HDTenEightyP/NetNews huggingface dataset:
From: CHESS@YKTVMV.BITNET (David.M.Chess)
Newsgroups: comp.virus
Subject: Re: IBM Anti-virus Service (PC)
Date: 10 Apr 92 15:19:46 GMT

>From:    bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)

>Or am I mistaken and the programs made generally available? Dave?
>Donny?

As Ian's posting said, people who buy into the U.S. Anti-virus Service
Offering get access to all the internal stuff.  We don't sell the
software by itself (so it's not exactly "generally available"), but
people who buy the offering get to use it (along with the education,
documentation, support, and so on).

Ian posted a basically-official announcement of the Offering, so you
can pretty much assume that it's accurate, and not just one person
talking...

DC
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: help - green catepillar! (PC)
Date: 9 Apr 92 18:56:22 GMT

hurd@sfu.ca (Peter L. Hurd) writes:

> Howdy, I just noticed one of those dreaded anonymous posters appeared
> on our departmental mailboxes.  Found GReen Catepillar virus.  Scan
> 86B (I think) I'm running doesn't include it in the virus list, and
> F-prot says it isn't analyzed (what does this mean). Anyway since my
> PC has been running ominously slowly of late I thought I'd panic.
> What scans for Green Catepillar?, What removes it?

SCAN -does- detect it. It calls it 1575 / 1591 [15xx] (arrgh, when
shal we standartize all those silly names...). The latest version
(89-B) claims to be able to remove it, but I haven't verified that.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Boot Record Disinfection (DOS) (PC)
Date: 13 Apr 92 10:09:15 GMT

padgett@tccslr.dnet.mmc.com (A. Padgett Peterson) writes:

> The problem is that while it can handle all OSs that I have seen, samples
> are needed of the "off-brands" to ensure compatability. In particular,
> I need the European "ERS" and "P16" variants (the first hidden file is
> called ERSBIO.COM for the first and P16BIO.COM for the second. I do not
> know if there is more than one variant of each or what DOS # they are
> analogous to.

Where did you get the information about the P16BIO?!! I thought that
currently only Fridrik Skulason knows about it... Anyway, FYI: P16 is
a Bulgarian version of PC-DOS 3.1. The name comes from "Pravetz-16" -
the name of the Bulgarian IBM XT clone. Essentially the OS is just an
illegal hack - with IBM's copyright messages replaced... Otherwise
it's perfectly equivalent to PC-DOS 3.1. In Bulgaria there was even a
rumor that IBM or Microsoft actually sued the producers of the hacked
OS and even won the case, but I don't believe that...

Unfortunately, this OS is no more used and I don't have copies of
it... Anyway, I'll forward your request to Bulgaria and will try to
find you a copy.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: HARALAAG@UCBEH.SAN.UC.EDU
Newsgroups: comp.virus
Subject: Re: Vshield vs Word (PC)
Date: 3 Apr 92 19:17:00 GMT
Organization: Lehigh University

RICHARDS@NRCBSC.NRC.CA writes:
> We are running VSHIELD (4.8 B86) on 386's in an area of shared
> computers (free access to all staff).  It is run as VSHIELD
> /chkhi/m/lh.

 In our computer lab we run 386SX computers, MS-DOS 5.0 and with same
version of VSHIELD without using of any switches and MS WORD work just
fine.

 Try to change the VSHIELD options - may be it will help?

Alexandre G. Haralampiev
Department of Geology
University of Cincinnati
From: UMEEB37@VAXA.CC.IMPERIAL.AC.UK (Olivier M.J. Crepin-Leblond)
Newsgroups: comp.virus
Subject: Re: Origins of viruses (ie: Elk Cloner - Apple ][)
Date: 3 Apr 92 09:05:00 GMT
Organization: Lehigh University

Vesselin Bontchev mentions the Elk Cloner running on the Apple ][ in
1981. Although I have never been in contact with the aforementioned
virus (or was it a worm ?), I can confirm that I have been informed
about the virus through different independent sources. They say
rumours are usually unfounded, but in this case, I tend to believe
them.  Oh yes, that was in 1984.

Olivier M.J. Crepin-Leblond, Comms. Sys. & Sig. Proc, Elec. Eng. Dept.,
  Imperial College of Science, Technology and Medicine, London, UK.
From: pl0129@mail.psi.net (Albert M. Berg)
Newsgroups: comp.virus
Subject: BLUESTREAK/NSA/ARCNET ?? (PC)
Date: 10 Apr 92 19:37:21 GMT

Novell periodically issues files called FYIs full of assorted technical
info culled from their tech support department.  These files are
distributed on CompuServe in the NOVLIB section.  The latest file
(FYI192.ZIP) contained an interesting virus related report.

A client had an ARCNET LAN and users could not log in properly.  NETSCAN
was run and JERU-B was found.  So far, so good.  However, to quote the
bulletin:

"...only problem was it was a strain that they had not seen before.
They had a guy from the NSA from the federal government look at it.  He
ran a program called BLUESTREAK.  This is a virus detection program
developed by the government.  It identified the strain of the Jerusalem
B called the Jerusalem DC virus."

The bulletin goes on to say that the JERU-DC virus "attacked the O/S in
such a way that all node addresses were disabled."  (Each node in an
ARCNet LAN has a node address which is usually set in hardware)  The
user had to reset all of the node addresses to get the LAN working.  The
virus also "attacked the Ethernet side of their LAN" in an unspecified way.

Finally, the bulletin says:

"Apparently a lot of these viruses redirect info in order to attach
garbage on to executable files by hooking two software ints.  BLUESTREAK
looks to see what is hooking these two interrupts and checks to see if
it is hardcoded in the applications software.  If not then it determines
that it's a virus."

The Novell document ID on this gem is "FYI.P.9581" and it was dated
"27NOV90" (why is it appearing in the 0292NET.TXT file (Feb 92) in the
current (1st qtr 92) FYI collection?)

I am checking with Novell to see what I can find out.  In the mean time,
Does BLUESTREAK ring a bell with anyone?

- -----------------------------------------------------------------------------
Al Berg - Director of Technical Services - CNE
NETLAN, Inc. - 29 W 38th Street - NYC, NY  10018 - 212/768-2273
All opinions expressed herein are mine alone - my employers are not foolish
enough to share them!
From: pjs@mulga.cs.mu.oz.au (Peter Stuckey)
Newsgroups: comp.virus
Subject: Re Protection from Boot Sector Viruses (PC)
Date: 2 Apr 92 02:16:53 GMT
Organization: Lehigh University

POSTED for Roger Riordan
- ---------------------------------

 bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
writes:

>pjs@mulga.cs.mu.oz.au (Peter Stuckey) writes:

Peter Stuckey didn't write anything.  He merely acted as postman for
me.  (We are trying to arrange access to the network in our own right
but the relevant authorities seem to be hiding from us at the moment.)

I won't answer Vesselins comments in detail, except to re-iterate
my statement;

   "IF you replace any boot sector VET does not recognise on any
    new disk, or any disk that has been in anyone elses PC, you
    CANNOT get a pure boot sector virus."

I did not explain that our documentation says that if you get any
valuable software from anyone else the first thing you should do
is to check if the disks are write protected, and if not write
protect them. Then check them, & if VET does not like the boot
sector (or finds a virus) copy the files to a clean disk & check
(& disinfect) that.  This way you won't destroy anything valuable,
& if a disk is infected you still have the evidence, & can't be
accused of infecting it yourself.

A lot of viruses arrive on shrink wrapped disks, etc, but a lot
more (especially the ubiquitous BS ones) are caught from
"harmless" data disks, usually by people who "never boot from
floppies".

Many of us are so busy thinking of obscure holes in each others
products that we overlook the fact that 99% of viral incidents
involve a few well known & readily detectable & removable
viruses.  It is nice thinking of ways of preventing exotic
attacks, but meanwhile our PCs are being overrun with Stoned, M,
& similar trivia.

I fully agree that no system is foolproof, and we never claim so
in our advertisements, but keeping viruses out is very largely
good housekeeping, and almost any scanner will detect the vast
majority of actual virus attacks. Furthermore a scanner is the
only form of defence that will detect viruses before they have
any chance do anything to your system.

Assuredly someone has to be hit by a new virus before the
scanners can find it, but refusing to use a scanner because it is
not 100% secure is like refusing to use a condom because they
sometimes have holes in them, or may burst.

Integrity checkers provide a valuable second line of defence, but
they are not entirely reliable unless the user can be persuaded
to boot from a clean DOS disk, and experience has shown that they
do not work well in the hands of unskilled users.

Relying entirely on an integrity checker is akin to relying on
blood checks to protect yourself against AIDs.  Granted they will
usually detect viruses before they do any damage, but are you
prepared to stake your life on it?

Roger Riordan                              PH:  +61-3 521-0655
CYBEC Pty Ltd                              Fax: +61-3 521-0727
PO Box 82, Hampton Vic 3187, AUSTRALIA.
From: pjs@mulga.cs.mu.oz.au (Peter Stuckey)
Newsgroups: comp.virus
Subject: VET and INT13 (PC)
Date: 2 Apr 92 02:18:59 GMT
Organization: Lehigh University

Posted for Roger Riordan
- -------------------------------

 ether@bencd.gedlab.allied.com (Russ Ether) writes

>For each PC, determine where is the ROM code which services
>int13 to load the MBR into memory during the boot process.  Then
>use that code in your VET program instead of calling INT13 to read
>the MBR.  i.e:

Thanks for the suggestion, but every time we try any trick like this
we can guarantee a flood of support calls from users with obscure
versions of BIOS, DOS, disk managers, hardware, etc, etc.

eg  You can retrieve the path & program name from the environment
    under DOS 3 or above, right?  (Duncan; Advanced MSDOS, says
    so, while Hogan; The Programmers PC SourceBook, asserts this
    applies to DOS 2 up.)

    Not on some Epsons running DOS 3.1 to my certain knowledge.

With things like Stacker, etc, around we will be very wary of doing
any more delving in the hardware.  If a virus crashes on 30 (or even
50)% of PCs it will still propagate happily, but if our program
crashes on one PC in 1000 we will get complaints about it.

Roger Riordan                              PH:  +61-3 521-0655
CYBEC Pty Ltd                              Fax: +61-3 521-0727
PO Box 82, Hampton Vic 3187, AUSTRALIA.
From: tck@netlink.cts.com (Kevin Marcus)
Newsgroups: comp.virus
Subject: VDS... (PC)
Date: 12 Apr 92 03:51:49 GMT

Tyetiser@ssw02.ab.umd.edu writes:

> We do not scan memory at all!

Well, I hope that you use some method to make sure there are no
viruses present in memory at the time of scanning, or you are going to
make a real big mess with any fast virus that happens to be memory
resident.  If, for example, Dark Avenger were in memory and you
started examining files, they're all gunna be infected.
- --
INTERNET:  tck@netlink.cts.com (Kevin Marcus)
UUCP:   ...!nosc!ryptyde!netlink!tck
NetLink Online Communications * Public Access in San Diego, CA (619) 435-6181
From: pjs@mulga.cs.mu.oz.au (Peter Stuckey)
Newsgroups: comp.virus
Subject: Norton quote (PC)
Date: 2 Apr 92 02:14:39 GMT
Organization: Lehgh University
 ath: s4mjsowestmark!mole-end!uunet!uunet!usc!rutgers!netnews.upenn.edu!netnews.cc.lehgh.edu!root

POSTED for Roger Riordan
- rsr@garnet.berkeley.edu (Roger Rosenblum) asks

>Yikes! Is that quote really attributable to Peter Norton?  If
>so, does anyone know where, when, or in what context he said it?

Peter Norton visited Australia in early 1990 (Jan or Feb if my memory
is correct), and gave a public talk at Melbourne University.  I asked
him if his firm was planning to do anything about viruses.  He
launched into a tirade about urban myths, starting with the story
about crocodiles in the NY sewers, and going on to a story going
around in his youth about a girl with a beehive hairdo.  A spider
built its' nest in it, then bit her & she died.

From the vehemence and length of his answer I am sure he had given it
many times before.

Roger Riordan              PH: +61-3 521-0655  Fax: +61-3 521-0727
CYBEC Pty Ltd
PO Box 82, Hampton Vic 3187, AUSTRALIA.
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: FP-203A.ZIP - Virus detection/removal/prevention/information
Date: 5 Apr 92 17:33:06 GMT
Organization: Lehigh University

I have uploaded to SIMTEL20:

pd1:<msdos.trojan-pro>
FP-203A.ZIP     Virus detection/removal/prevention/information

The only change between 2.03 and 2.03A is a fix for a very minor bug -
the heuristic analysis module in F-PROT.EXE thought (incorrectly) that
VIRSTOP.EXE was using some suspicious techniques.

frisk
- - -
Fridrik Skulason
frisk@complex.is
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Increasing CBCS Security (PC)
Date: 9 Apr 92 19:12:08 GMT

Toria@cup.portal.com writes:

> >virus (so the scanners won't catch it, and if he's clever enough,
> >he'll avoid the heuristic analyser of F-Prot too), a clever tunnelling
> >virus (so that it will be able to bypass a monitoring program) and a

> What do you exactly mean by a "tunnelling" virus?

Ooops, mea culpa, I should have supplied this to the FAQ list...
Anyway, here is the answer:

Most monitoring programs stay resident in memory, intercept some
interrupts and DOS functions and monitor them for dangerous activities
(like modification of an executable file and so on). However, due to
the total lack of memory protection under MS-DOS, a clever virus is
able to disable the monitoring program if it detects it in memory, or
even invoce the "dangerous" functions in a way that cannot be
intercepted (e.g., using CALLs to the ROM BIOS). Virus which are able
to do this are called "tunnelling", since they are able to bypass the
monitoring programs just as the electrons are able to bypass an
energetic barrier (the "tunnelling effect"). If correctly implemented,
these techniques are able to bypass -any- monitoring program, and
therefore the monitoring programs (like FliShot+) are the weakest
line in the anti-virus defense (even weaker than the scanners).

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: CHESS@YKTVMV.BITNET (David.M.Chess)
Newsgroups: comp.virus
Subject: re: OS/2 anti-virus programs (OS/2)
Date: 10 Apr 92 15:16:51 GMT

>From:    DTM102@psuvm.psu.edu
>
>write me back if you know of any programs that run on OS/2, and where
>I can get them.

IBM's Virus Scanning Program runs under both DOS and OS/2.  It's
non-trivial for indivuals to get at the moment; if you have access to
Promenade or IBMLINK, it's there.  Or ask your local IBM Marketing Rep
or Branch Office.  I think S&S's programs also have an OS/2 version
now.

But most anti-virus programs ought to work in the DOS compatability
box of OS/2, I'd think.  Did F-PROT not work there?

DC
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Introduction to the Anti-viral archives listing of 01 April 1991
Date: 9 Apr 92 19:34:04 GMT

jwright@cfht.hawaii.edu (Jim Wright) writes:

> Introduction to the Anti-viral archives	listing of 01 April 1991

Ha-hem... Not to be picky, but isn't the above a little bit outdated
(with one year)? Or is it just a typo?

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: reuter@venice.sedd.trw.com (Joseph Reuter)
Newsgroups: comp.virus
Subject: Re: Microsoft Word 5.0 Installation Instructions (Mac)
Date: 27 Mar 92 17:33:55 GMT
Organization: Lehigh University

Whenever the installation instructions require me to turn off Gatekeeper, I
first check the floppies with Disinfectant, then check my hard disk, THEN
I turn off Gatekeeper.  It may not be perfect, but at least I FEEL secure.
I highly recommend this practice.

According to my copy of Gatekeeper, it can be configured to allow the
Apple Installer to operate without interference.  Maybe in the light of
the above Microsoft problem, Installer should be included in the standard
configuration of Gatekeeper.
- - --
Joseph A. Reuter
Speaking for myself from reuter@venice.sedd.trw.com
From: RCTE4@Jetson.UH.EDU
Newsgroups: comp.virus
Subject: Post March 6 Michelangelo Infections (PC)
Date: 3 Apr 92 03:17:00 GMT
Organization: Lehigh University


      YAMP (yet another Michelangelo posting).....

      Re: the discussion of the probability of more Michelangelo infections,
my lab got its first (at least, first known to me) post-March 6 Michelangelo
infection today, April 2, 1992.
      A student put her floppy disk in the A: drive, and THEN obeyed our
signs posted on each PC to "RESET BEFORE USING."  Frisk's Virstop caught it
and prevented the PC from completing the boot, so there was no harm done.
We successfully removed it from the floppy and hard disk using F-prot 202d.

      Now, this is the real reason for posting.  Before cleaning the student's
diskette, I used Diskcopy to copy the virus to another diskette, so I could
look at it (I know, curiosity felled the feline.....).  Took it home, booted
my pc, put the infected diskette in the A: drive (my b: drive is wrong size
for this disk), did a Dir, deleted the student's assignment files, then ran
F-Prot on the A drive.  I had previously confirmed the infection at school
with F-prot.  F-prot said "The Stoned virus search pattern has been found
in memory..."
      My "understanding" was that Mich. would only do anything at boot time.
I reset the PC from the hard disk using ctrl-alt-del, and re-ran F-prot. No
infection on disk or in memory, so I assume whatever was in memory that
triggered f-prot did not infect my hard disk.
      Is this something as simple as Dir copying the boot sector and FAT into
memory and F-prot finding it there, or is there a risk of infection from
(this version of) Michelangelo even after booting?  I also re-booted from
my sanitized and hermetically sealed Dos boot disk and re-scanned the disk. It
was still clean.

      Thanks,   Scot Carpenter
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: MDISK & FDISK - Are they the same? (PC)
Date: 3 Apr 92 00:27:34 GMT
Organization: Lehigh University

Hello David Swayze,

The FDISK program is MS-DOS's utility to partition a hard disk after
low-level formatting or change the sizes of the partiions, etc.
M-DISK is a set of utility programs for replacing the Master Boot
Record (partition table) and DOS Boot Sector code when infected by a
virus.  M-DISK works for MS-DOS (and PC-DOS) 3.00 through 4.01.
MS-DOS 5.00 has it's own built-in "M-DISK" for removing partition
table infectors.  It's the undocumented /MBR switch, which will remove
the existing code in the MBR and replace it with a clean copy from
inside itself, while leaving the data (the actual partition table)
intact.

Regards,

Aryeh Goretsky
McAfee Associates Technical Support
- --
- - - -
McAfee Associates        | Voice (408) 988-3832 | mcafee@netcom.com  (business)
1900 Wyatt Drive, Suite 8| FAX   (408) 970-9727 | "Log... from Blammo"
Santa Clara, California  | BBS   (408) 988-4004 |
95054-1229  USA          | v32bis(408) 988-5190 | CompuServe ID: 76702,1714
ViruScan/CleanUp/VShield | HST   (408) 988-5138 | or GO VIRUSFORUM
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: F-PROT warning: false positive? (PC)
Date: 9 Apr 92 18:51:27 GMT

frisk@complex.is (Fridrik Skulason) writes:

> >>> A related question: f-prot identifies nearly all the Norton Utilities
> >>> programs

> The reason for this is that the programs use OPTLINK, (a linker which
> adds PKLITE-like compression to executables as they are linked).  My
> heuristics did not include a rule to specifically exclude OPTLINK
> (I have rules to exclude PKLITE, LZEXE, DIET, KVETCH, ICE, EXEPACK etc)
> so it detected "highly suspicious self-modifying code" - which,
> strictly speaking is true.  This was fixed in 2.03.

The problem is that it detected them even when I instructed the
instalation program to unpack them. However, I guess that this is
OPTILINK's (or more exactly the unpacker's) problem, not yours... :-)

> This (at least WORD.COM) is a documented false positive - see ANALYSE.DOC.
> I am working on reducing the number of false positives, but I fully agree
> that heuristic analysis should only be used by experienced users....there
> are still some false positives....

How about -scanning- for the known false positives? After all, they
are less than the known viruses... :-)

> I am working on my heuristic analysis - which (and I think nobody in
> the anti-virus community disagrees with me) is able to detect the
> majority of unknown viruses, but it is not perfect - I don't analyse
> boot sectors yet, and I detect only a low percentage of viruses
> written in high-level languages.  However, as I said...the analysis is
> improving.

The problam, I believe, is that a virus writer can -always- fool your
heuristics if he knows them...

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54