HDTenEightyP/NetNews huggingface dataset:
From: hamill@csn.org (James R. Hamill)
Newsgroups: comp.virus
Subject: Is FTP/Kermit of sources safe?
Date: 8 Sep 92 07:27:47 GMT

I recently had a discussion with someone I am contracting my services
to...  I uploaded a piece of code to our HP-UX workstation that I
retrieved from a generous Usenet/Netnews writer.  It was all ascii
source code that I had to build into my program.  This _seems_ safe to
me.  (BTW I used kermit to upload the files to my system via a modem).

The person I talked to has heard horror stories of PC viruses damaging
file systems and one that was shipped to customers accidentally as
part of a product.  This person is NOT a programmer (he's a
salesman/manager).

I have also downloaded software from the MIT export system for
X-Windows sources using FTP and kermit to bring those files to my
otherwise isolated workstation.

Are there any words of comfort that I can give this person that is
worried that the workstation might contain software that is corrupt?

While looking into virus protection software I noticed that there are
some sites where I can FTP software from...which seems rather ironic
in light of the question I am asking :-)

Post a response or send e-mail, it doesn't matter to me.  

P.S. If there is a FAQ that answers my question, please point me in
the right direction....

[Moderator's note: While the FAQ does not directly answer this
question, it is available either by e-mail or by anonymous FTP.  You
can FTP it from cert.org:pub/virus-l/FAQ.virus-l or you can request it
by e-mail - simply send mail to Listserv@Lehigh.edu containing the
text "info virus-l".  Yes, a new version of the FAQ is in the works...]

Randy Hamill
Standout Consulting, Inc.
From: glauber@ele.puc-rio.br (Glauber Maciel Santos)
Newsgroups: comp.virus
Subject: Re: Bug in F-PROT? (PC)
Date: 5 Sep 92 00:51:38 GMT

>I was using F-PROT 2.04c from a bootable DOS 5.0 diskette.  After
>booting from the A: drive, I wanted to scan another diskette in the A:
>drive.  F-PROT produced unintelligible messages, such as "cotaaly
>tanmcyng, ico staro%Nnurta...".  Another user here reported the same
>phenomenon.  Does anyone have an explanation and/or fix for this
>problem?

	I remember having read a file in the FP-205.ZIP packet which
explains that the author hasn't corrected this problem yet and doesn't
intend to do so in the near future.  I guess I'm not mistaken, but I
don't have this file with me at present in order to confirm this.

	If you run F-PROT from drive a: you can't scan diskettes in
the same drive because F-PROT needs to access itself.

	Despite this, I consider F-PROT to be the best antivirus
program ever written.  The rate at which its updates appear is
amazing!  I always upload its newest version to several Brazilian BBSs
and it seems to be taking the place McAfee's programs held here..
Congratulations to Frisk!

	Glauber M. Santos
	Dept. of Electrical Engineering
	PUC/RJ - Brazil
From: KDC@ccm.UManitoba.CA (Ken De Cruyenaere 204-474-8340)
Newsgroups: comp.virus
Subject: Problems with F-PROT (V2.05) (PC)
Date: 9 Sep 92 21:17:51 GMT

As a satisfied user of F-PROT I have to comment on a
couple of problems I have with the latest version.
 1) It no longer has the  "SCANNING MEMORY FOR VIRUSES" box
    come up at start-up time, though that is apparently what
    it is doing. Result is an span of several seconds where the
    menu appears ready for action but does not respond.
 2) VIRSTOP no longer hangs up the boot when it notices that
     it has been changed.  It still produces the warning message,
     with the recommendation to boot from a clean floppy, then
     allows the boot to continue.
 3) This might not be new to 2.05.  When you define some
     signature strings a file called USER.DEF is created.
     When you INSTALL F-PROT, USER.DEF is NOT one of the files
     copied over.

  Just my two cents, am I being too picky ?
  Ken D.
- ---------------------------------------------------------------------
Ken De Cruyenaere - Computer Security Coordinator - Computer Services
University of Manitoba - Winnipeg, Manitoba, Canada, R3T 2N2
Bitnet: KDC@CCM.UManitoba.CA   Voice:(204)474-8340 FAX:(204)275-5420
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: F-PROT reports Bugsres 3 Jokes program? (PC)
Date: 4 Sep 92 00:11:22 GMT

Dana E. Keil, <dana@are.Berkeley.EDU>, asks:
> I just obtained F-PROT. Running a scan with it reports that a file
> named bugres.com is infected with a virus named "bugsres 3 jokes
> program". I can find no mention of this virus anywhere in F-PROT
> documentation (nor elsewhere). Can anyone enlighten me about it?

F-PROT means exactly what it says, it has found "bugsres 3 joke
program".  This is not a virus, although Frisk should give information
about the message in his documentation.

There are a series of joke programs known as "Bugsres", when run they
don't appear to do anything, but sometime later they generate a video
effect of a number of little bugs messing about on the screen.  Most
commonly such programs are run, 'for fun', on a computer without the
owner's permission.  F-PROT, and other anti-virus software, therefore
recognise these programs due to the concern that a virus might be
causing these effects.

Hope this helps,
Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Netware (PC)
Date: 10 Sep 92 16:47:41 GMT

In my last posting, I accidently referred to the MODIFY right when the
reference should have been to the ACCESS right in the boolean
equation.  MODIFY is only of importance if certain non-default
attributes (e.g.are set.  ReadOnly are set.

						Padgett
From: gerald@vmars.tuwien.ac.at (Gerald Pfeifer (Prak Gusti))
Newsgroups: comp.virus
Subject: Re: Bug in F-PROT? (PC)
Date: 3 Sep 92 16:10:08 GMT

Kevin_Haney@nihcr31.bitnet writes:

>I was using F-PROT 2.04c from a bootable DOS 5.0 diskette.  After
>booting from the A: drive, I wanted to scan another diskette in the A:
>drive.  F-PROT produced unintelligible messages, such as "cotaaly
>tanmcyng, ico staro%Nnurta...".  Another user here reported the same
>phenomenon.  Does anyone have an explanation and/or fix for this
>problem?

With Frisk being on holidays, I think I might answer the question as
well:

It's not a bug, it's a feature!!  :-)

But seriously: As stated somewhere in F-Prot's documentation, F-Prot
needs to (re)load parts of it now and then. (I think every text
appearing on screen is stored in one of two datafiles - one for the
user interface and the other one for virus descriptions).

Frisk is well aware of the kind of problems you've got, but - if I remember
correctly - does not plan to change it anytime soon.

I hope I put it right and Frisk won't kill me when reading this!

Gerald, sign of the mouse

..............................................................................
. Gerald Pfeifer (Jerry)                 Technical University Vienna, Austria .
. gerald@kongo.vmars.tuwien.ac.at                                             .
..............................................................................
. Sorry, I'm not a native speaker (flames to /dev/null)                       .
..............................................................................
From: Felix.Lafontaine@f23.n367.z1.FIDONET.ORG (Felix Lafontaine)
Newsgroups: comp.virus
Subject: 15xx problems (PC)
Date: 30 Aug 92 13:24:00 GMT

HB> From: howard@maccs.dcss.mcmaster.ca (Howard Betel)
HB> My brother recently asked me to disinfect his computer as scan
HB> verifying I ran clean to remove the virus.  Then I installed
HB> (both wer v89) Thinking everything was now clean we started
HB> more work.  Vshield then caught 15xx again and notified me.  I
HB> clean again thinking that somehow I missed something.  Sure
HB> little while later another file seemed to be infected.  I then
HB> again with the all parameter.  It picked up an infected file in
HB> the subdirectories.  When I ran scan again with that file name
HB> file with a name something like '.xxxxx.exe' I can't remember
HB> deleted
HB> recently found out that 15xx mutates.  After telling my brother
HB> been freezing randomly on boot up (right after vshield finishes
HB> of the
HB> floppies are infected?

 Fisrt thing you have to do get a new scan/clean version. Version 89
is out of date. The latest software for antivirus are available in
ftp sites like urvax.urich.edu
  Second, you must boot your sistem from a clean/write protect floppie
to avoid the virus if it in TSR. After you boot you can scan your
computer and clean it.

- --  
Internet: Felix.Lafontaine@f23.n367.z1.FIDONET.ORG
UUCP: ...!myrddin!tct!psycho!367!23!Felix.Lafontaine
Note:psycho is a free gateway between Usenet & Fidonet. For info write to
     root@psycho.fidonet.org.
From: al163193@academ01.mty.itesm.mx (Jesus Miguel Garcia Rodriguez)
Newsgroups: comp.virus
Subject: NAVSCAN (PC)
Date: 10 Sep 92 17:45:57 GMT


 Where can i get NAVSCAN?  or When its gonna be out?

Thanx. 
/\/\otley.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Fingerprinting self-modifying files
Date: 9 Sep 92 19:15:43 GMT

PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics) writes:

> changes that are allowed.  Quite often, the start of the file (be it
> .EXE or .COM) doesn't get changed by self-modifying programs, but does
> by viruses. 

More exactly, you should determine the file entry point (i.e., the
place where the initial JMP points to in COM files and the entry point
in the EXE files) and checksum a few bytes (30-40) from that point.
This is by no means secure (it can be trivially bypassed), but at
least will work against the currently existing viruses (supposing that
the virus is not stealth or is not active in memory). Just remembering
the file entry point is not sufficient - you have to checksum at least
a few bytes from that point. The reason is that there are several
viruses, which modify not the entry point, but the place where this
entry point points to. Such viruses are LeapFrog (for COM files),
Voronezh.1600 (for EXE files), and others.

> I don't know, but probably! The version munging option in MSDOS 5
> supposedly used some self-modification. The number of programs that
> modify themselves (or other programs!) is relatively small (but still
> annoying), so can be handled as exceptions.

Unfortunately, some of these programs are very widely used... Examples
include SideKick, Borland's integrated environments, McAfee's SCAN,
SETVER in DOS 5.0...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: new virus found (PC)
Date: 7 Sep 92 21:24:30 GMT

RZOTTO@NYX.UNI-KONSTANZ.DE (Otto Stolz) writes:

> >                    INDONESIAN VIRUS
> >
> > * FREDDY
> >   Freddy was made by one of a student in a academy of
> >   computer in Indonesia.  It infected the program, not a boot
> >   sector virus.  The program infected is IBMBIO.COM
> >   The characteristic of this virus is the appearance of
> >   FREDDY in a box.

> I fear, this name has already been given to another virus (cf. the
> above quote from an old VIRUS-L posting). If I'm right, you'd better
> choose another name for the new beast, otherwise please tell us which
> name the Indonesioan virus has acquired, meanwhile.

The virus that was rumored to have a name Freddy and to be able to
infect IBMBIO.COM turned out to be a rumor - or at least we have not
seen it yet. By "we" I mean CARO. The virus from Brazil we have,
therefore it has the priority. We don't give names to the viruses we
have not seen.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics)
Newsgroups: comp.virus
Subject: Re: Fingerprinting self-modifying files
Date: 3 Sep 92 23:24:58 GMT

suresh@papaya.iss.nus.sg (Suresh Thennarangam - Research Scholar) writes:
> Is there general agreement that fingerprinting files with a relaible
> method is the most foolproof way of detecting virus infection ?

Yes, but assuming the files can be checked without the possibility of
a virus already in memory, to return the wrong file information, or
(possibly) that the change detector does such a good job of bypassing
DOS and BIOS that it cannot be fooled.

> How would one apply this technique to some programs that modify their
> disk-images ?

Basically the answer is to divide the files into sections, and have
separate checks for each section, and perhaps "know" the nature of the
changes that are allowed.  Quite often, the start of the file (be it
.EXE or .COM) doesn't get changed by self-modifying programs, but does
by viruses. There is another method, which I am still experimenting
with, that is relatively insensitive to typical self-modification
effects (and mutations of viruses), but is computationally intensive.

> Does the MS-Windows distribution contain any such binary files that
> are self-modifying ?

I don't know, but probably! The version munging option in MSDOS 5
supposedly used some self-modification. The number of programs that
modify themselves (or other programs!) is relatively small (but still
annoying), so can be handled as exceptions.

Mark Aitchison, University of Canterbury, New Zealand.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Any info on Gobbler-II a-v sw or Comrac (its publisher) ? (PC)
Date: 7 Sep 92 18:53:06 GMT

CCTR132@csc.canterbury.ac.nz (Nick FitzGerald) writes:

> This morning I received a "beta evaluation copy" of Gobbler-II version
> 2.99B in the mail from Comrac - a Dutch software producer.  From the

> Can anyone give me some more background on Comrac?  Have other regular

I can only confirm that they are indeed a Dutch-based company and
produce anti-virus software. One of their anti-virus programmers is
Victor Smith. In fact, Gobbler seems to be mostly his work.

With an earlier version of the product, there was a complain from S &
S International that the manual used significant parts of the texts
(mainly the virus descriptions) from Dr. Solomon's Anti-Virus ToolKit.
I understand that this is no longer true with the current version of
the product.

> (?) posters to Virus-L/comp.virus also been sent one of these
> diskettes (I haven't had time to look at it yet - looks like something

If you have received the same version as me, be prepared that this IS
a beta version. It's full of bugs and the context-sensitive help is
far from complete. If your copy just hangs your machine when you
execute it, try again with 256 bytes environment (NOT 256 bytes of
FREE environment - the TOTAL environment must not exceed 256 bytes).

The product is using the standard CARO naming scheme for the viruses
it detects. I was told that it performs exact virus identification,
but I was unable to test that, since the program breaks with "Abnormal
program termination" message without producing any report file at all.
Maybe the reason is my monstrous directory structure - my virus
collection consists of about 4,100 infected executable files in more
than 2,300 directories.

The product is promising and probably will be a pretty good scanner -
when it gets ready, which now it definitively isn't.

> for tomorrow now).  Interestingly, whilst they got their original
> contact with me via Email, the letter didn't mention an email address
> to contact them.

Victor Smith has an e-mail address. Probably this is his private
e-mail address, not the official address of the company.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: Windows virus? exists? (PC)
Date: 9 Sep 92 23:20:50 GMT

Alan Christiansen, <alan@saturn.cs.swin.OZ.AU>, asks:
> I was just wondering.  Are there any viruses that are windows
> specific.
>
> ie they infect windows programs only?  infect windows OS.  have
> sysmptoms only when windows runs etc.

There are rumours of Windows & OS/2 aware viruses, but none have reached
researchers - yet.

In the incidents reported to me, the affected individuals/companies have
always cleared it up themselves, and 'lost' the copies that they had put
aside.

Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: sgr4211@ggr.co.uk
Newsgroups: comp.virus
Subject: Re: F-PROT reports Bugsres 3 Jokes program? (PC)
Date: 4 Sep 92 13:06:55 GMT

Dana E. Keil writes:

>  I just obtained F-PROT. Running a scan with it reports that a file
>  named bugres.com is infected with a virus named "bugsres 3 jokes
>  program". I can find no mention of this virus anywhere in F-PROT
>  documentation (nor elsewhere). Can anyone enlighten me about it?

Yes.   The  file  BUGSRES.COM is not *infected* with the "bugsres 3 joke
program" - BUGSRES.COM *is* the joke program F-Prot has spotted.

It's  a  terminate-and-stay-resident (TSR) program that can be installed
so that it is "triggered" on a certain keystroke (eg, the 50th time  the
user  hits  the  "A"  key).   When this event occurs, several simplistic
"ants" race around the screen "eating" the characters on the display.  A
certain  key  combination restores the original screen.  (Can't remember
all the details - something like both shift keys together, I think - try
running  it  with  "/Help"  or  other such switches and you should get a
brief summary)

F-Prot  presumably reports this beacause it could cause panic if someone
installs it on someone else's PC as a "joke", as the  victim  may  think
they  have  been  hit  by  a virus.  Paradoxically, you have been caused
concern *because* of the warning             :-)

Steve Richards.
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: re: BIOS Virus Protection (PC)
Date: 3 Sep 92 17:31:20 GMT

> From:    padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
>
>          A major development seems to have quietly slipped in that
> should make it possible for effective *free* reduction of risk to PC
> users who have purchased their machines in the last year.
> ...
>         In the process my 1989 vintage AMI BIOS (AMI, Phoenix, & Award
> are the three major clone BIOS manufacturers) was replaced with an AMI
> dated 5 May, 1991 and referred to as the "New" BIOS. In the "Advanced
> Setup Menu" is an entry for "System Boot Up Sequence" which may be
> selected as A:,C: (original flavor) or C:,A:...

This is true of some of the latest PS/2 systems as well; you can set
it up to try the disks in just about any order.  If you really want to
try A: first (in case C: contains a CONFIG.SYS that hangs the machine,
for instance), there's a baroque key-sequence that you can do during
boot to make that happen (or to get into the menu that lets you change
the order; I forget which).

I don't know any more details of it, I'm afraid, or even which models
have it.  But it's certainly catching on; good thing!

- - -- -
David M. Chess                    \
High Integrity Computing Lab      \    The devil finds work for idle MIPS.
IBM Watson Research               \
From: Alexander_Ofek@p8.f101.n9721.z9.virnet.bad.se (Alexander Ofek)
Newsgroups: comp.virus
Subject: Auto-detecting Virus (PC)
Date: 6 Sep 92 11:04:38 GMT

In a message to All <02 Sep 92 17:52> Denis Beauregard wrote:

 DB> I would like to write a program that will check if it is per se
 DB> holder of a virus.  The method I have in view :

 DB> Compile the program.
 DB> Compute the checksum of the program.
 DB> Put the checksum in the program.
 DB> When starting the program : Stop the
 DB> program if the checksum has been altered.

Your approach will fail to detect a stealth virus like 1963 or dir2.
To be on the safe side you will have to read the directory using absolute read 
(int 13h) and follow the FAT chains yourself. Of course it might be useful to 
check whether the interrupt vectot of int 13h still points to the BIOS area.

 DB> Would it be safer to use a 32 bit checksum (I understand a 16 bit
 DB> checksum would mean if something if wrong, odd are 1 to 65536 not to
 DB> find it).  A 32 bit machine will just count faster a 32 bit sum.
 DB> So I would use 32 bit for speed reason instead of security (while
 DB> changing the checksum will be harder if 32 bit, and still more if
 DB> instead of adding 32 bits, I mask some bits and add them twice).

Use any CRC check with an UNUSUAL (i.e. rarely used) polinomial. 

        regards
        Alexander Ofek
From: dafj@vaxc.aud.auc.dk (Flemming Holm Jensen)
Newsgroups: comp.virus
Subject: Public Domain TSR Virus Checker (PC)
Date: 3 Sep 92 08:42:17 GMT

I'm looking for a Public Domain Virus-checker (and remover if
possible).  It must be a TSR-version.

I'm running DOS 5.0, on 386 PC's. I have FTP-access.

Anyone who knows about such a program, and where to get it.

Thanks in advance

Flemming Jensen
University of Aalborg, DENMARK
dafj@aud.auc.dk
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Bug in F-PROT? (PC)
Date: 9 Sep 92 19:12:00 GMT

glauber@ele.puc-rio.br (Glauber Maciel Santos) writes:

> 	Despite this, I consider F-PROT to be the best antivirus
> program ever written.  The rate at which its updates appear is

I share your oppinion that F-Prot is an excellent anti-virus program,
but would slightly correct you, by saying that "F-Prot is one of the
best -scanners- available".

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany