a reboot.  (The
recovery of the system would likely require a lot of programming and
code.  This has been pointed out before, and the "recovery mode" of
Windows 3.1 probably proves it.)
 
Den Zuk and Ohio are also "virus hunting viri".  This possibility
has long been discussed, and these examples prove it can be done. 
They also indicate that it is not a good idea: Den Zuk and Ohio are
far more dangerous than Brain ever was.
 
The Solomon and Skulason analyses are fascinating for tracking the
trail of a virus "mutation" through the same, and different,
authors.  The evolution of programming sophistication, the
hesitation to alter the length of text strings, even while they are
being replaced, and the retention and addition of bugs form an
engrossing pattern to follow.
 
copyright Robert M. Slade, 1992   HISVIR9.CVP   920810

==============
Vancouver      ROBERTS@decus.ca         | "My son, beware ... of the
Institute for  Robert_Slade@sfu.ca      |  making of books there is
Research into  rslade@cue.bc.ca         |  no end, and much study is
User           p1@CyberStore.ca         |  a weariness of the flesh."
Security       Canada V7K 2G6           |          Ecclesiastes 12:12
From: JFORD@UA1VM.UA.EDU (James Ford)
Newsgroups: comp.virus
Subject: New files on risc (PC)
Date: 5 Sep 92 22:02:05 GMT

Thanks to user response, I have been able to place the following files
on risc.ua.edu (130.160.4.7) in the directory /pub/ibm-antivirus:

               virx24.zip - VirX v2.4
              vds210t.zip - Virus Detection System v2.10
             vsig9208.zip - Virus signatures, Aug 1992
- ----------
Left to themselves, things tend to go from bad to worse.
- ----------
James Ford -  Consultant II, Seebeck Computer Center
              The University of Alabama (in Tuscaloosa, Alabama)
              jford@ua1vm.ua.edu, jford@seebeck.ua.edu
              Work (205)348-3968  fax (205)348-3993
From: Jonny_Bergdahl@f1.n9.z9.virnet.bad.se (Jonny Bergdahl)
Newsgroups: comp.virus
Subject: Re: Network Virus protection. Help. (PC)
Date: 2 Sep 92 22:18:00 GMT


 > that we should consider.  Are there any virus protection packages that
 > are NLM's and are they reasonably priced?  Based on discussions on

McAfee has recently released NetShield, a NLM version of SCAN. It is
very reasonably priced as well, and finds more virus than Intels NLM.
But note that it will not protect against locally infected
bootsectors, since the server would never know that an infection has
occured, so another protection level will have to be installed for
better security.

Jonny Bergdahl, NewAge productions, Sweden
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Auto-detecting Virus (PC)
Date: 11 Sep 92 08:42:52 GMT

Alexander_Ofek@p8.f101.n9721.z9.virnet.bad.se (Alexander Ofek) writes:

> Your approach will fail to detect a stealth virus like 1963 or dir2.
> To be on the safe side you will have to read the directory using absolute rea
d
> (int 13h) and follow the FAT chains yourself.

Which will fail to detect advance stealth viruses like Int13, which
are stealthy at sector access level. Using INT 13h to read the file
will not detect Dir_II either, since this virus subverts the block
device driver requests...

> Of course it might be useful to 
> check whether the interrupt vectot of int 13h still points to the BIOS area.

Unfortunately, since DOS 3.20 the interrupt vector for INT 13h never
points to the BIOS area (except at boot time), since DOS intercepts it
itself...

There are other possible anti-stealth techniques that could be used,
like scanning the ROM space for the hard disk controller program and
calling it directly, but neither of these tricks is reliable and/or
compatible with all kinds of systems... Just as an example, consider a
disk, compressed with Stacker... How are you going to access the files
on it "at a low level"?

The -only- secure technique against the stealth viruses is to use the
"magic object" - to cold boot from a write-protected non-infected
system diskette. Unfortunately, this method of operation is considered
too inconvenient by most users. Furthermore, it can be used only for
off-line integrity checkers, and what the original poster proposed was
an integrity module, contained in the executable file. In this case,
there's no way to stop the stealth viruses from fooling the integrity
module.

> Use any CRC check with an UNUSUAL (i.e. rarely used) polinomial. 

More exactly, use a CRC with a -different- polynomial on each
particular installation (be it a computer or a program).

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on request. **   Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: dcleek@csd4.csd.uwm.edu (Dick Cleek)
Newsgroups: comp.virus
Subject: Re: Bug in F-PROT? (PC)
Date: 3 Sep 92 15:33:32 GMT

fprot 2.05 thinks a  couple of menu.com files are infected with CREW.
However, that happens only w/Quickscan, not  w/ Secure or Heuristics and
2.04 finds no problem. Unfortunately, Virstop also detects CREW and halts.

I've notified Frisk, but unfortunately he's off on vacation.
- -- 
.........   .........................         .......................
: |_|\/\/ :   Dick Cleek                        dcleek@csd4.csd.uwm.edu
:.centers.:   Univ.of Wisconsin Centers         dcleek@uwcmail.uwc.edu
From: mha@baka.ithaca.ny.us (Mark Anbinder)
Newsgroups: comp.virus
Subject: MBDF Authors Plead (Mac)
Date: 5 Sep 92 22:26:49 GMT

Three former Cornell students, who had been facing a total of forty
computer tampering and related charges in connection with the creation
and release of the MBDF virus affecting Macintosh computers this
February, struck a plea-bargain agreement here in Ithaca yesterday.

David Blumenthal and Mark Pilgrim, each of whom had been facing felony
first degree computer tampering charges, pleaded guilty to one count
each of second degree computer tampering, a misdemeanor.  Randall
Swanson pleaded guilty to a reduced charge of disorderly conduct.
Swanson was not originally implicated in the case when the virus was
traced to Blumenthal and Pilgrim, but was charged this summer.

None of the three are currently enrolled for the fall semester at
Cornell University.  While the University is prohibited by federal law
from revealing the outcome of disciplinary action against students,
unofficial word has it that some of the students have been expelled
from the University, and the other(s) suspended for at least one year.
A 27 August memorandum from William Streett, the Dean of Cornell's
College of Engineering, referred to an unnamed group of students who
had been charged with violating Cornell's Code of Academic Integrity
"as a result of improper and unauthorized use of computers and network
systems."  Streett said that the punishments in these cases "include
expulsion and suspension for a year or more."  The memo went on to
remind students of their responsibility in maintaining academic
integrity standards in their computer use, and suggested that students
with special talents in computing and network systems "put these to
constructive use by tutoring other students or through volunteer work
with one of the local social service agencies."

- --
Mark H. Anbinder                      mha@baka.ithaca.ny.us
BAKA Computers, Inc.                  QuickMail QM-QM 607-257-2614
200 Pleasant Grove Road               Phax  607-257-2657
Ithaca, NY 14850                      Phone 607-257-2070

Q: How many tech support people does it take to change a light bulb?

A: We have an exact copy of the light bulb here and it seems to be
   working fine.  Can you tell me what kind of system you have?  Okay,
   just exactly how dark is it?  Okay.  There could be four or five
   things wrong.  Have you tried the light switch?
From: gary@sci34hub.sci.com (Gary Heston)
Newsgroups: comp.virus
Subject: Re: On daily scanning (general)
Date: 8 Sep 92 20:13:06 GMT

rslade@sfu.ca writes:

>Scanning has been denigrated not only for its inability to deal with "new"
>viral programs, but also due to time consumption.  David Stang, in his
>seminars, stresses that a five minute scan every day adds up to a full
>20 hours, half a working week, over the course of a year.

I'll be glad to invest 20 hours/year in prevention as opposed to 20
hours of my time + the cost of 60 co-workers idled (or a manufacturing
line producing $500K/shift shut down) cleaning up after a hit.

>However, in doing some work on a fairly average machine this week (386/25,
>80 meg HD with 75 meg of files, 350 executable out of 2400 files), I noted
>that Thunderbyte Scan took only 22 seconds to scan the entire thing.  (I
>didn't time any of the others, but none of them took five minutes.)

I scan a total of about 2GB (about 12K files, I think) every workday
morning, using a 386/25; the files are distributed between five
NetWare servers w/SCSI drives running 3.11 and one running 2.15 w/ESDI
drives, all connected via thin Ethernet. This scan takes about 28
minutes using F-Prot 2.04a.

I think it's the best half hour of the day, when it comes up and says,
"Infected: 0". Besides, I've got two other workstations in my cubicle
that I can use while the scan is running.

- -- 
Gary Heston    SCI Systems, Inc.  gary@sci34hub.sci.com   site admin
The Chairman of the Board and the CFO speak for SCI. I'm neither.
    The most dangerous person in the world is Jessica Fletcher.
        Everywhere she goes, people die.