HDTenEightyP/NetNews huggingface dataset:
From: suresh@papaya.iss.nus.sg (Suresh Thennarangam - Research Scholar)
Newsgroups: comp.virus
Subject: Re: hardware protection against PC viruses (PC)
Date: 1 Sep 92 02:06:46 GMT

barry.fagin@dartmouth.edu (Barry S. Fagin) writes:
>I have recently seen some literature on ViruGuard, a PC expansion card
>that claims to defeat all IBM PC viruses.  Does anybody know anything
>about this?  Is it all it's cracked up to be?  Please reply to this
>account; any help would be much appreciated.  Thanks.

Take a look at the Virus Bulletin Feb 1992, product review on page 24
by Keith Jackson.

FYI: The conclusion reads - ( I quote verbatim)
________________________________________________________________________
CONCLUSIONS 

ViruGuard can detect viruses. It can do this before execution commences 
for about 50% of viruses. It can detect over 90% of viruses when infected
files are allowed to execute, However, the vendor's original claim that
"ViruGuard traps all present and future viruses" is shown to be untrue.
________________________________________________________________________

Regards,
      __
     (_       o_   o  o |_
     __)/(_( _) (_(_ /_)| )_

***************************************************************************
* Suresh Thennarangam               *  EMail: suresh@iss.nus.sg(Internet) *
* Research Scholar                  *         ISSST@NUSVM.BITNET          *
* Institute Of Systems Science      *  Tel:  (065) 772 2588.              *
* National University Of Singapore  *  Facs.: (065) 778 2571          *
* Heng Mui Keng Terrace             *  Telex: ISSNUS RS 39988             *
* Singapore 0511.                   *                                     *
***************************************************************************
From: "a_rubin@dsg4.dse.beckman.com"@BIIVAX.DP.BECKMAN.COM
Newsgroups: comp.virus
Subject: Re: What is the best anti-virus program??? (PC)
Date: 26 Aug 92 20:07:59 GMT

andreas@dutedib.et.tudelft.nl (A.A.Buykx) writes:

>Hello,

>I recently downloaded f-prot.exe and I downloaded earlier virscan. Now my
>question is (I am a novice in *anti* virus programs):
>   Which one of these, or which other program should I use to 
>   protect my beloved computer from being crunched by some virus.

You can try posting on the group comp.virus, and get more responses
than you want, but the quick answer is .... get more than one (except
Central Point, which is incompatible with all other anti-virals).
- --
Arthur L. Rubin: a_rubin@dsg4.dse.beckman.com (work) Beckman Instruments/Brea
216-5888@mcimail.com 70707.453@compuserve.com arthur@pnet01.cts.com (personal)
My opinions are my own, and do not represent those of my employer.
My interaction with our news system is unstable; if you want to be sure I see a
 post, mail it.
From: bryce@sdf.lonestar.org (Bryce Hamm)
Newsgroups: comp.virus
Subject: Re: (c) Brain - part 2 (CVP)
Date: 27 Aug 92 23:38:34 GMT

Well i dont understand.. So then you can (c) virii?  or is that only
in the Middle Eastern countries.. forgive me for the stupid question..
i was just confuesed when you mentioned two brothers Copywrighting
it..

hmm..
From: JSIMPSON%MIAMIU.BITNET@OHSTVMA.ACS.OHIO-STATE.EDU (Joe Simpson)
Newsgroups: comp.virus
Subject: Re: Need Advice on Evaluating and Ordering Antivirus Software (PC)
Date: 20 Aug 92 15:28:26 GMT

We evaluated anti-viral software for MS-DOS.

We used the criteria:
Cost
Distribution off campus (the data doesn't stay on campus).
Frequency and quality of updates (anti-viral programs require
                                  frequent update)
General concerns about the nature of the supplier.
Prophylaxis as well as identification/removal.
"Ease of Use"
Co-existance with dos, windows, networks, various apps.

We ended up liking McAfee's product and Fridrick Skuulassen's product.
Bought f-prot on the basis of ease of distribution off campus.
We think we gave up some technical support by making this decision.
We very much admire McAfee's company and can testify to the support
they have to offer.
From: alvino@Solomon.Technet.sg (Alvin Ong)
Newsgroups: comp.virus
Subject: Request for Recommendations... (PC)
Date: 28 Aug 92 12:29:33 GMT

Dear All,

Can I have your opinions/recommendations for Anti-virus software for
my suite of SPANKING BRAND NEW PCs... I have seen several the likes
of:

	Turbo Anti-virus,
	McAFee, and
	Untouchable.

Can I have your thoughts for the above. Else, if anyone has got a
better suggestion, I'd love to hear it.

Thanks in advance

Regards,

Alvino...
From: ede890psft@vx24.cc.monash.edu.au
Newsgroups: comp.virus
Subject: Possible Virus Infection - info pls (PC)
Date: 24 Aug 92 12:57:06 GMT

Readers,

I am not sure whether this is an occurrence of a virus, but it does
 seem strange.

On Sunday, 23/8/92 (not US date format folks), a young 11 y.o. friend
 called me and asked me for my advice.  He owns a clone 286 PC and was
 attempting to copy a file from a floppy to the hard disk.  When using
 the copy command, the machine would hang.

Earle (your author), being a smarty, said, no worries.  I obtained their
 DOS disk, write protected, and did a file compare between the
 COMMAND.COM on the DOS disk and the hard disk.  The two files were
 the same size but contained different info.  I did not retain the
 comparison or the old COMMAND.COM.  

Other problems experienced at the same time:-
- -	files and directories have disappeared.
- -	SCAN 80(?) reports no virus (I know, it is an old version but
 I didn't have my toolkit with me).

I have quarantined the machine and post this for thoughts, requests,
 advice ....

The problem seems!! to have stopped but I think that the solution was
 too easy.

Earle ORENSTEIN
Student Nbr 11188707
GR Dip Comp
Monash University Faculty of Computing
ede890@mings3.cc.monash.edu.au
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: CPAV and Windows (PC)
Date: 26 Aug 92 20:13:39 GMT

Cleaning out the desk today.  :-)

The rumours of parts of Central Point's Anti Virus being included with
the next release of MS-DOS, discussed here previously, would seem to
be confirmed by now.  This prompted, in my mind, the possibility that
Windows would have some such capability in its next release as well.

This was brought home to me as I tried to install the Logo computer
language on a machine recently.  I was installing two versions, one
for DOS and one for Windows (both based upon the LSRHS version.)  Both
versions contained files named LOGO.EXE.  For reasons of the path and
environment requirements of the files, they were extracted into
different directories, and the Windows version copied into the main
directory as WLOGO.EXE.

In attempting to install the program within Windows, both LOGO.EXE
files were found, even though one was not a Windows program.  Both
files prompted an alert window from CPAV.  Neither program was
identified by the full path name.  The filename alone was given.  It
is reasonable that a "new" file should be flagged by change detection.
However, the WLOGO.EXE file never generated an alert.

The alert generated was very terse.  It simply stated that the file
LOGO.EXE had changed.  It did not indicate that this was a new file.
The only options were "OK" and "Cancel".  "OK" what?  OK to kill the
file?  "cancel" my Windows session completely?  OK appeared to let the
Windows installation procedure proceed.  However, sometimes (I tried
the installation more than once) the CPAV window was not removed.
Activity "behind" it would "show through", but the original screen was
not redrawn.  Although the "OK" allowed the operation to proceed,
subsequent runs still did not "know" about the LOGO.EXE file.
 
============= 
Vancouver      ROBERTS@decus.ca         | Life is
Institute for  Robert_Slade@sfu.ca      | unpredictable:
Research into  rslade@cue.bc.ca         | eat dessert
User           p1@CyberStore.ca         | first.
Security       Canada V7K 2G6           |
From: RADAI@vms.huji.ac.il (Y. Radai)
Newsgroups: comp.virus
Subject: Re: Jerusalem virus (CVP)
Date: 24 Aug 92 12:46:07 GMT


  Olivier M.J. Crepin-Leblond writes, concerning the Jerusalem virus:
>                    In fact, some pointers now show the origin of the
>virus to be Italy ....

I've seen this claim in several places, and I'm curious to know what
the evidence is for this "Italian Connection".  In my opinion, it is
quite unlikely that the virus originated outside of Israel for the
following reason:  Three other viruses were also discovered in Israel
shortly after the Jerusalem was discovered, and it's clear from an
analysis of them that they are *precursors* of the Jerusalem virus:
sURIV 1.01 infects only COM files, sURIV 2.01 only EXE files, sURIV
3.00 combines the two into one virus, and the Jerusalem is an improve-
ment over sURIV 3.00.  Unless these viruses were also discovered in
Italy, it's much more likely that the Jerusalem spread from Israel to
Italy rather than the other way around.

                                     Y. Radai
                                     Hebrew Univ. of Jerusalem, Israel
                                     RADAI@HUJIVMS.BITNET
                                     RADAI@VMS.HUJI.AC.IL
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: LANs & Viruses (PC)
Date: 31 Aug 92 20:38:38 GMT

I have received word that our test LAN is ready for experimentation &
will commence tomorrow. Before I get into that, I would like to make
some comments about Netware (R) in general.

1) It is possible to protect a LAN server from viruses using only
   the capabilities built into the LAN.

2) The methodology is somewhat obscure and may impact the way the
   users are accustomed to having the LAN operate.

3) Access to files is controlled by "rights" and may be assigned
   to users, groups, volumes, directories, and files.

4) Rights may be tranferred and "inherited" in certain ways.

5) Rights granted at one level can often override a lack of rights
   at another.

6) Out of 256 possible combinations of file rights (SRWCEMFA) alone,
   240 will permit viral attacks. The sixteen remaining combinations
   can be subverted by rights granted at other levels. 

					Warmly,
						Padgett
From: howard@maccs.dcss.mcmaster.ca (Howard Betel)
Newsgroups: comp.virus
Subject: 15xx problems (PC)
Date: 22 Aug 92 01:37:47 GMT

My brother recently asked me to disinfect his computer as scan
reported that he had been infected with the 15xx virus.  After
verifying I ran clean to remove the virus.  Then I installed vshield
(both wer v89) Thinking everything was now clean we started doing some
more work.  Vshield then caught 15xx again and notified me.  I ran
clean again thinking that somehow I missed something.  Sure enough a
little while later another file seemed to be infected.  I then scanned
again with the all parameter.  It picked up an infected file in one of
the subdirectories.  When I ran scan again with that file name it
didn't seem to identify it.  I went into the subdirectory and found a
file with a name something like '.xxxxx.exe' I can't remember the name
but the important thing is that it started with a period.  I deleted
it and ran a scan again on all files.  Everything seemed clean.  I
recently found out that 15xx mutates.  After telling my brother that
he may still be infected, he told me that might explain why he has
been freezing randomly on boot up (right after vshield finishes
checking memory).  It also seems like a few more files have been
corrupted.  So how do I get rid of this and make sure that none of the
floppies are infected?

Thanks

- -- 
Howard Betel                                    Howard@maccs.dcss.McMaster.CA
Dept of Computer Science                     ...!unet!utai!utgpu!maccs!howard
McMaster University
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: Datalision Inc fractal program (PC)
Date: 3 Sep 92 02:49:14 GMT

Homer Smith, <homer@theory.TC.Cornell.EDU> reports:
>      Being into fractals and all I get lots of fractal disks
> in the mail from would be fractal types.  A few years
> back I got a disk called MANJU87 from a company called
> DATALISION PULISHERS, INC.  New York 10017.
>
> [.. stuff deleted ..]
>
>      Anyhow a few weeks ago I got around to installing it for
> the first time to see what the competition was like.
> A few days later I found my hard disk will missing 16 million bytes
> in 8110 lost clusters!
>
> ... I fixed my disk with pctools and reinstalled manju87 and lo and behold
> 8110 lost clusters.
>
>      What is this joker doing anyhow?  Besides placing a hidden file
> in my root directory named !_235053 which was filled with sniblets of
> random files on my disk, how did he manage to lose that many clusters
> and cross allocate files in my fat to the point where pctools just
> gave us and went to the mirror file?

Well, the good news is that this is almost certainly not a virus.

The bad news is that the s/w is dire, but you'd guessed that already.

The probable explanation is: the software is trying to use a security
mechanism, presumably to prevent duplication (?).  However it was
written with the 32Mb partition limit of DOS versions up to 3.3 in
mind.  So it is mucking around at a low level with your hard drive,
and all references to disk areas are calculated modulo 32Mb.  Meaning
that the first protion of your disk is getting mangled in a
particularly unpleasant manner.  Time to reach for those backups, ...

Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: wjh0265@tamsun.tamu.edu (William Hobson)
Newsgroups: comp.virus
Subject: Re: help, high weirdness (PC)
Date: 26 Aug 92 12:48:37 GMT

Keyboard problems - what fun!!  After having done battle recently,
here are a few observations and solutions I have used:

1)  If it is WordPerfect you are having the problem with, use the /nc /nk 
command line switches.
2)  Bios problems seem to really jump forward when networking these faulty
BIOSes.
3)  Also be aware that other problems can look like this one: we had a PC
that had the fan go out on the power supply that created these symptoms
(I have seen a LOT of fan failures recently :-( )
From: homer@theory.TC.Cornell.EDU (Homer Smith)
Newsgroups: comp.virus
Subject: Datalision Inc fractal program (PC)
Date: 29 Aug 92 13:57:49 GMT


     Dear People, 
 
     Being into fractals and all I get lots of fractal disks
in the mail from would be fractal types.  A few years
back I got a disk called MANJU87 from a company called
DATALISION PULISHERS, INC.  New York 10017.  
 
     Now the fractals on this disk were pretty nice, but the program
was a joke, and failed to function so many times I took to playing
frisbee with the disk.  Further it forced you to enter a password
everytime you wanted to use the program.  I used CSHOW to look at the
images.
 
     Anyhow a few weeks ago I got around to installing it for
the first time to see what the competition was like.
A few days later I found my hard disk will missing 16 million bytes
in 8110 lost clusters!
  
     I got a bit frantic wondering what the hell it was, until I
remembered the competency with which manju was pieced together.  I
fixed my disk with pctools and reinstalled manju87 and lo and behold
8110 lost clusters.
 
     What is this joker doing anyhow?  Besides placing a hidden file
in my root directory named !_235053 which was filled with sniblets of
random files on my disk, how did he manage to lose that many clusters
and cross allocate files in my fat to the point where pctools just
gave us and went to the mirror file?
 
    Anyhow I haven't contacted the people who put this thing out yet,
I am having too much fun playing frisbee with their disk, but I have
a mind to, except that they are probably long gone and should be.
 
     Besides their ENGLISH in the documentation was terminal, some
people just don't know how they come across with their broken english.
especially on the jacket of a product touting itself to be the
world reference for fractals, and demanding level 10 security
clearance to use the disk.

     Have a nice day.
 
     Homer
From: leveret@warren.demon.co.uk (Nick Leverton)
Newsgroups: comp.virus
Subject: Re: help, high weirdness (PC)
Date: 20 Aug 92 14:31:47 GMT

hurd@sfu.ca (Peter L. Hurd) writes:

>2)  Keyboard spaceyness, it gets to thinking that the shift is down, so
>even numbers show up as @#$%^, and the alt ,and ctrl keys don't quite
>do what I expect them to (usually happens in WP5.1)

This is a known problem with some BIOSes. There is a set of programs
Out There Somewhere (tm) which fix it. I came across them under the
name INT099FI.ZIP, so look for that name wherever you usually get your
shareware and PD software.

Nick Leverton
- -- 
Just my six pounds fourteen shillings and eightpence three-farthings worth.
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: new virus found (PC)
Date: 26 Aug 92 15:33:10 GMT

sapao@dcc.ufmg.br writes:

>A new virus not detected by McAfee's Scan93 nor Virx version 2.3 was
>found in Brazil. F-prot said it's a new variant of jerusalem. 

Well, it turned out that it is not.  This virus belongs to a separate
family.  It contains an encrypted text string "Freddy Krg", so I have
proposed the name "Freddy" for it.

F-PROT version 2.04d (a semmi-official version I just uploaded to
SIMTEL20) can detect and disinfect this virus.  However, there is no
need to hurry and download this version, as I will upload 2.05
tomorrow, just before I leave for the virus conference in Scotland.

- -frisk
From: JFORD@seebeck.ua.edu
Newsgroups: comp.virus
Subject: Re: Netware and viruses - some new results (PC)
Date: 19 Aug 92 17:45:11 GMT

>Date:    Wed, 19 Aug 92 08:06:46 -0500
>From:    cohen@fitmail.fit.qut.edu.au (Mr Fred Cohen)
>
>At QUT, we have set up an experimental network to test viruses in
>networked environments, and the first results have just come in -
>unbelievable!
>
>Test 1: Exhaustive test of netware preotection setting on files and
>directories against common viruses.
>
>Result: Only 3 of the 15 bits provide any protection - Execute ONLY?
>NO GOOD!!!  Read ONLY? NO GOOD!!!

Is this using "FLAG (or FLAGDIR) file parameters" or using Syscon to
grant specific File and directory rights to the account?

- ----------
James Ford - Consultant II, Seebeck Computer Center
             jford@seebeck.ua.edu, jford@risc.ua.edu
             The University of Alabama (in Tuscaloosa, Alabama)
From: ISB202REID@redgum.qut.edu.au (Did somebody say Coffee ??????)
Newsgroups: comp.virus
Subject: Anyone for a Feist ??? (PC)
Date: 24 Aug 92 11:46:09 GMT

A few days ago I came across a machine absolutely
covered by the feist virus..

Clean 93 wouldn't remove it, although it was in F-Prot 2.04a's
database, wouldn't even recoginise it !!

Can someone tell what it does and _can_ it be removed...

Thanx...

- -Fodd

isb202reid@qut.edu.au
n1019031@water.fit.qut.edu.au
From: Andrew_Clark.sdb-e@rx.xerox.com
Newsgroups: comp.virus
Subject: F-Prot & SuperStor (PC)
Date: 3 Sep 92 07:34:38 GMT

Has anyone used F-Prot's F-Driver.SYS with SuperStor from DR-DOS6.

I tried to install this but got the message INT 13h modified....

I am sure that I do not have a virus, and am assuming the INT 13h is
used for disk access (which superstor would need to modify to redirect
disk accesses to itself)

Second: IBM PC question.
Can anyone advise me whether there is a virus that modifies the
seconds field in a files time value to 62. I seem to recall that there
is a virus which does this.

If there is then how do I remove it? what does it do etc.

Anyone help?

Thanks,
Andy
From: swispl@Solomon.Technet.sg (SW International)
Newsgroups: comp.virus
Subject: Comments on Untouchable... (PC)
Date: 22 Aug 92 02:04:17 GMT

The company has just purchased a whole batch of spanking brand new PCs
for a major project. As luck would strike it, I've been choosen as one
of the guys to look after its "Virginity" against viruses.

I would very much like to hear your worthy comments of the following
Virus detection/terminator software on the market:

	* Untouchable (by Fifth Generation Systems),
	* Turbo-Anti virus (by CARMEL Software Engineering),
	* McAFee

Thank you in advance...

Regards,

Alvino...


- --
SW International Systems Pte Ltd     |  "I've got a plan so cunning 
    14, Science Park Drive           | you could put a tail on it and
    Singapore Science Park           | call it a weasel".. Black Adder
    Singapore 0511                   | 
    Tel: (65) 778-0066               |
    Fax: (65) 777-9401               | swispl@solomon.technet.sg
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Archive access without anonymous ftp last changed 11 July 1992
Date: 1 Sep 92 18:54:08 GMT

Archive access without anonymous ftp	last changed 11 July 1992

To get files from the anti-viral archives, you do not need access
to anonymous ftp.  (However, anonymous ftp is generally the preferred
method.)  Below is information on accessing the archive sites using
only email.

                           -=-

The AppleII, Atari ST and IBMPC archives have mail servers which
provide access to their archives.  You may receive automatic updates
of Macintosh anti-viral programs via email.  See the individual articles
on these sites.

                           -=-

One way to get access to the archives is through the BITFTP server
at Princeton.  Send a message to the BITNET address is BITFTP@PUCC
with the body of the message containing the single word HELP.  This
should get you more information, and give you access to any archive
site on the Internet.  Due to excessive loads, this service has been
restricted to BITNET and EARN sites only.  UUCP sites need not apply.

                           -=-

In response to Princeton closing its service to non-BITNET sites,
Digital has made an FTPmail service available.  Send mail to
FTPmail@decwrl.dec.com with the body of the message containing
the word 'help'.  Another site offering this service in Australia
can be reached at the address FTPmail@cs.uow.edu.au.

                           -=-

You may also retrieve files from the SIMTEL-20 and the INFO-MAC
archives by using one of the many mail servers which maintain
a shadow archive of these sites.  Send the following message to one
of the listserv sites.

help

See the IBMPC and Macintosh articles for a complete list of servers.