HDTenEightyP/NetNews huggingface dataset:
From: 0005555440@mcimail.com (Scott Begin)
Newsgroups: comp.virus
Subject: VSUM Listing (PC)
Date: 14 Nov 92 03:00:17 GMT

I have heard reference to the VSUM listing as a reference on the
characteristics of viruses.  I know I can download it off the McAfee
BBS and that it is a HyperText document, but I have never worked with
HyperText.  I know it is some sort of database, but nothing more than
that.  Once I would download the VSUM listing, what software would I
need to use it?  Will this software run on an 8088 or a 286/386 with
nothing more than Hercules Graphics?  Where can I get a copy of the
software?  Do I even have everything right about the VSUM listing?

Scott A. Begin             Oak Forest, IL
SBEGIN@mcimail.com
From: masjol@dou.dk (J|rgen Olsen)
Newsgroups: comp.virus
Subject: Re: Bug in F-PROT2.06a - cannot reproduce it! (PC)
Date: 16 Nov 92 13:53:04 GMT

I have tested 2.06a for the bugf you reported. I/We cannot reproduce
it on our machines!!

So probably Frisk cannot do it either, and that makes it difficult for
anyone to help you with your problem.

Try again and be sure that you either have installed all files -
belonging to 2.06a (I had a similar problem reported from a user had
an earlier version of FRISK's database on his disk) on your harddisk,
or the program diskette in a drive!!

Hope this might
help

Regards,
Jorgen O
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: F-Prot's (v2.05) memory scanning. (PC)
Date: 17 Nov 92 08:58:23 GMT

cz1jed@orac.sunderland-poly.ac.uk (J.EDWARDS) writes:

>After hours of failing to get Windows to install, the owner suddenly
>announced he thought his computer might be infected.  I ran F-Prot
>straight away and sure enough it announced it had detected 'Stoned' in
>memory.  I booted from my clean floppy and when running F-Prot again
>it claimed the hard-disk was infected with not 'Stoned' but
>'Michaelangelo'.

The reason for this is simple - The memory scan only reports the virus
family, not the exact variant name.  As Michelangelo has been
classified as a member of the "Stoned" family, it reports "Stoned".
When you scan the boot sector, F-PROT identifies the variant - in this
case Michelangelo.

- -frisk
From: ygoland@edison.SEAS.UCLA.EDU (The Jester)
Newsgroups: comp.virus
Subject: Things that keep me awake at night
Date: 17 Nov 92 02:14:30 GMT

Silence. That is what I hear on this net.group. I hear silence.  There
is some discussion about a particular program's ability to detect a
virus and then there is the reason I still read this group, new
product announcements. But the one thing I'v never seen is a
discussion of the mechanics of fighting viruses. Is the viral world
satisfied with it's basic tools, scanner, activity/change monitor, and
heuristic analyizers? Is that the end? Are all of the people in the
community doing nothing more than comming up with new scan codes for
whatever virus has shown up this week, trying to understand the ugly
inards of some os so they can tweak their monitors a little better,
and trying to see yet another combination of code that only a virus
would use? Why is there no real discussion on techniques and ideas? Is
this part of the conspiracy of silence that infects the viral
community?

		Just curious,
				Yaron (The Jester) Goland
- -- 
RSA proved you could patent math, whats next? Fire?
"Sorry, you can't rub those two stones together!
	First is a Patented Process"
		-The Jester
From: jhk@washington.ssds.COM (jhk)
Newsgroups: comp.virus
Subject: Re: SCAN 97 not working on OS/2 (OS/2)
Date: 16 Nov 92 17:15:53 GMT

Ref Scanv97 not working with OS2 .... McAfee released (BETA i think) a
copy of SCANOS2 ... I dloaded it off the HomeBase BBS last week.
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: Need info on MONKEY virus (PC)
Date: 17 Nov 92 06:42:46 GMT

>From:    martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences)

>Third, the Monkey virus specifically (and successfully) 
>bypasses Padgett's Disk Secure program.  This virus represents
>a rare case: a very specific attack against a very specific
>disk security system.  Fortunately most scanners will find 
>the virus in memory.  Again this stresses the importance of
>having a multi-layer antivirus strategy.

Like I said, no software is proof against a directed attack, *however*
the DOS validator (CHKSEC) in the latest DS will detect the fact that
the proper code is not resident in memory and the Monkey cannot
prevent *that*.

Incidently, it was said that FixMBR cannot remove the Monkey - this is
true however if FixMBR was executed *before* infection and the .DAT
file saved, use of it as directed after booting from floppy will
restore the MBR & table as will the DiskSecure recovery disk.

				Cooly (in Chicago in November ?)

						Padgett
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: re[2]: Infection Density
Date: 14 Nov 92 11:11:19 GMT

Tarkan Yetiser writes:
>It is usually an alert user who discovers the beast, even without an
>a-v product. After that discovery, they bring in the big guns.

Thank you for saying this!  This is the real life world in which we
live.  This is the root of the differences between the philosophies
espoused by the academics and the words this forum has heard from some
of the people who represent products.

Products have to be concerned with being fast (invisible) during the
normal course of a day's work.  The normal course is one where there
are no viruses on the system.  When a virus is detected, the big guns
get called and they arrive to work in a different environment, where
there is known to be a virus.  That would imply a different set of
tools.

The program is an alarm system.  You don't house firemen in everyone's
homes.

Jimmy Kuo                                       cjkuo@ccmail.norton.com
Norton AntiVirus Research
From: rslade@sfu.ca
Newsgroups: comp.virus
Subject: CHRISTMA effects (CVP)
Date: 15 Nov 92 01:52:16 GMT

HISVIRI.CVP   921022
 
                    CHRISTMA EXEC - the effects
 
The exact number of copies made by any one reading of the CHRISTMA
EXEC would depend upon the number of listings in the NAMES file, and
the messages received by the NETLOG file.  However, for all intents
any nuclear physicist knows that it only needs to be, on average,
"greater than one".  The CHRISTMA EXEC would destroy itself, after
having been read, but more copies would be created than destroyed.
 
Some of the newly spawned messages would "die" a natural net death,
being outdated accounts, or directed at those who were on holiday
(or, perhaps, executives and managers, who, of course, never read
their email :-).  Most, however, would reach a working account, and
a mildly (but likely not sufficiently) curious user.  The user would
type "Christmas", see the tree, shrug and dismiss the message ...
while a number of new messages would be created and head off in all
directions.
 
Eventually, a large number of users would be reading, and
inadvertantly sending, copies of the message.  Therefore, a large
volume of mail would be being generated, using up a large chunk of
bandwidth.  Eventually, in some cases, all the available bandwidth. 
Some machines were essentially cut off from the net ... with the
exception of the CHRISTMA "cards".
 
In addition to bandwidth, CHRISTMA consumed disk space.  The
individual messages would not be large, but the numbers of them
would start to consume significant amounts of disk drive real
estate.  Mail spool entries would also be used up.  Not only would
they be used up on the system itself, but users' mail directories
would start to show repeating listings for the CHRISTMA EXEC,
crowding out other, more important messages.  (Most of this crowding
would be psychological, but occasionally it would be physical, as
system limits were reached.)
 
The general "disinfecting" action taken was to shut down the system,
and purge all copies of the message from the mail spool.  However,
since the transmission was "cross-system", users would have to be
warned to be on the alert for the message when received from an
outside source.  The major impact was mostly confined to the period
of December 9th, 1987, to December 14th.  IBM's internal network,
VNET, was more heavily hit than either EARN or Bitnet, and drastic
action, in the form of a general system shutdown, was felt to be
needed to clear up the mess.  (VNETers seemed to be more severely
affected because of larger NAMES files.)
 
copyright Robert M. Slade, 1992   HISVIRI.CVP   921022

==============
Vancouver      ROBERTS@decus.ca         | "A ship in a harbour
Institute for  Robert_Slade@sfu.ca      |  is safe, but that is
Research into  rslade@cue.bc.ca         |  not what ships are
User           p1@CyberStore.ca         |  built for."
Security       Canada V7K 2G6           |           John Parks
From: bob@psychnet.psychol.utas.edu.au (Robert G. Reid)
Newsgroups: comp.virus
Subject: Australian anti-virus site
Date: 17 Nov 92 05:58:41 GMT

An small selection of current Anti-Virus software is once again
available for Australian net users (AARNET) at:
         ftp.psychol.utas.edu.au    (131.217.35.98).

Please address any correspondence re this facility to:
         bob@psychnet.psychol.utas.edu.au
- --
bob@psychnet.psychol.utas.edu.au <Robert Reid>
From: SYSBXR@suvm.acs.syr.EDU (Bridget Rutty)
Newsgroups: comp.virus
Subject: Re: CHRISTMA Effects (CVP)
Date: 17 Nov 92 13:38:29 GMT

The CHRISTMA exec did NOT destroy itself after sending copies.  I
erased several from our users minidisks.  Also, I did not have to
shutdown our system.  I just listed all the reader files in the system
and purged any CHRISTMA exec I found.  But, there weren't many - I
forget exactly how many there were but it was less than a hundred.
Other sites merely drained their RSCS links (software that delivers
mail and files to other computers) while they cleaned up.  There may
have been some sites that found it necessary to shutdown but I have
not heard of any.  What really stopped the explosion of files was the
BITNET sites that installed a trap in RSCS to erase any CHRISTMA file
sent to it.  When installed in a few strategic nodes, this trap is
very effective at stopping this type of trojan horse.  Two more
attempts at distributing CHRISTMA were stopped as well as a couple of
others whose names I forget.  The defense is good enough that most
people aren't aware of the subsequent attacks.  I haven't seen any
attempts to distribute such trojans in a couple years.

Bridget Rutty                                        SYSBXR@SUVM.BITNET
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: KEY Press virus & McAfee v97 (PC)
Date: 16 Nov 92 14:51:44 GMT

mcafee@netcom.com (McAfee Associates) writes:

> >Am I sure about -what-? That SCAN 97 does not detect Commander Bomber
> >reliably? Yes, I am sure about it. It doesn't detect it reliably. It
> >misses this virus in some of the infected files.

> But it picks it up in some.  Which means the programmers are at least on
> the right track, as far as a making a detector goes.  I'll ask them to look

The above remark would be fine if we were discussing a beta version of
a program, or a theoretical approach how to detect this virus. But,
hey, we are discussing a widely used known-virus scanner! In this
particular case it means that it is not able to reliably detect this
virus! Any comments about it "being on the right track" is simply
irrelevant! Fortunately, the virus is not spread in the wild - it is
available mainly on the virus exchange BBSes... On the top of that, a
bug in it causes it to crash from time to time...

> at the detector for the it, then.  If they have any questions, can they 
> contact you directly by email?

I really cannot understand this question?! You know very well that
both you and Igor Grebert are keeping in touch with me by e-mail!

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: gerald@vmars.tuwien.ac.at (Gerald Pfeifer (Prak Gusti))
Newsgroups: comp.virus
Subject: Re: VSUM Listing (PC)
Date: 17 Nov 92 18:27:53 GMT

0005555440@mcimail.com (Scott Begin) writes:

> [ Some questions about VSUM ]

Yes, it runs an 8088 to 80486, and on Hercules as well as on VGA....
The VSUM-package contains everything you need except DOS....
It is available on most antiviral FTP-Sites (try risc.ua.edu, urvax.urich.edu)

BUT: Some experts (Bontchev, Frisk...) in this group do *not* recommend VSUM.

A while ago I heard that the VTC Hamburg (where Bontchev works) is going
to release a dBase version of there virus catalog. I have not seen it 
yet, but if anyone in this group knows, please let us know.....

Please no flaming about this topic!!!!

Gerald

...........................................................................
. Gerald Pfeifer (Jerry)              Technical University Vienna, Austria .
. gerald@kongo.vmars.tuwien.ac.at     Home: Mondweg 64, 1140 Wien, Austria .
...........................................................................
. Sorry, I'm not a native speaker (flames to /dev/null)                    .
...........................................................................
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Filler virus - Need Help! (PC)
Date: 16 Nov 92 13:42:01 GMT

ames@bcstec.ca.boeing.com (Wes Ames) writes:

> packages in our "anti-virus toolkit", including CPAV.  My experience
> has been that early versions of CPAV did indeed have a problem with
> viral scan strings in memory, but the problem has been eliminated in
> more recent versions.  Not only are the strings encrypted, but they
> are specifically overwritten when the user exits the app.  That has
> been my understanding of the current product - have you seen something
> different??

Maybe we should clarify to each other the particular version of CPAV
we are speaking about. The latest version we have here is 1.3. In the
same time, I have seen a clone of the program that is rumored to be
supplied with MS-DOS 6.0 and it doesn't have the unencrypted strings
problem. Did CPS produce any version of their product between those?

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: Netscan (PC)
Date: 15 Nov 92 06:25:54 GMT

Hello Jenny,

pruett@CS.ColoState.EDU (J. L. Pruett) writes:
>Question:  Netscan97 wont' scan my server drive f: . Tells me 
>boot sector not found, and asks me if I'm sure I have a drive f. 
>The server is a novell setup. 
[...deleted...]

It sounds like you downloaded a damaged copy of NETSCAN Version 97
that was on our BBS for about four hours before it was discovered and
replaced with a new .ZIP file.  You can download the current (97-B)
version from our BBS, or by anonymous ftp from the mcafee.com site
(IP# 192.187.128.1).  Filename is netsc97b.zip and is in the
pub/antivirus directory.

Regards,

Aryeh Goretsky
Technical Support
- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Info Grain of Sand Virus (PC)
Date: 16 Nov 92 14:06:41 GMT

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:

> probably have a false positive. Just in case, try F-Prot 2.06a. It is
> important to verify whether you really have this virus or it is only a
> false positive, since the virus triggers on November 15 and destroys
> the information on your hard disk.

Ooops, as several people pointed me out, I've got my activation dates
messed up. The virus activates on November 1 and March 15, not the
other way around. Sorry for the misunderstanding.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: tyetiser@umbc5.umbc.edu (Mr. Tarkan Yetiser)
Newsgroups: comp.virus
Subject: Being forthcoming...
Date: 14 Nov 92 21:16:45 GMT


   Hello Aryeh,

mcafee@netcom.com (McAfee Associates) writes:
> Bugs can be fixed.  Bearing in mind that I am, after all, a McAfee
> Associates employee, I believe that McAfee Associates (and myself) have
> been very forthcoming to users about reporting bugs, fixing them, and
> suggesting workarounds while the bugs do get fixed.

   In keeping up with this tradition of open communications with your
users, would you please share with the readers of this newsgroup the
press release from McAfee Assoc., dated May 11, '92 and titled "Dark
Avenger Mutation Engine No Threat to Protected PCs", with the contact
name Mr. McKiernan?  Out of curiosity, is William McKiernan a McAfee
agent or employee?

   If the requested article is not posted here, curious individuals
can contact me by e-mail to get a copy of what I am talking about, and
judge for themselves the nature of the statements made there. I shall
not comment.

[Moderator's note: It is with great trepidation that I am approving
this message.  Gentlemen, before this gets out of hand, I want to
remind you both to keep this discussion civil.  Otherwise, you can
eliminate the middle man by forwarding any follow-ups directly to
/dev/null...  :-\]

Regards,
Tarkan Yetiser
VDS Advanced Research Group
P.O. Box 9393
Baltimore, MD 21228, U.S.A.
(410) 247-7117
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: How good is Norton Antivirus? (PC)
Date: 16 Nov 92 13:54:57 GMT

protonen@daimi.aau.dk (Lars J|dal) writes:

> How does Norton Antivirus compare to other virus programs, such as
> F-prot and Vscan, apart from that Norton is commercial? Norton is

I don't know what Vscan is, but when comparing the virus-related
stuff, F-Prot is much superior to NAV, IMNSHO... F-Prot doesn't have
the same flashy interface (which I don't like, BTW), but has better
virus detection, -much- better virus removal (although I claim that
disinfecting viruses is a bad idea), better virus identification,
- -much- better virus classification, seems faster (I'm not certain
about this; it's difficult to tell the difference on a '486), uses
(slightly) less memory, etc.

> almost never mentioned here. Is that because it is commercial or
> because the other programs are better?  Please note that I'm NOT

Both, I guess... But we have a virus expert (Jimmy Kuo) from Symantec
who is reading this forum, so he might be able to provide you any
additional information...

> Approximately how many viruses does it detect? 

Haven't done detailed tests recently, but I would bet that version
2.1 (and I have not heard about a newer version) detects less than 90%
of the viruses in our collection... Probably something around 60-85%,
but I am unable to supply a more reliable number right now, and the
above number is -not- reliable (i.e., it is not based on recent tests).

> Does it detect all the "important" viruses? 

Probably, yes. Define "important".

> How often is it upgraded?

Hm, I don't know... You should ask Symantec about this.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: mechalas@mentor.cc.purdue.edu (John Mechalas)
Newsgroups: comp.virus
Subject: Re: SCAN Ver 97 & Monkey Virus (PC).
Date: 17 Nov 92 03:43:45 GMT

martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences) writes:
>But it isn't trivial, so instead you might want to get a copy of
>my KILLMONK program, which does that and more for you.  It uses
>some careful identification strings, checks that the recovered MBR
>is correct, etc.  Also makes scanning and cleaning of floppies 
>easy.  And strictly speaking, it doesn't require a clean boot, as
>long as the only virus messing things up at the time is Monkey.
>
>I think KILLMONK may have been posted at some of the ftp sites.
>If you can't find it, or want me to send it (uuencoded) via
>e-mail, drop me a note.  (It's free of course, and worth every
>virtual cent!)

I found killmonk.zip at oak.oakland.edu, so I assume it is at all of
the SIMTEL20 mirrors.  It's in the trojan-pro directory, by the way.
- -- 
John Mechalas                      | If you think my opinions are Purdue's, then
mechalas@mentor.cc.purdue.edu      |      you vastly overestimate my importance.
Purdue University Computing Center |             Help put a ban on censorship :)
General Consulting                 |                       #include disclaimer.h
From: 74656.557@CompuServe.COM (ESSMAN)
Newsgroups: comp.virus
Subject: New virus (PC)
Date: 17 Nov 92 17:57:24 GMT

Source: Northeastern US
        Found on two BBSs with the file name LARRY5.ZIP

Type:   COM and EXE infector with variable size
        increases from 1024 to 2048 bytes that will infect files
        over 3K when they are opened for any reason. File
        size changes not seen while in memory.

Symptoms: Left CTRL key disabled when in memory, message displayed.
          File allocation errors on CHKDSK.

Trigger Date: Third Friday of any month (after 1992).

Message Displayed:  VSUM VIRUS - your PC is now infected
                    (c) 1992 P/S, Inc.

Other Text (memory only):  For that dumb c***
                           Igor was here
                           C:\COMMAND.COM

Identification: No HEX detection string available since virus is
                slightly polymorphic.  Algorithm needed for detection.

                           Please avoid all files with the name LARRY
                           or LEISURE SUIT LARRY in the descriptions.

                           Eric J. Essman
                           PC/LAN Implementations Group
                           Information Center
                           Union Bank of Switzerland
                           North American Region

                           CIS: 74656,557
                           Internet: 74656,557@compuserve.com
From: alon@ibmpcug.co.uk (Alon Risdon)
Newsgroups: comp.virus
Subject: Michelangelo Date Please (PC)
Date: 14 Nov 92 20:56:42 GMT

Can anyone recall the date that the Michelangelo virus trips on?

[Moderator's note: Shouldn't that be, "Can anyone _forget_ the
date..."?  :-)  March 6, of any year.]
From: rahul@hfglobe.intel.com (Rahul Ravel)
Newsgroups: comp.virus
Subject: Stoned virus Recovery (PC)
Date: 18 Nov 92 00:20:07 GMT

Hi all,

About 1 1/12 weeks ago I posted a query on how to get rid of the
Stoned virus on a friend's pc.  Just wanted to say 'Thanks" to all who
e-mailed.

FYI, I used Paul Padgett's FixMBR utility to restore the original boot
record.  No loss of data.  Thanks, Paul!

- -Rahul, rahul@hfglobe.intel.com

"Only my own opinions here"