HDTenEightyP/NetNews huggingface dataset:
From: lachlan@dmp.csiro.au (Lachlan Cranswick)
Newsgroups: comp.virus
Subject: Re: VET as good as Viruscan? (PC)
Date: 28 Jul 92 13:08:17 GMT

AMN@vms.brighton.ac.uk (Anthony Naggs) writes:

>David H. Ivens (D.Ivens@deakin.OZ.AU) asks:
>> I have evaluated VET anti-virus software (Australia) and it seems a very
>> good alternative to the expensive Viruscan.
>>
>> Has anyone had problems with this software?
>>
>> We do not get a lot of viruses and are considering a site licence for VET.

>I haven't used VET, but I have talked to Roger Riordan (the author) at
>a couple of conferences and he certainly knows his stuff, both on
>viruses loose on Australia and effective techniques for anti-virus
>software.  Better still for you he is also in Victoria and will
>provide good quality and timely support, two things which you may have
>problems with for Viruscan (esp being so far from LA).

We have a site licence for V give it to site staff to nice how you can
legitimatly? give copies to site staff to install on their home
computers so any viruses they get from their

We are not on the cutting edge of pirate software etc that is a major
source of viruses so I do not encourage people to use the memory
resident parts of VET unless they expect nasty file viruses.  The
memory resident part of VET can cause clashes and eratic behaviour
with some programs.  If you read the manual you are prepared for it,
but just having VET.COM installed makes

VET is also very good at repairing the damage that a virus can cause
to a hard-disk.

Just have a site licence for an anti-viral program makes people aware
the damage they can cause and makes them cautious - and thus we do not
have many infectionRs (1 or 2 a year).

Another advantage of having a program installed on all PC's is that
people no longer blame viruses when their computers play up and
instead look for other software or hardware causes.  Not too long ago,
it used to be very hard to convince PC users that their problem was
not virus related because of all the virus paranoia.
- -- 
  Lachlan Cranswick  -  CSIRO             _--_|\  lachlan@dmp.CSIRO.AU
  Division of Mineral Products           /      \     +61 3 647 0367
  PO Box 124, Port Melbourne 3207        \_.--._/ 
  AUSTRALIA                                    v
From: CHE358W@vaxc.cc.monash.edu.au
Newsgroups: comp.virus
Subject: keypress appears and disappears. Help! (PC)
Date: 23 Jul 92 09:46:00 GMT

Hi
  I have an aunt who has a confuser that has contracted the key press
virus. I decided that since they are always getting viruses to install
vshield93 in the autoexec file. All this file does is prompt, path and
run mouse.com and win.com.  I inserted vsheild before win.com and it
found key in memory. I booted off a floppy and scanned with scanv93.
(all files). nothing was found. I moved the vshield command up before
mouse.com and this time nothing was found. After windows executed I
started vhield and still it didn't find anything. It's as though
keypress pops up at a specific point and then dispears again almost
straight away.
  Can anyone tell me if this is expected behaviour for keypress and how I
can find it on the hard disk?

Thanks so much.
Samantha Lane .
che358w@vaxc.cc.monash.edu.au
From: marvin@norton.norton.com (Marvin Carlberg)
Newsgroups: comp.virus
Subject: Re: SAM T4 virus defs file difficulties (Mac)
Date: 22 Jul 92 02:36:21 GMT

Attention SAM Users:

If you are experiencing any difficulties after updating your copy of
SAM for the T4 virus and its associated strains, please note that
SAM's ability to provide protection, detection, and repair via Virus
Clinic, Intercept, or Intercept Jr are not compromised or diminished
in any way.

If your system satisfies all three of the following conditions, you
may experience errors when attempting to launch some applications.

    1) using SAM version 3.0.3 or earlier
AND
    2) using the latest SAM Virus Definitions file (7/8/92) or have added  
       the T4-A/T4-B virus definition manually via Virus Clinic
AND
    3) running System 7 or MultiFinder under System 6

The specific errors include a -605 system error, -33 system error
(only with System 7 File Sharing enabled), an 'Unknown' system error,
and a system freeze or hang.  Please call technical support at
310-449-4990 from 7:00am - 5:00pm Pacific time, Monday through Friday
if it appears that this situation is affecting your system.

Once again, please keep in mind that protection for all currently
known Macintosh viruses, including the T4 strains, is still very
complete even if you are having these difficulties.

Thank you,

Symantec
From: OB77665@IBMH1.ORL.MMC.COM
Newsgroups: comp.virus
Subject: Re: McAfee GENP/GENY identification (PC)
Date: 28 Jul 92 13:18:03 GMT

In reference to Padgett's comments on McAfee's GENP / GENY virus
identification.

I must agree when you have several thousand PC's to keep CLEAN it's
almost imperative that you know what your coming against.  This type
of identification process makes keeping any kind of useful stats very
difficult.

We ran into some factory sealed diskette that were infected. Can you
imagine trying to talk to the service rep. "We know your infected with
a virus, but we don't know what it is."

                      Bruce
From: mha@baka.ithaca.ny.us (Mark Anbinder)
Newsgroups: comp.virus
Subject: re: Disinfectant 2.9 problems (Mac)
Date: 29 Jul 92 15:11:47 GMT

Fran Holtsberry says...

> Since we began installing Disinfectant 2.9 on campus machines,
> we have had a rash of System errors. We have lock-ups, inits
> not loading, errors when attempting to access Apple Menu
> selections. . ..

You haven't specified whether you're referring to the Disinfectant
INIT (or "Extension" in System 7 terminology) or just the application.
My guess is the INIT, since just having the application on your hard
drive shouldn't have this effect.

> Anyone else experiencing this type problem? was there a
> warning with it that I didn't read?

One thing that's important to note, if you haven't used a version of
Disinfectant since 2.7, is that System 7 users MUST put the
Disinfectant INIT in the Extensions folder within the System Folder.
Prior to version 2.7, the reverse was true: the Disinfectant INIT
needed to be in the System Folder itself, not the Extensions
subfolder.

> We are sending out a campus warning about Disinfectant 2.9
> until I hear from some of you.

Are these problems campus-wide?  Or are they showing up on only a few
machines?  If you could provide more details, the rest of the group
will be better able to offer suggestions.  For example, what version
of the System software (6.0.5?  7.0.1?) is running on the affected
machines?  What other INITs are present?

Disinfectant is one of the most-compatible pieces of software I've
seen in a long time, but conflicts can occur almost anywhere.  Maybe
we can figure out something that will help John Norstad make his
software still more reliable.
- --
Mark H. Anbinder                      mha@baka.ithaca.ny.us
BAKA Computers, Inc.                  QuickMail QM-QM 607-257-2614
200 Pleasant Grove Road               Phax  607-257-2657
Ithaca, NY 14850                      Phone 607-257-2070

"Some people want to be independent but can't do it alone." 
                                -- Frank Romano
From: brianc@eskimo.celestial.com (Brian C)
Newsgroups: comp.virus
Subject: Virus BBS List?
Date: 22 Jul 92 23:10:49 GMT

Could someone please e-mail me a list of virus related bbs?

Thanks,
Brian
From: werner@cs.utexas.edu (Werner Uhrig)
Newsgroups: comp.virus
Subject: Re: Quick antiviral comparison (Mac)
Date: 17 Jul 92 11:47:56 GMT


	Regarding your article which just appeared in comp.virus.

	please refrain from including Macintosh software in your
	index as you clearly are not putting in any effort to keep
	the information up-to-date.  As the correct information has
	been posted by others here (comp.virus) -- and widely --
	there is no excuse for this and those of us who are working that
	field would appreciate it if you'd not spread INCOMPLETE,
	OUTDATED, or PLAIN WRONG information.

					---  Werner
					(comp.sys.mac.announce moderator)
- -- 
  werner@cs.utexas.edu |  ..!uunet!cs.utexas.edu!werner | werner@UTXVM.bitnet

              "Free Advice and Opinions -- Refunds Available"
From: james.roy@synapse.isis.org (James Roy)
Newsgroups: comp.virus
Subject: McAfee Products (PC)
Date: 19 Jul 92 20:06:00 GMT

TO: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)

APP>        Lately, there has been a more disturbing trend to leave off
APP>the explicit identification and identify whole families of viruses
APP>simply as [GEN-P] (GENeric-Partition). Since IMHO it is important for
APP>those cleaning up after infections to know what it is they are dealing
APP>with once an infection has been identified, I sincerely hope that this
APP>trend will not continue.

McAfee was quoted in Australia recently as saying that he didn't
recommend using virus cleaning utilities by anyone except those without
back-ups.

The reason he said this is that such cleaning utilities are not 100%
effective and can damage code or leave it infected.  One is better to
identify the infected files, wipe them and restore from back-up.  As
for those who don't maintain effective back-ups, maybe there is a
Santa Claus, Virginia.

Generic detection is the way to go if what we are talking about is the
ability to detect --all-- viruses known and unknown.  This is the major
weakness of scanners - they can't identify viruses they don't already
know about.
- ---
 . OLX 2.1 . This tagline is umop apisdn
From: seldon@milton.u.washington.edu (Hari Seldon)
Newsgroups: comp.virus
Subject: Best VirusDetection Software for the PC??? (PC)
Date: 25 Jul 92 07:30:12 GMT

I am new to this group, and I get kinda paranoid after reading all the
potentias of programs, not being able to detect..  I have the latest
version of McAfee s3t apparently it isn't very good.  Does anybody
have any suggestions, on which, orn of programs would be the best??
And if possible, list FTP sites where I can ac clean versions of these
programs??  I haven't really had a problem, yet.  I donh outside
contact, except the downloaded files, from ftp sites, and the
occasetinn board..  Thanx for any advice...

Seldon
From: vail@tegra.com (Johnathan Vail)
Newsgroups: comp.virus
Subject: Re: WARNING - Virus Creation Laboratory (PC)
Date: 28 Jul 92 21:48:18 GMT

millernw@craft.camp.clarkson.edu (Neal Miller) writes:

	   Oh for crying out loud...  Just what we need...  A
   Virus-Construction Kit for beginners...  I hope that McAfee gets their
   hands on this package ASAP, if not sooner.  Here's an idea...  Could
   someone conceivably write a virus that will seek out and destroy such
   a V.C.L. based on unique strings within the program?  Just an idea...

The short answer is yes.

However, I hope this was a sarcastic comment.  People have expounded
many times on why a benevolent virus is not a good thing.  For both
technical and moral reasons.

jv

"Good doesn't live and theres no evil here, 
 only this great power we misunderstand" -- Dinosaur jr.
 _____
|     | Johnathan Vail     vail@tegra.com     (508) 663-7435
|Tegra| jv@n1dxg.ampr.org    N1DXG@448.625-(WorldNet)
 -----  MEMBER: League for Programming Freedom (league@prep.ai.mit.edu)
From: UNRECOVERABLE APPLICATION ERROR: Abort? Retry? Buy OS/2?@hooch.CC.Le
Newsgroups: comp.virus
Subject: Dark Avenger query (PC)
Date: 17 Jul 92 21:00:38 GMT


  Has anyone had experience with Dark Avenger infecting files on a
Novell Network, specifically Login.exe? We've had an infection where
the virus appears to have infected files on the server as well as the
workstations. Can there be something else going on? Thanks in advance.

Steve Grigg
From: millernw@craft.camp.clarkson.edu (Neal Miller)
Newsgroups: comp.virus
Subject: Re: WARNING - Virus Creation Laboratory (PC)
Date: 22 Jul 92 13:08:05 GMT

martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences) writes:

>I have acquired a rather disturbing new software package, that is
>apparently available from some of the virus BBSes.  It is called the
>"Virus Creation Laboratory" v 1.00, (c) 1992 Nowhere Man and [NuKE]
>WaReZ.  The package includes the V.C.L. itself, a development
>environment written in Borland C++ and styled after the Borland
>Integrated Development Environment, MS-Windows .ico and .pif files,
>surprisingly well written documentation, and eight example viruses and
>trojans.

	(Rest of well-written posting deleted for convenience)

	Oh for crying out loud...  Just what we need...  A
Virus-Construction Kit for beginners...  I hope that McAfee gets their
hands on this package ASAP, if not sooner.  Here's an idea...  Could
someone conceivably write a virus that will seek out and destroy such
a V.C.L. based on unique strings within the program?  Just an idea...
Please post when McAfee decodes these virii.  I have a feeling that
these virii will be at least as widespread as Jerusalem and Stoned in
a matter of time.

- --
- -----------------------------------------------------------------------------
 Neal Miller         | "Why not go mad?"  | millernw@craft.camp.clarkson.edu
 Clarkson University |     - Ford Prefect |     dark@craft.camp.clarkson.edu
- -----------------------------------------------------------------------------
From: krvw@cert.org (Kenneth R. van Wyk)
Newsgroups: comp.virus
Subject: Administrative: VIRUS-L mailing problems
Date: 27 Jul 92 19:27:05 GMT

As some of you have noticed, we've been having some e-mail problems
associated with the recent move to the new LISTSERV@Lehigh.edu.
Please be patient and bear with these teething problems for a while
longer while more fine tuning takes place behind the scenes.  We hope
to have the problems resolved shortly.

Thanks for your patience,

Ken

Kenneth R. van Wyk
Moderator VIRUS-L/comp.virus
Technical Coordinator, Computer Emergency Response Team
Software Engineering Institute
Carnegie Mellon University
krvw@CERT.ORG       (work)
ken@THANG.PGH.PA.US (home)
(412) 268-7090  (CERT 24 hour hotline)
From: PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics)
Newsgroups: comp.virus
Subject: Re: McAfee Products (PC)
Date: 22 Jul 92 23:43:00 GMT

james.roy@synapse.isis.org (James Roy) writes:
> TO: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
> APP>  ... disturbing trend to leave off
> APP>the explicit identification and identify whole families of viruses
> APP>simply as [GEN-P] (GENeric-Partition). Since IMHO it is important for
> APP>those cleaning up after infections to know what it is they are dealing
> APP>with once an infection has been identified, I sincerely hope that this
> APP>trend will not continue.
> 
>...  One is better to identify the infected files, wipe them and restore 
> from back-up...

Yes, but it is still important to know the exact name of a virus
sometimes, e.g. to know what damage to expect, or if there is a new
virus around. Probably the main reason for me is if it is the same
virus that was cleaned up last week then I know I have to hunt harder
for some infected diskettes or machine in the department. Knowing the
exact name of a file infector might be becoming less useful (or even
possible?), I must admit, but I would really like to know why SCAN
seems to be going to such great lengths to not identify (or
mis-identify) viruses the way it does. It must be deliberate, surely.

I agree very much with using backups rather than disinfecting,
although with boot sectors the disinfecting process *could* be safe -
unfortunately fewo tell (sometimes) which version of boot sector is required an
d copy
the appropriate one in.

Mark Aitchison, University of Canterbury.
From: ndecour@spartan.ac.BrockU.CA (Nancy DeCourville)
Newsgroups: comp.virus
Subject: Scream information? (PC)
Date: 22 Jul 92 01:19:20 GMT

Any information on a virus called Scream would be appreciated.
From: Jim.Baltaxe@vuw.ac.nz (Jim Baltaxe)
Newsgroups: comp.virus
Subject: Frodo False Alarm (PC)
Date: 29 Jul 92 00:00:11 GMT

I just came across an interesting false positive reported by Virusafe
v. 4.5, from XTree software running on a Toshiba laptop (386SX) under
DOS 5.0 and an access control manager called Ironclad v. 2.0 from
Silver Oak Systems.

Virusafe reported the Frodo (4096) virus in memory but no infected
files. F-Prot 204a did not report anything either in memory or on
disk.  Attempting to reboot from a known clean system disk failed
because the ACM was active.

Eventually we got an emergency boot disk for Ironclad which disabled
the ACM. Then when we rebooted and rescanned with both Virusafe and
F-Prot the system reported clean. EXE & COM files reported the same
lengths with & without the "infected" system running.

Unfortunately I am not very familiar with Ironclad so I cannot say
exactly what it did (presumably packed/encrypted the disk?). Ironclad
appears to be based on a hidden device driver which is unlikely to
have been effected by the virus.

Anybody come across this as well?
- -- 
Jim Baltaxe - jim.baltaxe@vuw.ac.nz
Computing Services Centre - Victoria University of Wellington - New Zealand
- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Time is such a valuable commodity because they're not making it any more.
From: smith_s@gc.bitnet (Steven W. Smith)
Newsgroups: comp.virus
Subject: RE: write protect on C: (PC)
Date: 28 Jul 92 15:04:51 GMT

>Date:    Thu, 23 Jul 92 05:09:01 +0000
>From:    glratt@is.rice.edu (Glenn Forbes Larratt)
>Subject: GIF viewer crashes system (was Re: an amazing problem...) (PC)
>
>sbb1@Ra.MsState.Edu (Shay B. Berthelson) writes:
>>t7@elan.glassboro.edu (TEMP_7) writes:
>>
>>>i am in desperate need of help.
>>
>>>yesterday i downloaded a piece of software called NakedEye -- a p.d. gif
>>>viewer -- when i tried to run it, the screen blanked and the system crashed,
>>>but when i rebooted i got an error "drive c write protected" -- i am using
>>>dos 5.0 and as far as i know (and as far as my manual says) you cannot write
>>>protect a drive. although i am also running stacker and 4dos. 4dos does not
<DOT>
<DOT>
>>Do you have a virus scan program??? Really sounds to me like you got infected.
>>Better get a scan/clean prog. and clean it up.  Most stuff can be fixed and
>>saved if it hasn't destroyed everything.
>
>I agree that this sounds like malicious code at work, since t7's
>assumption is correct that write-protecting a hard drive is not a part
>of standard MS-DOS or (I think) 4DOS or Stacker.  This is especially
>likely if you down- loaded from a BBS or from an INCOMING directory of
>an ftp site.

  I've experienced the same thing using DR DOS 6.0 with disk
compression. It was not virus-related in any way.  It's very likely
that CHKDSK/F will put everything back in order.  I think that it's a
nice feature to add the write protect if you subtly munge your disk,
but it would be nice to clue the user in about using CHKDSK/F to clean
up.
  Hope you haven't formatted your HD yet or anything :-)
  _,_/|
  \o.O;   Steven W. Smith, Programmer/Analyst
From: RXB%FDACFSAN.BITNET@VTVM2.CC.VT.EDU
Newsgroups: comp.virus
Subject: F-PROT, Telecom, false positive ?? (PC)
Date: 22 Jul 92 13:46:25 GMT

Situation - After receiving ftp'd *.zip files, I downloaded them
from my mainframe VM session to my PC using Attachmate's Extra for
Windows 3.22, under Windows 3.1. Then I ended my mainframe session and
exited Windows. After unzipping the files onto a floppy, I scanned them
using SCANv93, then Central Point Antivirus 1.2, and then F-PROT 204a.
Central Point's VSAFE is loaded into memory as a tsr, the others are
not. F-PROT gave a message indicating that the Telecom virus
search pattern was found in memory, reboot from a clean floppy. After
rebooting, I scanned with each of the 3 packages, and none reported a
problem. This happened on several different occasions, involving
different unzipped files each time. Is this a case of SCAN or
CPAV leaving a virus string in memory that F-PROT is picking up,
or do I have a problem?
The PC is an Iverson 486/33, DOS 5.0, and QEMM386 6.0. SmartDrive,
VSAFE, and Norton Utilities 6.01's Erase Protect are loaded upon
booting.
Assuming this is just a false positive, is there any reason I shouldn't
scan using any or all of these packages under Windows, with the
mainframe session still active?
Is F-PROT the only one of the 3 that can scan *.zip files, not yet
unzipped?
Thanks for your help.
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: Re: How do I reverse the effect(s) of Stoned ? (PC)
Date: 29 Jul 92 17:31:38 GMT

> From:    lachlan@dmp.csiro.au (Lachlan Cranswick)
> ...
> Stoned is quite happy to exist on a hard-disk which it slowly corrupts.

No.  Sorry to be contrary, but this is one of the most common viruses,
and misinformation about it is a bad thing.  The Stoned virus writes
to a hard disk one and only one time: when the machine is booted from
an infected floppy diskette.  It never makes any alterations to the
hard disk after that.  No slow corruption, or fast corruption either,
for that matter (with one exception; see the next paragraph).

On some hard disks (those with the first partition stored immediately
after the master boot record, rather than at the start of the next
track), the virus will save a copy of the master boot record over
part of DOS's data space (generally one of the FATs).   (This is
a bug in the virus, and apparently not intentional; the space is
unused on most hard disks.)  This can cause immediate problems
if that part of the FAT is in use for files (the files will
become cross-linked, invalid, and so on; CHKDSK will report
many errors).  If that part of the FAT is not in use, problems
may occur later, when the disk gets fuller and DOS tries to
use the part of the FAT that contains the saved original MBR.
The machine may not boot from the hard disk, for instance.

Cleaning up from a Stoned infection just involves reconstructing
or restoring the code part of the Master Boot Record, using
FDISK /MBR to rebuild the code from scratch (carefully! see back
issues of VIRUS-L for details), or using any anti-virus program
that can find and restore the original MBR.  If the old MBR was
placed in the FAT, and DOS has altered it (so the machine no
longer boots from the hard disk), that won't work, and a
rebuild-the-code-from-scratch is called for (unless you have
a backup of the MBR lying around).  Also if the old MBR was
placed in the FAT, and that part of the FAT was in use for
files, the files should be restored from backups (although
if any are critical and not backed up, lots of slogging
with some disk-explorer should be able to find the data
eventually).

The "hard drive named D:" effect in the original posting
doesn't ring any bells with me.   What does DOS think about
C:?   What does "DIR C:" do?   I've not heard of the Stoned
causing this effect before.  Might be a coincidence, or
an unusual interaction with something about your hard disk.

- - -- -
David M. Chess                |  "Some look at the world as it is, and
High Integrity Computing Lab  |   ask 'why?'. I look at the world as it is,
IBM Watson Research           |   and say 'Hey, neat hack!'."  - J. R. H.