HDTenEightyP/NetNews huggingface dataset:
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: KEY Press virus & McAfee v97 (PC)
Date: 2 Nov 92 14:13:47 GMT

mcafee@netcom.com (McAfee Associates) writes:

> We've reproduced the problem of SCAN reporting a variant of the
> KeyPress virus multiple times in a file and will be fixing this in a
> subsequent version of SCAN.

While you are at it, please also have in mind that:

BetaBoys.Rattle is reported as Rattle [Rttl] and Mexican [Mex];
Burger.* are reported as Burger [Burger] and FamilyQ [FQ];
Cascade.1701.D is reported as JoJo [JoJo] and Yap [Yap];
Crew.* (except Crew.1.C) are reported as Crew-2480 [2480] and FamilyM [FM];
FaxFree.Topo is reported as Lamer [Lam] and Topo [Topo];
Happy_New_Year.1600 is reported as Happy N.Y. [HNY] and Voronezh [Vor];
Horse.1154.* are reported as 512 [512] and Horse [Hrs] (in some files only);
Jerusalem.Mummy.1_2 is reported as Mummy [Mum] and FamE [FE];
Jerusalem.Timor is reported as 1241 [1241] and Jerusalem [Jeru];
Leprosy.G is reported as infected twice by Leper [OW];
Leprosy.Plague is reported as Viper [Vip] and Plague [Plg];
MShark is reported as FamN [FN] and FamM [FM];
Murphy.Brothers is reported as Brothers [Bro] and 1530 [1530];
Murphy.Tormentor.* are reported as LixoNuke [Lix] and Murphy [Murphy];

Sorry for the long list, but I hope that it might help to some other
readers too. Hope you'll fix that in your next version.

> >places... Unfortunately, this is not always the case, which explains
> >why SCAN does not detect Commander Bomber infections reliably - the
> >virus can reside just anywhere in the file and control is transferred
> >to it in a non-trivial way...

> Are you sure of this?  The reason I ask is that does not always use
> the "top-and-tail" (or "beginning-and-end," etc.) method of searching
> for file-infecting viruses, especially if a "fragmentation attack" is
> performed.

Am I sure about -what-? That SCAN 97 does not detect Commander Bomber
reliably? Yes, I am sure about it. It doesn't detect it reliably. It
misses this virus in some of the infected files.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Newest and best scanner? (PC)
Date: 11 Nov 92 22:02:00 GMT

bartjan@blade.stack.urc.tue.nl (Bartjan Wattel) writes:

> One of *the* best scanners I know of, is:

You forgot to tell -why- you are considering it as one of the best
ones. IMHO, its best feature is that it is user-programmable. It uses
a text file, which contains a database of scan strings. The scan
strings can contain wildcards and in fact the wildcard language
supported is rather powerful. For viruses that cannot be detected with
a scan string (i.e., the polymorphic viruses), it supports the
so-called AVR modules - small assembly-language programs that
implement algorithmic search for these viruses and are loaded at
runtime.

In fact, TbScan contains only the scanning engine; the virus-specific
stuff is provided additionally. The most popular eternal database of
virus signatures is supported by Jan Terpstra.

TbScan is also extremely fast and uses some tricks to speed up the
scanning. For instance, it traces the entry point of the files, until
it reaches a place where the virus should reside and then scans only
this place, thus reducing the disk access significantly.
Unfortunately, it sometimes tries to be too smart and can skip the
place where the virus signature begins. That's why I personally prefer
HTScan, which can use the same format of the signature database and
the same AVR modules, but instead of smart tricks just plainly scans
the whole file. Indeed, I think that there is an option to make TbScan
to scan the whole file.

As far as I know, the latest version of TbScan is 4.3.

> TBScan is shareware, and can be uploaded from several BBS's. For the
> most recent version, call the 'data'-phone number (all baudrates).

More important for the readers of this newsgroup is that it is
available for anonymous ftp from Simtel20 and its mirrors, in the
MSDOS.TROJAN-PRO directory.

> TBScan uses identity scanning, but als heuristic scanning. The
> heuristic scanning algorithm is rather new and seems to be (one of)
> the best there is.

The only problem is that you cannot turn it off. Sometimes I need just
to scan for a particular set of strings in many files, and want a
report about what exactly strings have been found which files. I don't
need the report file to be cluttered with information which files are
considered suspicious by the scanner, because some of its heuristics
have fired... In version 4.3 it is possible to turn off the (long)
explanation of each heuristic each time that it is used, but it is
still not possible to disable the heuristics completely.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: spaf@cs.purdue.EDU (Gene Spafford)
Newsgroups: comp.virus
Subject: Tripwire release (UNIX)
Date: 3 Nov 92 22:14:09 GMT

This is to announce the first public release of "Tripwire."

Tripwire is an integrity-monitor for Unix systems.  It uses several
checksum/signature routines to detect changes to files, as well as
monitoring selected items of system-maintained information.  The
system also monitors for changes in permissions, links, and sizes of
files and directories.  It can be made to detect additions or
deletions of files from watched directories.

The configuration of Tripwire is such that the system/security
administrator can easily specify files and directories to be monitored
or to be excluded from monitoring, and to specify files which are
allowed limited changes without generating a warning.  Tripwire can
also be configured with customized signature routines for
site-specific checks.

Tripwire, once installed on a clean system, can detect changes from
intruder activity, unauthorized modification of files to introduce
backdoor or logic-bomb code, (if any were to exist) virus activity in
the Unix environment.

Tripwire is provided as source code with documentation.  The system,
as delivered, performs no changes to system files and does not require
root privilege to run (in the general case).  The code has been
beta-tested in a form close to that of this release at over 100 sites
world-wide.  Tripwire should work on almost any version of Unix, from
Xenix on 80386-based machines to Cray and ETA-10 supercomputers.

Tripwire may be used without charge, but it may not be sold or
modified for sale.   Tripwire was written as a project under the
auspices of the COAST Project at Purdue University.  The primary
author was Gene Kim, with the aid and under the direction of Gene
Spafford (COAST director).

Copies of the Tripwire distribution may be ftp'd from
ftp.cs.purdue.edu from the directory pub/spaf/COAST/Tripwire.  The
distribution is available as a compressed tar file, and as
uncompressed shar kits.  The shar kit form of Tripwire version 1.0
will also be posted to comp.sources.unix on the Usenet.  No mailserver
access currently exists for distribution, although we expect some
archive sites with such mechanisms will eventually provide access.

Questions, comments, complaints, bugfixes, etc may be directed to:
genek@mentor.cc.purdue.edu (Gene Kim)
spaf@cs.purdue.edu (Gene Spafford)

3 November 1992

[Moderator's note: Did you choose that date on purpose, Spaf?  Some
VIRUS-L readers may remember the historical significance of November
3rd...]

- -- 
Gene Spafford
Software Engineering Research Center & Dept. of Computer Sciences
Purdue University, W. Lafayette IN 47907-1398
Internet:  spaf@cs.purdue.edu	phone:  (317) 494-7825
From: ACPS7115@RYEVM.RYERSON.CA (Mind Your Own Business!!!!)
Newsgroups: comp.virus
Subject: PS-MPC, similar to VCL (PC)
Date: 6 Nov 92 21:27:13 GMT

I have come across the Phalcon/Skism Mass-Produced Code Generator.
Here is a bit of info on what it can do.

 1) like VCL in design but no IDE.
 2) Over 150 encryption techniques.
 3) Creates compact commented code (ASM)
 4) COM/EXE infections, option to exclude command.com
 5) Both Resident and non-resident viruses
 6) Two type of traversal for non-resident viruses
 7) Three types of high memory residency routines for TSR's
 8) Optinal Critical error handling routines (external)
 9) variable activation dates

So far the creation rate is about 80% (only small modifications to the
20%) There is now destructive code in the generator, but anyone with
simple ASM knowledge can add them.

Q: does McAFEE, for Frisk, have a scan string for the viruses made buy
   the MPC?
From: u554835@csi.uottawa.ca (Fadi Kachi - President.)
Newsgroups: comp.virus
Subject: Help. Needs info about computer viruses.
Date: 8 Nov 92 18:05:14 GMT

HI.
This my first post to COMP.VIRUS.

I am a third student at the University of Ottawa (Ontario, Canada).

I am writing a project on Computer viruses. The project should include
information on some kinds of viruses, and the packages available to
cure them.  The information I have is very limited. I would appreciate
if anyone who reads this post, can send me some information, and
guidelines.

I 'll take anything, articles, posts, suggestions ...

Please send the information either through comp.virus or  reply to me  
directly. Thank you in advance.

Please do it as soon as possible.
					FADI KACHI
					COMP. SCIENCE.
					UNIV. OF OTTAWA
					OTTAWA, CANADA.
From: TAWED@etsu.bitnet (ed street)
Newsgroups: comp.virus
Subject: help on finding a book......
Date: 11 Nov 92 02:32:33 GMT

Hello again this time I'm looking for a well known book, but a rare to
get book (according to the local bookstores)..  The name of this book
is "The Complete Computer Virus Handbook" and the "Computer Virus
Handbook" both is (I believe) about $100.00 each (or there about)..

I was wondering how I can get my own copy of these hard to find books?????

thanks
ed;
From: millernw@craft.camp.clarkson.edu (Neal Miller)
Newsgroups: comp.virus
Subject: Where to find VSUMX (PC)
Date: 3 Nov 92 17:15:39 GMT


	Until I received a disk error this morning, I had a copy of a
VERY nice database of virus info in hypertext format.  It appeared
very complete and was well written.  I've been tromping all over
wuarchives trying to find it again without any luck.  If anyone could
post/mail a sitename (number) and directory, I'd appreciate it.

 - Neal Miller

- --
- -----------------------------------------------------------------------------
 Neal Miller         | "Why not go mad?"  | millernw@craft.camp.clarkson.edu
 Clarkson University |     - Ford Prefect |     dark@craft.camp.clarkson.edu
- -----------------------------------------------------------------------------
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: Michelangelo (PC)
Date: 11 Nov 92 08:58:52 GMT

Hello Brian C. Boorman,
In article <0013.9211101943.AA07075@barnabas.cert.org> you write:
>Does anyone know how Michelanelo is transmitted.  We have a serious
>problem at this institution with it's spread.
>
>Basically my question is this: We know that it can transmit via a
>5-1/4 disk in the A drive of a PC, but can it infect the boot sector
>of a 3-1/2 floppy in the B drive?

The Michelangelo virus is spread by booting from an infected floppy
diskette.  When the infected floppy is booted from, the virus code is
loaded and executed by the computer.  The virus is now installed in
memory and will monitor the system for disk accesses.  When a disk
access occurs, the virus checks the disk to see if its infected, and
if not, infects the disk (network drives, Stacker compressed volumes,
and other media which are accessed through a device driver are not
affected).  I recall that the first copy of the virus we saw did not
infect the second disk drive, however, a later version (February or
March of this year?) infects both floppy drives.

Regards,

Aryeh Goretsky
Technical Support
- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: Re: SCAN 95b doesn't find MtE in EXE files (PC)
Date: 3 Nov 92 20:31:09 GMT

Stefano Turci writes:
[after converting MtE infected COM files to EXEs and then LZEXE'd them]
>The results were a bit strange, in fact:
>    F-prot 2.05
>    Scan 97
>    VirX 2.4
>missed *ALL* the converted files, while
>    Gobbler 2.99 beta 5
>    TbScan 4.3
>got each infected file.

>The viruses in the files missed by F-prot, Scan and VirX in the .EXE
>form were all found out by the same programs in the original .COM
>version.

>I have personally tried to infect a COM file starting from a .EXE
>converted file and the infection was made correctly, that is the
>converted files are still able to propagate the virus, so I think the
>authors of the "missing-in- action" programs should improve their a-v
>packages. 8-)

These results are not surprising nor should they be alarming.  There's
a ever going argument in the anti-virus field relating to the premise
that anti-virus software must be able to detect every absolute
infected file.  The opposing side argues that it is not necessary to
detect such files as those above (or specific files found in some
reviewers' collections) which do not create children of the same form.

The argument for the second opinion says that if you detect the
infected form of the children, you will know if something is going on
in the computer.  Once something is known to be affecting the
computer, theories related to integrity checking can take over.  Files
such as those created above and certain files in reviewers'
collections cannot spread in that convoluted form and need not worry
endusers.  (A version of this argument applies to whether it is
necessary to detect absolutely 100% of MtE mutations, i.e.  integrity
checking takes over.)

It should be the form that propagates that we worry about.  And though
you didn't note it, I'm sure all the files infected by your creations
were detected by all the packages above.  Thus end-users need not
worry about your peculiar forms of MtE files because you're not going
to put those files on anyone else's computer.  :-)

Jimmy Kuo                                       cjkuo@ccmail.norton.com
Norton AntiVirus Research
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: SCAN 95b doesn't find MtE in EXE files (PC)
Date: 4 Nov 92 11:27:52 GMT

Stefano_Turci@f0.n462.z9.virnet.bad.se (Stefano Turci) writes:

> I hope you'll be able to read this message, I never wrote in this area
> before.

You did fine; I was able to read your message. A very interesting one,
BTW!

> Do you know LZEXE ?

[stuff deleted]

> Well, I converted the files from COM to EXE, and made some scanning
> tests with the mentioned programs.

Ha, yes, indeed, that's interesting. It's similar to using PKLite or
LZEXE, or one of the dozen other compressors to hide the initial
infected file. Of course, all replicants will be detected correctly,
but if the dropper (because what you did is to create droppers) will
remain undetected and continue to spread the infection...

>     Gobbler 2.99 beta 5
>     TbScan 4.3

> got each infected file.

I find this hard to believe... Did you try Gobbler with unencrypted
replicants of CryptLab? Did you try TbScan with unencrypted replicants
of Fear? Those scanners are usually missing these viruses...

> I have personally tried to infect a COM file starting from a .EXE
> converted file and the infection was made correctly, that is the
> converted files are still able to propagate the virus, so I think the
> authors of the "missing-in- action" programs should improve their a-v
> packages. 8-)

I agree with you. There is no reason why scanners that claim to be
able to scan inside PKLited and LZEXEd files (and SCAN, F-Prot, and
VirX do claim to be able to do so; F-Prot even scans inside files
compressed with other compressors) should be unable to scan inside COM
files converted to EXE format...

> Well, I'm trying to write my own Mte detector.

If you do, we'll be glad to test it here.

> I run it on a high number of files infected with two Mte-based viruses
> ( Dedicated and Pogue) and it is able to detect all of the infected
> files, but how could I say if it will work for *EVERY* mutation and
> for *EVERY* Mte-based virus ?

> I think it's impossible.

You are right, it's impossible. That's why, our tests can only prove
that a scanner is NOT able to detect the MtE-based viruses reliably.
Otherwise we can only say that we have been unable to find an MtE
replicant that the scanner does not detect.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Denning Key Registration Virus
Date: 12 Nov 92 09:22:30 GMT

Grant@DOCKMASTER.NCSC.MIL (Lynn R Grant) writes:

> This is sort of like the IBM XMAS virus, but it doesn't take any code.
> All you have to do is post a highly controversial item on a well-read
> forum, and wait for the responses to bring the network to its knees.

:-). Yeah, but it must also be a non-moderated newsgroup, like
sci.crypt, or sci.math, otherwise the moderator might spoil you the
pleasure... :-))

Regards,
Vesselin

P.S. Since I am wasting the bandwidth anyway... If shu@rascal.uucp
reads this - I am receiving your messages, but am unable to reply -
the mail bounces. Please supply a better reply path, possibly
involving one of the gateways to uucp in South Africa.
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: GREVE@WILMA.WHARTON.UPENN.EDU (Michael Greve)
Newsgroups: comp.virus
Subject: Cansu Attack! (PC)
Date: 10 Nov 92 14:59:50 GMT


     We're getting hit by the CANSU virus here at Wharton.  I'd like
  to get any information on this virus.  What it does, how it's spread
  etc.  What is the best way of removing it from both a hard drive and
  floppy?  We especially need a quick, easy way of removing it from
  floppies.   Also, is there a FTP site that has a document(s)
  detailing every PC virus known and how they're spread, what they 
  infect and how to get rid of them.  I downloaded a text file
  detailing all known PC viruses about 4 years ago but forgot where
  I got it from.    Thanks for any assistance.

						Michael

 ************************************************************************
 * Michael Greve                           Academic Technology Services *
 * greve@wharton.upenn.edu                      The Wharton School      * 
 ************************************************************************
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Checking high memory with VSCAN (PC)
Date: 4 Nov 92 10:47:09 GMT

padgett@tccslr.dnet.mmc.com (A. Padgett Peterson) writes:

> >Till now, there are no known viruses that use the last two methods.
> >Since the known-virus scanner can detect only known viruses, it is
> >obviously useless to check places in memory where no known virus can
> >reside.

> Sorry to niggle but must point out that the above refers to MS-DOS
> (and its close family) only.

Well, yes, that's why there is a "(PC)" in the subject line... :-)

> More specifically to an Intel based
> system (PC) in REAL mode. Once operating in PROTECTED mode or with
> virtual DOS boxes, all bets are off. I point this out only so that
> people running Windows do not do a memory-only SCAN from a DOS box and
> possibly miss an infection in another. If you are going to run from
> Windows, it is best to check the programs on disk as well.

Correct, I have several times posted messages about the difficulties
to scan "the whole memory" under Windows in protected more... In fact,
it is still possible to do it there - by switching back and forth
between protected and real mode, but under OS/2 all bets are off...

> Vesselin is correct that no known virus (though I'm not sure about that
> new Windows specific one - haven't seen it) exploits this though I
> am sure that it is just a matter of time.

The only Windows-specific virus that we know is not memory resident...
:-) As you can see, the virus writers have solved the problem in the
easiest way... :-)

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: tck@fold.ucsd.edu (Kevin Marcus)
Newsgroups: comp.virus
Subject: Re: Comment on the MtE wars (PC)
Date: 9 Nov 92 23:25:59 GMT

Hmm.  MtE detection is difficult, but there are a few things that one
can look out for in order to help you get a staart if you are writing
an MtE detector, without having "big labs" and stuff.
 
One, as someone kindly pointed out at one time, I forgot where I saw
it, but the MtE can only generate certain code.  It can't generate a
variety of instructions, and any program which begins with these
instructions cannot possibly be infected.
 
Two, the MtE always has certain markers.  For example, the end of the
decrypting algorythm always ends with JNZ.
 
If you have a disasssembler, or even debug, you can spend a few hours
and figure out how to take care of a variety of infections.
From: dluckma3@mach1.wlu.ca (david luckman 9209 U)
Newsgroups: comp.virus
Subject: What kind is it? (PC)
Date: 11 Nov 92 08:50:28 GMT

Either I have a virus or I'm just paranoid (or both I suppose).  I've
had trouble recently with my computer locking up on me for pretty well
no reason, it often happens while running Windows (but usually at
different times in it's run) and Escape from Wolfienstien 3-D, (of
course that could also be because these are the two things that I am
most often running) Can anyone suggest a scanner other than FProt or
McFee's Scan? I've tried The most recent versions of these that I
can find but no luck.

Thanks,

		Dave