HDTenEightyP/NetNews huggingface dataset:
From: spaf@cs.purdue.edu (Gene Spafford)
Newsgroups: comp.virus
Subject: Re: Looking for references (UNIX)
Date: 10 Sep 92 02:53:11 GMT

See the postscript files on ftp.cs.purdue.edu in pub/spaf/security
In particular, see IWorm and IWorm2

Also, here's some info on Robert Morris that many people ask for:

Robert T. Morris, the author of the Internet Worm program, was
convicted of a Federal felony in the case.  The law involved was 18
USC 1030, the Computer Crime and Abuse Actof 1986.  He was found
guilty in February of 1990 in US District Court in Syracuse, NY.

In May of 1990, he was sentenced -- outside of Federal guidelines --
to 3 years of probation, 400 hours of community service, and $10,000
in fines plus probation costs.  His lawyers appealed the conviction 
to the Circuit Court of Appeals, and the conviction was upheld.  His
lawyers then appealed to the Supreme Court, but the Court declined to
hear the case -- leaving the conviction intact.
From: A.APPLEYARD@fs1.mt.umist.ac.uk
Newsgroups: comp.virus
Subject: Re: Tan an Door virus?!?! (PC)
Date: 10 Sep 92 08:26:25 GMT

The square in Beijing (formerly known as Peking) in China where the
massacre occured, is correctly called 'Tien An Men Square', because it
is by the 'Tien An Men' = "Heaven(ly) Peace Gate". (Do not confuse it
with the Indian cookery word 'tandoori'.) Your informant seems to have
part-translated the name. Is this virus the virus usually known as
'Beijing' or 'Bloody'?, which contains matter referring to that event.

> Date:    Tue, 08 Sep 92 11:08:48 -0400
> From:    Paul Bradshaw <ACDPAUL@vm.uoguelph.ca>
> Subject: Tan An Door virus?!?! (PC)

> The following recently appeared on our local virus conference here at the
> University of Guelph. I've never heard of the tan an door virus, or the 64
> virus as the gentleman refers to it and would like to hear from any of you
> who have.
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> Title: Tan An Door Virus
> Recently in China I cought the 64 VIRUS which apparently was related to the
> incident of June 4 atthe Square of Tan An Door in Peijiang (Bejing ?). I
> found there a "Kill" progr, and apparentlyI have cleaned my stuff off.
> However bere transferring material form my travelling kit to my computer in
> Guelph I would like to know if any of you know anything about this virus
> and if it could be lingering still somewhere: a. I was using a palmtop
> (Sharp 3100) with built in software: could the virus have entered such
> software ? ..
 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> I would like to help the poor guy out, but I haven't the faintest idea what
> this virus's commonly accepted name would be. Thanks all, Paul Bradshaw
> acdpaul@vm.uoguelph.ca
From: simion@iveuncc.unive.it (Marco Simionato)
Newsgroups: comp.virus
Subject: Re: I'm off [to Scotland]... Comp Virus Conferences
Date: 7 Sep 92 14:17:31 GMT


 Fridrik Skulason, writes:

        >[..] now I'm off for
        >the virus conference in Scotland.

Yes, maybe I'm too lazy or I do not remember very well, but there is a
list of the most important Computer Virus Scientific Conferences for
the next year [1993, off course] ?

Thanks

                Francesco Dalla Libera

- -- franz@iveuncc.unive.it    University of Venice (Italy)
   [ City Limit. Produce Speed. ]
From: Nemrod_Kedem@f0.n972.z9.virnet.bad.se (Nemrod Kedem)
Newsgroups: comp.virus
Subject: Re: New Files On Risc (pc)
Date: 5 Sep 92 04:18:17 GMT


 > The following files have been placed on risc.ua.edu (130.160.4.7) in the
 > directory /pub/ibm-antivirus for anonymous FTP:

 >                   fp-205.zip   - FProt v2.05
 >                   vsumx208.zip - Virus Summary Listing.

 > It is time for the once-in-a-blue-moon checking of files on
 > risc.ua.edu.  Please send email to jford@risc.ua.edu if any of these
 > files are out of date or just should not be there.  Thanks.

 > vshell10.zip

If it's what I think it is (VSHELL from Chief D.R.) ... It out of date for
over 18 months.

Lates version (VSHL202U.ZIP) is avaliable on McAfee's HomeBase BBS or
Freqable from it's support home (2:403/138@Fidonet or 9:972/0@VirNet)
under the magic name of VSHELL.

     Regards,
     Rudy.
From: 70451.3621@compuserve.com (Roger Thompson)
Newsgroups: comp.virus
Subject: Possible Virus Infection - info pls (PC)
Date: 4 Sep 92 16:23:18 GMT

>From:    ede890psft@vx24.cc.monash.edu.au
 
Hi Earle,
 
You really don't have enough information yet to determine whether or
not you have any new virus. I can think of any number of reasons why
your young mate's (I'm an Oz too) machine should play up the way it
is, ranging from slippery fingers to incompatible Dos's.
 
Your best shot at this stage is to use a more up-to-date scanner to
look at it. If you are determined to resolve the problem, you should
also use a checksummer to see if any executables are changing.
 
Just monitor the situation and see if you get any more activity.
 
Roger Thompson
Leprechaun Software.
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: VACSINA Information Wanted (PC)
Date: 11 Sep 92 01:01:23 GMT

Remembering that a well known story teller, :-), gave me this advice:
> Rule 0. Read before arguing. :-)

I believe I have read, so here goes...

Vesselin Bontchev, <bontchev@fbihh.informatik.uni-hamburg.de>, wrote:
> AMN@vms.brighton.ac.uk (Anthony Naggs) writes:
>
> > > Is it important that one utility recognised CHKDSK while the other did
>     not?
>
> > Yes, 'EXE' files modified in this way may be corrupted and either fail to
                                          ***

Reading test; do you see the word 'may' in my previous answer?  In the
particular incident discussed there is no problem, as CHKDSK functions
normally in this state.  However I was answering the question of
whether scanners should detect such files.

> > work or work incorrectly.  This includes a number of programs that
> > use overlays or include configuration information in the executable file.
>
> True in general, but this particular virus (Vacsina.05) does not
> infect files with internal overlays or trailing configuration info.
> So, in this particular case there is no danger.

No.  No.  No.  Even with the care that Vacsina takes there can still be
problems.  For instance programs, as discussed here recently, that check
themselves will notice such a change and refuse to run.  If the detection
utility misses this file in the list of those affected, then the user will
suspect that s/he is also suffering from a new virus.  This is likely to
cause some anxiety!

I hope this is clear, and I shall save my ration for other topics.

Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: duck@nuustak.csir.co.za (Paul Ducklin)
Newsgroups: comp.virus
Subject: Re: F-PROT reports Bugsres 3 Jokes program? (PC)
Date: 7 Sep 92 19:32:05 GMT

Thus spake dana%are.Berkeley.EDU@ucbvax.Berkeley.EDU (Dana E. Keil):
>I just obtained F-PROT. Running a scan with it reports that a file
>named bugres.com is infected with a virus named "bugsres 3 jokes
>program". I can find no mention of this virus anywhere in F-PROT
>documentation (nor elsewhere). Can anyone enlighten me about it?

The bugsres program I've seen is a non-viral TSR which waits for
a hotkey and then starts up a bunch of text-mode "insects" which
run around, chomping up the screen. A "joke", and not a virus.
Of course, the problem with "jokes" is that jokers tend to
encapsulate them in replicative engines and to let them go...

Why keep software around if you don't know its function, anyway?
Seems to be a waste of disc space to me - and a recipe for disaster. 

- -- 

- --<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--
Paul Ducklin                                           duck@nuustak.csir.co.za

    CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: Virus Armour
Date: 4 Sep 92 00:16:47 GMT

Suresh Thennarangam, <suresh@papaya.iss.nus.sg>, raises some questions:
> In the Jan 1992 issue of Virus Bulletin,column Virus Anlysis,
> James Beckett writes:
>
> <> Designers realized some time ago that the efficiency of micro-processors
> <> can be increased by using the spare bus time to pre-fetch the next few
> <> bytes of instructions. This has the curious corollary that if the
> <> memory is modified a very short distance in front of the current
> <> instruction, the processor never sees the change, as it has already
> <> read the relevant bytes ........
>
> While this seems somewhat plausible I wonder if Intel's chip designers
> didn't make the 80x86 processors smart enough to detect memory changes
> in the vicinity of the current instruction and reload the pre-fetch
> queue in response.

No they don't.  This would make the processor much more complicated, as it
would have to monitor and understand all DMA accesses (including DRAM refresh
cycles, disk data transfers, ..).  And you are asking it throw away
instructions that are already partly executed, and restart them from
their original start conditions.

Cache memory, on the other hand, uses techniques such as "bus snooping" to
ensure that the cache contents are not used if they vary from the real
memory.  It should be noted that the more recent CPUs of most families use
pipelining, (starting to execute several instructions before earlier ones are
complete), to help give their increase in speed.

> Well, if not then this is a hazard for programs that modify themselves
> during runtime.

For most purposes, self modifying programs went out of fashion with the
Commodore PET, around 1979.  (The PET did indeed use a considerable quantity
of self modifying code, too get the maximum speed of operation).

The only use I have made of self-modifying code was for a magazine article in
1989, to identify through software the different members of the 80x86 family.
This indeed relied in the effect of the CPU pre-fetch in one of its tests.

Yours, Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: re: 62 seconds (was: F-Prot & SuperStor) (PC)
Date: 4 Sep 92 15:53:39 GMT

>From:    Andrew_Clark.sdb-e@rx.xerox.com
>
>Second: IBM PC question.
>Can anyone advise me whether there is a virus that modifies the
>seconds field in a files time value to 62.
>If there is then how do I remove it? what does it do etc.

There are quite a few viruses that do this; how to remove it
and what it does depends on which one you have.  Get ahold of
a good scanner and see what it says...

DC
From: HAYES@urvax.urich.edu
Newsgroups: comp.virus
Subject: Padgett Peterson's DISKSECURE upadate (PC)
Date: 3 Sep 92 17:14:15 GMT

Hi.

Just received directly from Padgett Peterson an update for his
DISKSECURE program.  The archive (.ZIP) name is DS115.ZIP, and will be
available for FTPO processing.

Site:       urvax.urich.edu,  [141.166.36.6]    (VAX/VMS using Multinet)
Directory:  [anonymous.msdos.antivirus]

FTP to urvax.urich.edu with username anonymous and your email address
as password.  You are in the [anonymous] directory when you connect.
cd msdos.antivirus, and remember to use binary mode for the zip files.

Best, Claude.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Claude Bersano-Hayes     HAYES @ URVAX                 (Vanilla BITNET)
University of Richmond   hayes@urvax.urich.edu     (Bitnet or Internet)
Richmond, VA  23173
From: a_rubin%dsg4.dse.beckman.com (Arthur Rubin)
Newsgroups: comp.virus
Subject: Re: Bugs on my Atari (Atari)
Date: 3 Sep 92 20:51:20 GMT

cmontoya%carina.unm.edu@lynx.unm.edu (Red Dragon) writes:

>I know I'm the not the only person with an old Atari.  I just had a
>bunch of bugs appear on my screen and eat up the screen and trash my
>disk.  Help please.  I was just going to help a friend with an Amiga
>virus and this happens!  BTW, can PC viruses infect my Atari?  I was
>using a DOS disk when this happened.

PC viruses cannot infect a non-IBM-architecture machine unless it is
running a PC simulator/emulator.  That program, in addition, sounds
like a joke program I've heard of.  Are you SURE your disk is damaged?
- --
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; please mail anything important.
From: masjol@dou.dk (J|rgen Olsen)
Newsgroups: comp.virus
Subject: F-PROT 2.05 - minor problem detected. (PC)
Date: 10 Sep 92 10:50:58 GMT

Having brought home my personal copy of version 2.05 (collected from
Fredric i Edinburgh, I used the SAVE feature after doing a scan with
the heuristics option (lots of 'semi-false' positives but correctly
identified as being so).

The result : Funny things happened - system hang (5) - funny
Characters on screen (1) - garbled report (misc.characters replaced
with others) (2).  The above numbers refers to 8 test on 3 machines.

I seems that saving of larger files results in 
    a) no save - with or without hang.
    b) no save - with an entry of length ZERO (0).

By the was if yopu only write a program name when prompted the file
(if it is a small one) will be placed in the root of the last logical
disk on your system.

In these days with a lot of cheap RAM around this will often be a
RAMDISK on many (non-networked) machines. Maybe an other saving
strategy should be considered!

The whole thing is a minor nuissance - when you know of it! But
distributing version 2.05 to 1600 users might give us a feedback we
should like to be without.

As no one has reported the problem - few people seems to use the SAVE
feature!

J Olsen
DOU, Odense DK
From: JFORD@seebeck.ua.edu
Newsgroups: comp.virus
Subject: Re: New files on eugene and beach (PC)
Date: 10 Sep 92 13:55:06 GMT

>From:    John Perry <perry@andre.utmb.edu>
>
>Hello Everyone!
>
>Better late than never I always say! I've finally had a chance to sit
>down and update the anti-viral archives on eugene and beach. Please
>make note of the following additions. If there is a problem or
>question, please feel free to contact me at perry@eugene.utmb.edu.
>
>eugene.utmb.edu
>vsig9207.zip

vsig9208.zip is on risc.ua.edu and oak.oakland.edu.
- ----------
James Ford - Consultant II, Seebeck Computer Center
             jford@seebeck.ua.edu, jford@risc.ua.edu
             The University of Alabama (in Tuscaloosa, Alabama)
From: chanm@server.uwindsor.ca (CHAN HENRY )
Newsgroups: comp.virus
Subject: New virus that scanv95b cannot pick it up!!!(HELP) (PC)
Date: 6 Sep 92 14:18:19 GMT

I just found out that my computer is attacked by a new virus(may be).
The signatures of that virus is always attack the "format.com" file.
When I viewed the file, the file contain "-stack!--stack!--stack!--"
string.  And this string has about 10 or more "-stack!-" in it.

In my friends' cases, it attacked the borlandc directory(Borland C++
3.0).  The directory /borlandc/opernach (spelling?) has lots of junks,
also with the word "-stack!-" and cannot be deleted.  Also the virus
rewrite the file "config.sys" with a long string of repeated
"-stack!-".

It seems that the virus will trigger by different kind of software and do 
different things.

Does anyone has any clue about this?

If anyone has any information about this virus (how to delete the virus etc.)
Please email me as soon as possible.

Thanks for helping!!

Henry Chan
=============================================================================
e-mail:chanm@server.uwindsor.ca
hchan@engn.uwindsor.ca

VLSI Research Group
U. of Windsor
=============================================================================
From: BURGER@dmrhrz11.bitnet (Christian Burger)
Newsgroups: comp.virus
Subject: Re: self-checking programs
Date: 10 Sep 92 06:54:38 GMT

In response to the posting of D. Beauregard on self-checking programs
and to several comments thereon:

You should have a look at the ``Stealth Bomber'' package by Kevin
Dean.  It implements a crc self-check plus additional anti-virus
features for borland turbo c or pascal programs. The package uses a
very sophisticated way to circumvent the problem that the crc itself
is part of the stream to calculate the crc from, patching the
executable after compilation. This package will probably not protect
against all stealth viruses but it will certainly provide a good
protection against the most common viruses. The stealth bomber package
is freely available via anonymous ftp from any simtel archive mirror
as /msdos/trojan-pro/stealth.zip.  I would be interested in comments
of the virus gurus on this package.

Christian Burger, burger@dmrhrz11.bitnet
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: Netware and viruses - some new results (PC)
Date: 9 Sep 92 23:17:49 GMT

Felix Lafontaine, <Felix.Lafontaine@f23.n367.z1.FIDONET.ORG>, comments:
> JJ> From: JFORD@seebeck.ua.edu
> JJ> Newsgroups: comp.virus
> JJ> >At QUT, we have set up an experimental network to test viruses
> JJ> >networked environments, and the first results have just come
> JJ> >Test 1: Exhaustive test of netware preotection setting on
> JJ> files and
> JJ> >directories against common viruses.
>   Thats sound well, but most of the commons virus have an
> erradicated status, so what about new viruses, like MTE bases
> viruses.

Felix, are you a French speaking citizen?  I don't wish to be rude
about your English, so I shall just recommend that you compare
'common' and 'eradicated' in your dictionary.

On MTE:
    MTE is not a base but rather a wrapper.  It is used to make detection
    with scanning software more difficult.  It does not provide any 'magic'
    new functions for viruses.

Regards, Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: Comp Virus Conferences ... THE BEST CONFERENCE THIS YEAR!
Date: 10 Sep 92 02:32:29 GMT

Francesco Dalla Libera, <franz@iveuncc.unive.it>, asked:
> Yes, maybe I'm too lazy or I do not remember very well, but there is a
> list of the most important Computer Virus Scientific Conferences for
> the next year [1993, off course] ?

A couple I know of next year:

6th International Computer Virus & Security Conference
    March 11th-12th 1993, New York City, NY USA
    Dick Lefkon posted a call for papers here a little while back.

3rd Virus Bulletin Conference
    probably in September again

However the best one to attend, -subtle hint-, this year is still to come:

The 3rd annual EICAR Conference
    (EICAR - European Institute for Computer Anti-Virus Research)
    December 7th-9th, Munich Germany

    Quick outline:
    Monday 7th is an introductory day.
    Tuesday 8th has an opening talk, and splits into technical and
                management tracks.
    Wednesday 9th continues with technical and management tracks,
                which join in the afternoon for a panel discussion.
    Tuesday and Wednesday will have papers in English and German with
                translation provided.

    If you have not sent your draft papers to Christoph, the deadline is
    Friday September 11!  Final arrangements and full details of the
    programme will be posted here soon.

    Email for info to:  Christoph Fischer ry15@rz.uni-karlsruhe.de
                or (UK) Anthony Naggs     amn@vms.brighton.ac.uk

Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: Tan An Door virus?!?! (PC)
Date: 10 Sep 92 02:32:33 GMT

Paul Bradshaw, <ACDPAUL@vm.uoguelph.ca>, asked for information about a virus
described in his local virus conference:
> Title: Tan An Door Virus
>
> Recently in China I cought the
> 64 VIRUS
> which apparently was related to the incident of June 4 atthe Square of
> Tan An Door in Peijiang (Bejing ?).

64 => June 4
This is presumably the massacre of students in Tiannamen Square (sorry not
sure about the spelling), in Bejing/Peking.
There is a boot virus, loosely based on Stoned, which includes the message
"Bloody! Jun.4, 1989".  The usual names I have seen are "Bloody" and "June 4".

> I found there a "Kill" progr, and apparentlyI have cleaned my stuff off.
> However bere transferring material form my travelling kit to my computer
> in Guelph I would like to know if any of you know anything about this
> virus and if it could be lingering still somewhere:
> a. I was using a palmtop (Sharp 3100) with built in software: could the
> virus have entered such software ?
> ..

As a boot sector virus it is unlikely to have been transferred to a palmtop,
unless user has disk image files (eg using Teledisk).  I would expect all
a-v software to detect "Bloody"/"June 4", as F-PROT is one of the more
comprehensive scanners you could use it for reassurance.

Hope this helps,
Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Bug in F-PROT? (PC)
Date: 7 Sep 92 19:57:41 GMT

Kevin_Haney@nihcr31.bitnet writes:

> I was using F-PROT 2.04c from a bootable DOS 5.0 diskette.  After
> booting from the A: drive, I wanted to scan another diskette in the A:
> drive.  F-PROT produced unintelligible messages, such as "cotaaly
> tanmcyng, ico staro%Nnurta...".  Another user here reported the same
> phenomenon.  Does anyone have an explanation and/or fix for this
> problem?

Quoted from one of the documentation files (PROBLEM.DOC):

"F-PROT cannot be used on a single-floppy machine without a hard disk
or network connections. This is because if the F-PROT is run from a
diskette, the diskette may not be removed while the program is
running, so other diskettes cannot be inserted for scanning."

If your machine has a hard disk, then scan it first (to ensure that it
is virus-free). Afterwards, copy the F-Prot files there and start
F-Prot from there. You'll be able to scan diskettes without problems.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany