HDTenEightyP/NetNews huggingface dataset:
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Re: Virus BBS List?
Date: 28 Jul 92 18:03:26 GMT

brianc@eskimo.celestial.com (Brian C) writes:
>Could someone please e-mail me a list of virus related bbs?

As coincidence would have it, I have just sent out a request on the
Fidonet virus related echoes for information from sysops of antiviral
BBSes.  I do not expect to have most of the info for at least a month.

I am not sure how this list will be maintained, but at the present
time I suspect I will have to keep it separate from the CONTACTS.LST
file.
 
============= 
Vancouver      ROBERTS@decus.ca         | "Kill all: God will know his own."
Institute for  Robert_Slade@sfu.ca      |       - originally spoken by Papal
Research into  rslade@cue.bc.ca         |         Legate Bishop Arnald-Amalric
User           p1@CyberStore.ca         |         of Citeaux, at the siege of
Security       Canada V7K 2G6           |         Beziers, 1209 AD
============= for back issues:
Contacts list: cert.org, /pub/virus-l/docs/reviews
Reviews: cert.org, /pub/virus-l/docs/reviews/pc
Column: cert.org, /pub/virus-l/docs/slade.cvp.articles
           For those without ftp, see Jim Wright's posting, or use Cyberstore. 
           Also FREQ from 1:153/733 The Cage 604-261-2347.
From: gscobie@castle.edinburgh.ac.uk (G J Scobie)
Newsgroups: comp.virus
Subject: Re: Virus discovered in file from WUARCHIVE.WUSTL.EDU (PC)
Date: 28 Jul 92 08:09:03 GMT

> From:    System Manager <system@SCFE.NWC.NAVY.MIL>
> 
> Today I downloaded a file from WUARCHIVE.WUSTL.EDU (one of the
> mirroring ftp sites). Filename is
> /mirrors/garbo.uwasa.fi/screen/grabsc11.zip When I tried to ran
> GRABSCRN.COM from this zip file, Norton Antivirus TSR reported that
> the file is infected with Wonder-2 virus.  F-PROT did not report a
> virus.  I sent mail to the person who maintains garbo.uwasa.fi and
> received an answer that he is out of town till July 27. This means,
> the file will not be tested/removed from garbo until then.  Has anyone
> downloaded this file before ?  What happened ?

Hi there,

Just for your info I have downloaded the above file this morning and
F-PROT 2.04 and Bates v3.37 report the unzipped files as being clean.

I receieved two copies of this digest in my mail this morning - can't
get too much of a good thing I suppose :-)

Cheers

Garry Scobie
EUCS LAN Support
Edinburgh University Computing Service
Scotland
From: mjbrown@magnus.acs.ohio-state.edu (Mike J. Brown)
Newsgroups: comp.virus
Subject: Re: 696/Scr2/Enemy (PC)
Date: 18 Jul 92 04:04:50 GMT



>>  [tale of woe, wrapped up by this, deleted ]
>
>uh-oh... I feel a flame coming on...
>
>[Moderator's note: Please take any flames to another mailing
>list/newsgroup.]

Whoops.  Poor choice of words.  I was referring to the 'tale of woe'
but I think it sounded like I was about to make a flame of my own.

>>So, Mike, you're saying you had a disc full of pirated software, and a
>>virus burned you? Didn't even back it up after you bought it, or clean
>>it off?

He later informed me he didn't intend this as a flame, just "salt in
the wound" sarcasm, which I admit I rightfully deserve.

>Yes.  No.  No.  Seriously intended to do both, but "twas too much trouble"
>or so I thought. 

For those who aren't paying attention,
     *** IT'S NOT TOO MUCH TROUBLE TO MAKE BACKUPS! ***
Take it from someone who learned the hard way (but still hasn't made
his backups -- still trying to assess the damage)

>>Did you ask the seller for the manuals and originals for all that neat
>>stuff on it?
>
>Yes.  The thing is, he got most of his stuff from work.

 (third generation piracy... I truly deserved what I got, I know)
 (do you guys think it's silly to quote and respond to my own article?)

>Both of our systems had problems at the same time.

likely path:  BBS->friend->me
I think the bbs he got it from crashed at the same time our PC's did, too.

Summary on the way...
- -- 
Mike Brown
mjbrown@magnus.acs.ohio-state.edu
"The Universe is a spheroid region 705 meters in diameter."
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: Green Caterpillar (PC)
Date: 18 Jul 92 02:24:14 GMT

I'm having a hard time trying to locate what VSUM calls 1575-D, the
one variant of 1575 which is supposed to show a green caterpillar on
the screen.  I have the following files from various libraries:

NCSA:
!1892.COM (a,1) !4404.COM (b,2) !4405.COM (c,3) !4914.COM (a,1)
!1553.EXE (c,1) !4403.EXE (b,2) !2421.EXE (b,2) !4914.EXE (a,1)
!3314.EXE (b,2) !5646.EXE (c,1)
CERTUS:
!6585CRT.EXE (c,3)      !7345CRT.EXE (b,2)      !6584CRT.COM (c,1)
!7344CRT.COM (b,2)      !7346CRT.COM (c,3)      !7347CRT.COM (a,1)
!7348CRT.COM (a,1)      !7349CRT.COM (a,1)      !7350CRT.COM (b,2)
AVPD:
_1575_B.EXE (b,2)

The (a,1), etc. are the Green Caterpillar variant names from Solomon
and F-Prot.  None are d or 4, unfortunately.

Could someone who knows the various library collections please tell me
which of these samples or any other samples in which libraries
correspond to the VSUM 1575-D variant?

Also, which samples in which libraries correspond to "Loa Duong" and
the "Slayer" family?

Thanks.

Jimmy Kuo                          cjkuo@ccmail.norton.com
Norton AntiVirus Research
From: txl@dbs42.elsegundoca.ncr.com
Newsgroups: comp.virus
Subject: Virus Question re printer, floppy problems (PC)
Date: 28 Jul 92 00:00:16 GMT

Is there any virus that can cause an IBM-compatible to be blind to the
printer (it thinks that an online printer is offline) and to the
changing of floppies (showing previous floppy contents after replacing
a floppy with another with different contents).

Any comment is appreciated.  Thanks a lot.

- -Tuan
From: glauber@ele.puc-rio.br (Glauber Maciel Santos)
Newsgroups: comp.virus
Subject: Re: Bugsres-2 (PC)
Date: 29 Jul 92 16:44:10 GMT

Hello,
	The same thing happened to me when I ran F-Prot.  The program
I have is called BUGRES and it's not a virus.  It's just a program
that tries to simulate a virus by drawing some bugs on the screen.
	That's why F-Prot calls it a joke program.

		Glauber Santos
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Jerusalem virus part 1 (CVP)
Date: 18 Jul 92 19:22:41 GMT

HISVIR3.CVP   920714
 
                   The "Jerusalem" virus - part 1
 
In the MS-DOS world the Stoned virus is currently the most successful
virus in terms of the number of infections (copies or reproductions)
that the virus has produced.  (Boot sector viral programs seem to
have an advantage among microcomputer users.)  Among file infecting
viral programs, however, the Jerusalem virus is the clear winner.  It
has another claim to fame as well.  It almost certainly has the
largest number of variants of any virus program known to date.
 
Initially known as the "Israeli" virus, the version reported by Y.
Radai in early 1988 (also sometimes referred to as "1813" or
Jerusalem-B) tends to be seen as the "central" virus in the family. 
Although it was the first to be very widely disseminated, and was the
first to be "discovered" and publicized, internal examination
suggests that it was, itself, the outcome of previous viral
experiments.  Although one of the oldest viral programs, the
Jerusalem family still defies description, primarily because the
number of variants makes it very difficult to say anything about the
virus for sure.  The "Jerusalem" that you have may not be the same as
the "Jerusalem" of your neighbour.
 
A few things are common to pretty much all of the Jerusalem family. 
They are file, or program, infecting viri, generally adding
themselves to both COM and EXE files.  When an infected file is
executed, the virus "goes resident" in memory, so that it remains
active even after the original infected program is terminated. 
Programs run after the program is resident in memory are infected by
addition of the virus code to the end of the file, with a redirecting
jump added to the beginning of the program.  Most of the family carry
some kind of "date" logic bomb payload, often triggered on Friday the
13th.  Sometimes the logic bomb is simply a message, often it deletes
programs as they are invoked.
 
David Chess has noted that it is a minor wonder the program has
spread as far as it has, given the number of bugs it contains. 
Although it tends to work well with COM files, the differing
structure of EXE files has presented Jerusalem with a number of
problems.  The "original Jerusalem", not content with one infection,
will "reinfect" EXE files again and again so that they continually
grow in size.  (This tends to nullify the advantage that the
programmer built in when he ensured that the file creation date was
"conserved" and unchanged in an infected file.)  Also, EXE programs
which use internal loaders or overlay files tend to be infected "in
the wrong place", and have portions of the original program
overwritten.
 
copyright Robert M. Slade, 1992   HISVIR3.CVP   920714

==============
Vancouver      ROBERTS@decus.ca         | "Don't buy a
Institute for  Robert_Slade@sfu.ca      |     computer."
Research into  rslade@cue.bc.ca         | Jeff Richards'
User           p1@CyberStore.ca         | First Law of
Security       Canada V7K 2G6           | Data Security
From: matrix@valinor.mythical.com (JJ Kahrs)
Newsgroups: comp.virus
Subject: VAX virus list? (VAX/VMS)
Date: 20 Jul 92 05:22:40 GMT

This may be a totally ignorant question...BUT... Does anybody have a list of 
VMS virilli?
                      -JJ Kahrs
- -----
JJ Kahrs
Internet:  matrix@valinor.mythical.com     uucp:  uunet!valinor!matrix
- -----
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Virus Question re printer, floppy problems (PC)
Date: 29 Jul 92 08:13:22 GMT

txl@dbs42.elsegundoca.ncr.com writes:

>Is there any virus that can cause an IBM-compatible to be blind to the
>printer (it thinks that an online printer is offline) and to the
>changing of floppies (showing previous floppy contents after replacing
>a floppy with another with different contents).

Yes. Azusa.

- -frisk
From: lachlan@dmp.csiro.au (Lachlan Cranswick)
Newsgroups: comp.virus
Subject: Re: How do I reverse the effect(s) of Stoned ? (PC)
Date: 28 Jul 92 13:11:45 GMT

berstel@lacim.uqam.ca (Bruno Berstel) writes:

>In brief : I got Stoned and now my hard disk has name D:. How can I correct
>           this ?

>I have bought a modem to some unknown fellow; he gave me a floppy with
>Kermit on it. Well, not just Kermit. Stoned/Marijuana too. Since I'm
>new to the PC world (yes : another Unix/Mac baby -- in fact I grew up
>with MULTICS !), I didn't run no scanner on the infected disk. I woke
>up the day after with my hard disk named D:. Stop me here if there is
>no relation.

>>From what (I understand among what) I have been told by my scanner,
>Stoned sleeps in the boot sector of floppies and attacks hardies, but
>doesn't settle down on them. Of course I've erased it from the floppy
>but the evil had been done.  Not knowning what to do I "temporarily"
>notified to all my software that the hard disk was named D:.

Try the VET anti-viral program, unlike other programs it is very
good at repairing the damage this virus causes as well as cleaning 
the virus of the hard-disk.  Stoned is quite happy to exist on
a hard-disk which it slowly corrupts.  Other anti-viral
programs can wipe the data on the hard-disk by not repairing 
the damage Stoned has  caused.

- -- 
  Lachlan Cranswick  -  CSIRO             _--_|\  lachlan@dmp.CSIRO.AU
  Division of Mineral Products           /      \     +61 3 647 0367
  PO Box 124, Port Melbourne 3207        \_.--._/ 
  AUSTRALIA                                    v
From: HAYES@urvax.urich.edu
Newsgroups: comp.virus
Subject: killmonk.zip available (PC)
Date: 22 Jul 92 18:55:34 GMT

KILLMONK.ZIP by T. Martin is now available from us.  As the name
implies, the program will detect and eradicate the "monkey" virus.

- -----
Site:       urvax.urich.edu, [IP#  141.166.36.6]  (VAX/VMS using Multinet)
Directory:  [anonymous.msdos.antivirus]

FTP to urvax.urich.edu with username anonymous and your email address
as password.  You are in the [anonymous] directory when you connect.
cd msdos.antivirus, and remember to use binary mode for the zip files.
- -----

Best to all, Claude.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Claude Bersano-Hayes     HAYES @ URVAX                 (Vanilla BITNET)
University of Richmond   hayes@urvax.urich.edu     (Bitnet or Internet)
Richmond, VA  23173
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: Common misconception (was: Re: VET as good as Viruscan? (PC))
Date: 29 Jul 92 16:41:56 GMT

mcafee@netcom.com I write:
>(during the October, 1990 earthquake, we were "disconnected from the
>electronic world" for about 36 hours).

Oops, that was October, 1989.  My apologies for any confusion.

Regards,
 
Aryeh Goretsky
McAfee Associates Technical Support
- -- 
- - - -
McAfee Associates        | Voice (408) 988-3832 | mcafee@netcom.com  (business)
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | ObQuote: "Log... from Blammo"
Santa Clara, California  |                      | 
95054-3107  USA          | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
ViruScan/CleanUp/VShield | USR Courier DS 14.4Kb| or GO VIRUSFORUM
From: mebrown@hubcap.clemson.edu (Miriam E Brown)
Newsgroups: comp.virus
Subject: victor charlie (PC)
Date: 21 Jul 92 15:51:05 GMT

Has anyone ever used Victor Charlie and have any opinions?  We are
thinking of using it opposed to McAfee's Scan and Clean.  

thanks
miriam brown pepinsky
(mebrown@hubcap.clemson.edu)
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Common misconception (was: Re: VET as good as Viruscan? (PC))
Date: 28 Jul 92 02:36:31 GMT

AMN@vms.brighton.ac.uk (Anthony Naggs) writes:
<message deleted>
>Oh, while I am being rude about McAfee, any suggestions as to what
>will happen to Viruscan if the "big one" hits LA?

This is a quite common misconception that I would like to clear up.
McAfee Associates is located in Santa Clara, a city at the southern
end of the San Francisco Bay.  We are some 330 miles (530km) north of
Los Angeles, about the distance from London to Luxembourg or Perth to
Rawlinna.

Any geologic activity (flooding, earthquakes, giant radioactive ants
from the bowels of the earth, etc.) affecting Los Angeles is not going
to have any physical impact on the northern portion of California.

In case of an earthquake or other event that leaves us stranded
without power for several days, we do have enough laptops to keep the
programmers working although we will have to shut down our technical
support, customer support, order processing, and other non-essential
(well, lower priority, perhaps) services.  Of course, given that our
communication links (fax, telephone, BBS, internet, postal mail) will
be down as way until the restoration of services, these may not have
as much impatct as you thought.

Oh, we do also have a network of agents both domestic (inside the U.S.
and Canada) and international, so anyone could contact them for
support, etc., but the home office would be down for a day or two
(during the October, 1990 earthquake, we were "disconnected from the
electronic world" for about 36 hours).

Regards,
 
Aryeh Goretsky
McAfee Associates Technical Support

- -- 
- - - -
McAfee Associates        | Voice (408) 988-3832 | mcafee@netcom.com  (business)
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | ObQuote: "Log... from Blammo"
Santa Clara, California  |                      | 
95054-3107  USA          | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
ViruScan/CleanUp/VShield | USR Courier DS 14.4Kb| or GO VIRUSFORUM
From: berstel@lacim.uqam.ca (Bruno Berstel)
Newsgroups: comp.virus
Subject: How do I reverse the effect(s) of Stoned ? (PC)
Date: 22 Jul 92 20:09:50 GMT

Hello,

In brief : I got Stoned and now my hard disk has name D:. How can I correct
           this ?

In detail :

I have an Amstrad PC-1512 with :
        - single DSDD 5''1/4 drive
        - 32Mb hard drive (in fact a FileCard)
        - keyboard, screen, and so on.

I have bought a modem to some unknown fellow; he gave me a floppy with
Kermit on it. Well, not just Kermit. Stoned/Marijuana too. Since I'm
new to the PC world (yes : another Unix/Mac baby -- in fact I grew up
with MULTICS !), I didn't run no scanner on the infected disk. I woke
up the day after with my hard disk named D:. Stop me here if there is
no relation.

>From what (I understand among what) I have been told by my scanner,
Stoned sleeps in the boot sector of floppies and attacks hardies, but
doesn't settle down on them. Of course I've erased it from the floppy
but the evil had been done.  Not knowning what to do I "temporarily"
notified to all my software that the hard disk was named D:.

But now I'm tired of it : some days the hard disk is D:, some days
it's C:.  Now what is the best behaviour to get things normal ? Should
I reformat my hard disk ? Would it be of any good ? If I did, could I
trust the files I'd have backed up before reformatting ?

Any help, comment, suggestion or else will be greatly appreciated.

Bruno.
- -----     -----     -----     -----     -----     -----     -----     -----
Bruno Berstel                                         berstel@lacim.uqam.ca
Laboratoire de Combinatoire et d'Informatique Mathematique       L.A.C.I.M.
Universite du Quebec a Montreal                                    U.Q.A.M.
(Tele)phone : (514) 987-8495                           Fax : (514) 987-8477
- ---------------     ---------------     ---------------     ---------------
                    Noel en hiver, Paques au printemps.
From: Grant@DOCKMASTER.NCSC.MIL (Lynn R Grant)
Newsgroups: comp.virus
Subject: Re: Virus Creation Laboratory (PC)
Date: 28 Jul 92 17:33:30 GMT

>It is interesting to note that Nowhere Man has the gaul to expressly
>forbid any disassembly of his code, or the use of any binary strings
>produced by his program for the purposes of scanning for viruses
>created by the package.  Yah, right, Nowhere Man.  Go ahead, sue me.

I wonder if he could.  I don't believe making a Virus creation
laboratory is illegal (correct me if I'm wrong), though using it
probably is.  In that case, he ought to be able to forbid disassembly
of his code the same way IBM does with their licensed code.  It might
be interesting to watch the court cases where people have tried to
hold gun manufacturers liable for murders committed with their
products.  (To avoid excessive flames and digressions, I won't say
which side I'm on in that issue.)

What would be really interesting is if he waited until a virus created
with his laboratory infected your machine, then sued you for using his
licensed code (the code in the virus) on your machine without a
license.  (Sort of like the kids in my old neighborhood, who would
shovel your sidewalks in the winter without being asked, then knock on
the door and expect you to give them a bunch of money for doing it.)

Lynn Grant
From: slclancy@uci.edu (Steve Clancy)
Newsgroups: comp.virus
Subject: Help with Central Point Anitvirus and FPROT (PC)
Date: 28 Jul 92 23:08:19 GMT

The following was passed along to me by a user of our local BBS.  I
would appreciate any suggestions addressing his particular problem.

- -- Steve Clancy

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
%   Steve Clancy, M.L.S.              %  Wellspring RBBS              %
%   Biomedical Library                %  714-856-7996 300-2400 24hrs  %
%   University of California          %  714-856-5087 300-9600 24hrs  %
%   P.O. Box 19556                    %  slclancy@uci.bitnet          %
%   Irvine, CA 92713  U.S.A.          %  slclancy@uci.edu             %
%.....................................................................%
%     "As long as I'm alive, I figure I'm making a profit"            %
%                                       - John Leas, 1973.            %
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

I have DOS 3.3, a 286 10 MHz with 896K extended memory.
I have Norton Utilities 6.0
Antiviral software that I have:  Central Point Antivirus (CPAV) and
FPROT.

Part of CPAV is a program called VSAFE.  This checks the programs you
try to execute for viruses.  There are also options that will have it
alert the user if something is trying to become resident in memory,
access a disk, format a disk, alter a file, etc.

Lately, whenever I have the General Write Protect option on (when this
is on, VSAFE will sound an alarm if anything is trying to write to a
disk) and then I try running a program, VSAFE commplains that something
is trying to write to the current disk.  I don't know if it's trying to
write to a sector, or if it's using regular file functions.

When using FPROT on Heuristics, it complained that Norton Utilities was
compressed by OPTILINK, and was skipping it.  Those Norton Utilities
program that weren't packed were checked.  FPROT said that these
programs used certain techniques to move around in memory that viruses
usually use.  I don't know if that's important or not, but I'll mention
it just to be safe...

When FPROT (on Heuristics scan) scanned WHERE.COM and DDIR.COM, it said
that there was a virus that remained resident in them.  When I tried
running them (before they were scanned with FPROT) with VSAFE on, there
was no mention that anything was trying to become resident.  (Yes, I did
have VSAFE set to alarm me if something DID try to become resident!)

Anyway, that's really all there is, except that I have WHERE.COM and
DDIR.COM in an archive (.LZH) file.

P.S.,  I just remembered!
Central Point Antivirus' scanner (the thing that checks the program
files and actually removes viruses) has sometimes been complaining that
some program files are SHRINKING.  One of them was CSHOW.EXE (a graphics
viewer).
From: leichter@lrw.com (JERRY LEICHTER)
Newsgroups: comp.virus
Subject: re: VAX virus list? (VAX/VMS)
Date: 21 Jul 92 23:49:51 GMT


	matrix@valinor.mythical.com (JJ Kahrs) asks:
	This may be a totally ignorant question...BUT... Does anybody have a 
	list of VMS virilli?

Lucky him.  I have just such a complete list.  It's right here:

For the humor-impaired: There are no known VMS viruses at this time.
It's worth repeating, of course, that neither VMS nor any system is
inherently immune to viruses; but none have been reported as of today
(and I'd be in a position to hear fairly quickly - certainly within a
couple of days of any public discussion).

There HAVE been some network-related VMS "worms" reported.  These go
back a couple of years and, with the tighter security that's the
default in current versions of VMS, they have not been seen recently.

Virilli?
							-- Jerry
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Scream information? (PC)
Date: 28 Jul 92 08:43:59 GMT

ndecour@spartan.ac.BrockU.CA (Nancy DeCourville) writes:

>Any information on a virus called Scream would be appreciated.

I know of one Scream virus - or "Screaming Fist" as it is also called.
There are at least five variants of it, 692, 696, 711 and 838 bytes
long (and one with a variable length). I have not yet written a
disinfector for the 838 byte variant, but I can handle the others.

As for the effects of the virus, I am not sure - I have only analysed
them minimally.

- -frisk