HDTenEightyP/NetNews huggingface dataset:
From: RZOTTO@NYX.UNI-KONSTANZ.DE (Otto Stolz)
Newsgroups: comp.virus
Subject: Re: F-Prot & SuperStor (PC)
Date: 8 Sep 92 15:45:55 GMT

On Thu, 03 Sep 92 03:34:38 -0400 Andrew Clark
 <Andrew_Clark.sdb-e@rx.xerox.com> said:
> [...]
> Can anyone advise me whether there is a virus that modifies the
> seconds field in a files time value to 62. I seem to recall that there
> is a virus which does this.

Andy,

the Vienna virus, and its descendants, do so, including the Zerobug
virus.

I have tried to send you the pertinent info, but it bounced back (cf.
below) -- hence I have to bother the whole Virus-l to reach you.
If you want more details, send a valid E-mail address to me.

Best wishes,
                    Otto Stolz <RZOTTO@DKNKURZ1.Bitnet>
                               <RZOTTO@nyx.uni-konstanz.de>

- --------

On Tue, 8 Sep 1992 08:22:48 PDT Clayvin.Parc@xerox.com said:
> Subject: Undeliverable mail
> Message-Id: <92Sep8.082302pdt.11813@alpha.xerox.com>
>
> The enclosed message could not be delivered to the following recipient:
>
>     ANDREW_CLARK.SDB-E@Rx.Xerox.com -- no such user

On Tue, 8 Sep 1992 08:22:56 PDT Mercury.PARC@xerox.com said:
> Subject: Undeliverable mail
> Message-Id: <92Sep8.082322pdt.11812@alpha.xerox.com>
>
> The enclosed message could not be delivered to the following recipient:
>
>     ANDREW_CLARK.SDB-E@Rx.Xerox.com -- no such user
From: gary@sci34hub.sci.com (Gary Heston)
Newsgroups: comp.virus
Subject: F-Prot 2.05 on NetWare.... (PC)
Date: 3 Sep 92 20:44:49 GMT

Greetings, all....

  I've run into a *very* strange interaction problem. When using
F-Prot 2.05 to scan a group of servers, it works it's way through five
servers running NetWare 3.11 without any problem. When it gets to the
last server, which is the one it's being run from and which has
NetWare 2.15c installed, it scans merrily along until it hits the
\public\ms_dos\v500 directory, then locks up *solidly*. I can't even
toggle the numlock LED, or do a warm boot. It's red switch time.

  However, it'll scan a DOS 5 system without any problems at all. I
tried changing the command line to remove the /all file selection
switch, with the result that it locks up on a *different* file.
Actions are identical if run interactively (I've got a user set up on
each server to attach the other five and kick off F-Prot automatically
upon login; I run this each morning), scanning all files or
executables. It's consistent about which files it crashes on; scanning
all files it doesn't like DOSSHELL.HLP, and locks *every* time. If
checking executables only, it dies on another file.

  Has anyone else seen this? I've been running 2.04a for weeks without
a glitch, and have dropped back to it until I can figure out what's
going on. It still runs fine.

  My copy of FP-205 was retrieved from uunet, FWIW.

Puzzled;
Gary

- -- 
Gary Heston    SCI Systems, Inc.  gary@sci34hub.sci.com   site admin
The Chairman of the Board and the CFO speak for SCI. I'm neither.
    The most dangerous person in the world is Jessica Fletcher.
        Everywhere she goes, people die.
From: andy@exp.uvs.edu.sr
Newsgroups: comp.virus
Subject: F-prot false alarm? (PC)
Date: 8 Sep 92 18:19:00 GMT

Hi,

Just obtained F-prot 2.05 from simtel. Unpacked it and did a secure
scan.  To my surprise backup.exe (from dos 5.0) was reported as being
infected with the Stanco virus. The file was packed with pklite. I
Looked the virus up in the info table of f-prot and it says the virus
replicates only in compressed form??! Also Virstop didn't stop
backup.exe from running.  I think this is a false alarm (or I hope it
is).

Does anyone has more information regarding the Stanco virus?

Thanx,
Andy

  /\  |\ | |~\ |_|   Internet : andy@exp.uvs.edu.sr
 /~~\ | \| |_/  |        UUCP : ...!upr2.clu.net!uvs!exp!andy
 Andy R. Lo A Foe    Faxmodem : +1-597-491-117
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: F-PROT reports Bugsres 3 Jokes program? (PC)
Date: 7 Sep 92 20:29:15 GMT

dana%are.Berkeley.EDU@ucbvax.Berkeley.EDU (Dana E. Keil) writes:

> I just obtained F-PROT. Running a scan with it reports that a file
> named bugres.com is infected with a virus named "bugsres 3 jokes
> program". I can find no mention of this virus anywhere in F-PROT
> documentation (nor elsewhere). Can anyone enlighten me about it?

It's not a virus; it's a joke program. If you run it, it goes TSR and
each time you press Alt-B, a bunch of crudely drawn (using text
characters) bugs begin to eat your text screen. When you press a key,
the bugs disappear and the previous contents of the screen is
restored.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: duck@nuustak.csir.co.za (Paul Ducklin)
Newsgroups: comp.virus
Subject: Re: F-Prot & SuperStor (PC)
Date: 7 Sep 92 19:39:57 GMT

Thus spake Andrew_Clark.sdb-e@rx.xerox.com:
>Second: IBM PC question.
>Can anyone advise me whether there is a virus that modifies the
>seconds field in a files time value to 62. I seem to recall that there
>is a virus which does this.

Plenty of viruses use this trick. Vienna was probably the first -- and
the source went and got itself published in a book \end{flame}, with
the result that it became a popular technique. 

Or, of course, you might have a program that's been "innoculated"
against various viruses, including those which avoid infection if
they see a second stamp of 62. [Incidentally, M*crosoft allocated
5 bits for "seconds", so a DOS filestamp has a 2-second granularity;
62 seconds are actually 31 M*crosoft-double-seconds].

Try as decent virus scanner [after a clean boot, of course] if you
want to identify what it is.

- -- 

- --<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--
Paul Ducklin                                           duck@nuustak.csir.co.za

    CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa
From: seborg@csrc.ncsl.nist.gov (Brian Seborg)
Newsgroups: comp.virus
Subject: Re: Fingerprinting files
Date: 3 Sep 92 12:31:28 GMT

Suresh,

Your observation that fingerprinting files is the most proven me best
way of virus detection is for the most part true.  Some tricks have to
be pulled to ensure that you bypass stealth viruses, but other than
that, it is the best way.  You raise a very good question regarding
self-modifying exe files (e.g. setver.exe that comes with DOS 5.0).
There are several ways to handle these.  First, one can put them on an
exception list and ignore them.  This is not a good idea for programs
which are executed every time the PC is turned on (again setver.exe
comes to mind), but may be appropriate for files which change due to
their being programs under development (such as would be seen in some
directories of a programmers machine).  The second way to deal with
this is to note the modifi- cation and query the user as to whether
this should be allowed.  This works well for power users, but is prone
to error for the general user who may not un understand what is going
on on his PC, and could, therefore, make the wrong decision.  The
third way is to note where the change occurred, and what type of
change occurred.  Whereas it may be okay for a program to make a
change to its data area, it is probably not okay to see a change in
the program entry point.  Fourth and finally, you can raise the flag
to industry to stop this technique of self-modifyable executables.  It
is irresponsible to have self- modifying executables in today's
computer environment.  Just when we think we are getting a handle on
the virus problem, along comes a suit of programs which modify
themselves.  Not the best idea in my book, regardless of the fact that
it provides a neat solution to some other problems such as making sure
that data-files are located in the right directory, and the need to
execute files from the same directory where their data files are
contained to run properly.  Hope this answers the question.

:-) Brian Seborg
From: Felix.Lafontaine@f23.n367.z1.FIDONET.ORG (Felix Lafontaine)
Newsgroups: comp.virus
Subject: Stoned/Azusa haunting (PC)
Date: 30 Aug 92 13:28:00 GMT

DT> scan a: - 1 virus found [azusa]
DT> clean a: [azusa] - 1 virus removed [azusa]
DT> Anyone know if these two virii mutate when they're together?

 Do you boot from a clean floppie. Both are Memory resident

- --  
Internet: Felix.Lafontaine@f23.n367.z1.FIDONET.ORG
UUCP: ...!myrddin!tct!psycho!367!23!Felix.Lafontaine
Note:psycho is a free gateway between Usenet & Fidonet. For info write to
     root@psycho.fidonet.org.
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: re: Info on "Invol" virus (PC)
Date: 3 Sep 92 11:03:23 GMT

A few more notes on INVOL, since Tarkan brings it up:

- - It's only sometimes resident.  In particular, when in a device
  driver it functions as a resident EXE infector, but when in
  an EXE file it functions as a non-resident SYS infector.  So
  if you run an infected EXE, it looks around for SYS files to
  infect, but doesn't go resident.  When you boot with an
  infected SYS file in CONFIG.SYS, it goes resident and infects
  EXE files that are executed.

- - The sample that I have triggers on the 19th of the month (13h).
  I guess there are date-variants?

- - The silly message doesn't always appear twice in infected SYS
  files; there's some "filler" space that gets filled with random
  junk, sometimes from the virus itself (sometimes not).

- - There are actually about 24 bytes that always occur in the
  degarbler, and always in the same order; there are just
  single NOPs between them at times.  If you support
  variable-length don't-cares in your scanner, it's
  not hard to do a signature for even the EXE form.

- - The virus will try any device driver at all that's mentioned
  in CONFIG.SYS, I think (I captured it in TD.SYS).  I'm not
  entirely certain what the "vansi" strings are doing in the virus;
  it looks as though the code is supposed to create a vansi.sys
  device driver to infect if no other sys was found to infect,
  but I've never actually gotten the virus to behave that way!
  (If a mysterious new vansi.sys device driver, or one by any
  other name for that matter, suddenly appears in your CONFIG.SYS,
  it's probably worth investigating...)

- - In general, I wouldn't expect this virus to be a real winner;
  it activates much too often, and much too severely, to survive
  (people will know they have it, and be unwilling to just live
  with it).

DC
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: New virus that scanv95b cannot pick it up!!!(HELP) (PC)
Date: 9 Sep 92 23:19:55 GMT

Henry Chan, <chanm@server.uwindsor.ca>, says:
> I just found out that my computer is attacked by a new virus(may be).
> The signatures of that virus is always attack the "format.com" file.
> When I viewed the file, the file contain "-stack!--stack!--stack!--"
> string.  And this string has about 10 or more "-stack!-" in it.

In MS-DOS 4.0 it is normal to have this in Format.Com, I don't have a
copy of 5 to hand, but suspect that does as well.

> In my friends' cases, it attacked the borlandc directory(Borland C++
> 3.0).  The directory /borlandc/opernach (spelling?) has lots of junks,
> also with the word "-stack!-" and cannot be deleted.  Also the virus
> rewrite the file "config.sys" with a long string of repeated
> "-stack!-".

Apart from the text in Config.Sys, why do you think there is a virus
involved?

The corruption of Config.Sys may be due to DOS mangling things, or
perhaps a 'friend' playing a prank?

If you still think you have a virus then you can try using F-PROT,
available from most FTP sites and BBSs that have SCAN.  Alternately
you could send an 'infected' file to some virus researchers for
detailed analysis.

Hope this helps,
Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: A.APPLEYARD@fs1.mt.umist.ac.uk
Newsgroups: comp.virus
Subject: Self-modifying programs
Date: 11 Sep 92 07:47:13 GMT

Re self-modifying programs confusing virus scanners: before PC's were around,
my university had a mainframe that had an Algol60 compiler that compiled
(subroutines that had parametric subroutines) thus, e.g.:-
    real procedure integrate(fn,q,w,e,r,t); real procedure fn; real q,w,e,r,t;
    begin; .... x[2]=fn(q+w); ...... z=fn(t); ..... x[4]=fn(e+r); ..... end;
The compiled version of procedure 'integrate' started with code which wrote
a copy of the (entry address of whatever 'fn' was in that call) into the code
of 'integrate' wherever it calls 'fn'. I don't know if there are any compilers
around nowadays that do that sort of thing.
From: perry@andre.utmb.edu (John Perry)
Newsgroups: comp.virus
Subject: New files on eugene and beach (PC)
Date: 8 Sep 92 15:49:17 GMT

Hello Everyone!

Better late than never I always say! I've finally had a chance to sit
down and update the anti-viral archives on eugene and beach. Please
make note of the following additions. If there is a problem or
question, please feel free to contact me at perry@eugene.utmb.edu.

eugene.utmb.edu
fp-205.zip
cvc792am.zip
cvc792ma.zip
cvc792ms.zip
cvcindex.zip
htscan18.zip
tbscan41.zip
vsig9207.zip

beach.utmb.edu
fp-205.zip

John Perry - perry@andre.utmb.edu
From: jin@spdcc.com (Jerry Natowitz)
Newsgroups: comp.virus
Subject: Virus scan for AIX 3.2? (UNIX)
Date: 10 Sep 92 15:37:47 GMT

I have never heard of a Unix based virus scanner, but I have been
asked to investigate virus scanning of software built on, and running
on, an RS6000 running AIX 3.2.

Any leads, freeware or commercialware, would be appreciated.
- -- 
     Jerry Natowitz
     Guest user on:
ARPA jin@ursa-major.spdcc.com
UUCP {ima,harvard,rayssd,linus,m2c}!spdcc!jin
From: I5MMARAB@utfsm.bitnet
Newsgroups: comp.virus
Subject: tbscanx41 and scan95 ! (PC)
Date: 8 Sep 92 20:38:23 GMT

Hello...

     I was working on my computer...and had tbscanx41 resident when i
tried scan95 (new!) for the first time....and it found Israeli Boot
virus..  in the boot sector!

     I though it was real, but I wanted to see if it was true...
     I disactivated tbscanx41 and run scan95 .....guess what ??

                         NO VIRUS FOUND !!

    I ran tbscanx41 again...then scan c:....and again found virus..

    CONCLUSION...: scan95 and tbscanx41 DON'T work good together!


 Is it a bug...?  (must be)

thanks..


<<<take care...virus is everywhere>>>

      ---:<:---            Marcelo A. Maraboli R.
     "The Diode"           Student of Electronic Engineering
 The Beginning of the      Universidad Tecnica Federico Santa Maria
    Electronic Age         I5MMARAB@UTFSM.BITNET
From: rgasch@nl.oracle.com (Robert Gasch)
Newsgroups: comp.virus
Subject: Looking for references (UNIX)
Date: 4 Sep 92 08:02:59 GMT

Hi,

could anybody please direct me to public (FTP) sources of any of the
following:

	1) Discussion/analysis of the workings (strategies employed)
		by the 1989 internet virus.
	2) Same as #1 for other similar incidents (were there any?).

I remember seeing a document analyzing the internet virus on some FTP
server about 2 years ago, but I have no recollection where that was. I
would prefer documents in either plain ASCII or postscript. Please
mail any responses to me as of lately our site seems to be
experiencing some problems receiving this group.

If there is interest I will summarize any responses and post them
to this group.

[Moderator's note: I believe that the May 1989 issue of the
Communications of the ACM was almost entirely on the Internet worm (of
November 1988, not 1989).]

Thank you
- ---> Robert
From: KGGXG@ASUVM.INRE.ASU.EDU (Grant Getz)
Newsgroups: comp.virus
Subject: F-PROT 2.05 on Netware . . . (PC)
Date: 9 Sep 92 23:50:58 GMT

gary@sci34hub.sci.com (Gary Heston) writes:

>Greetings, all....
>
>  I've run into a *very* strange interaction problem. When using
>F-Prot 2.05 to scan a group of servers, it works it's way through five
>servers running NetWare 3.11 without any problem. When it gets to the
>last server, which is the one it's being run from and which has
>NetWare 2.15c installed, it scans merrily along until it hits the
>\public\ms_dos\v500 directory, then locks up *solidly*. I can't even
>toggle the numlock LED, or do a warm boot. It's red switch time.
>
>  However, it'll scan a DOS 5 system without any problems at all. I
>tried changing the command line to remove the /all file selection
>switch, with the result that it locks up on a *different* file.
>Actions are identical if run interactively (I've got a user set up on
>each server to attach the other five and kick off F-Prot automatically
>upon login; I run this each morning), scanning all files or
>executables. It's consistent about which files it crashes on; scanning
>all files it doesn't like DOSSHELL.HLP, and locks *every* time. If
>checking executables only, it dies on another file.
>
>  Has anyone else seen this? I've been running 2.04a for weeks without
>a glitch, and have dropped back to it until I can figure out what's
>going on. It still runs fine.
>
>  My copy of FP-205 was retrieved from uunet, FWIW.

I ran into the same problem scanning my Banyan networks with F-PROT
2.05.  I have not tested this theory out completely but I believe the
memory area for the scan report is filling up.  On the next write to
this memory some protected or program area is being overwritten and
the program hangs.  Version 2.04 must have had a bigger memory area
for the scan report.

I have not checked this out but you could try running F-PROT in
command mode try the /SILENT switch with the /REPORT=file switch to
get away from screen output.

Good Luck !!

- - R. Grant Getz                  INTERNET  -  KGGXG @ ASUVM.INRE.ASU.EDU
  Support Systems Analyst                              (192.67.165.36)
  Arizona State University         BITNET  -  KGGXG @ ASUACAD
  Computing & Network
    Consulting Services - ODP       PHONE  -  (602) 965-5663
  Tempe, AZ  85287-0101               FAX  -  (602) 965-8698
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: F-prot false alarm? (PC)
Date: 10 Sep 92 10:47:37 GMT

andy@exp.uvs.edu.sr writes:

> Just obtained F-prot 2.05 from simtel. Unpacked it and did a secure
> scan.  To my surprise backup.exe (from dos 5.0) was reported as being
> infected with the Stanco virus. The file was packed with pklite. I

Hmm, it's a nasty false positive... For the reasons, see below. I
suggest that you send a private message to Frisk about that, since
he's now on holidays and may miss your article...

I didn't know that BACKUP.EXE from DOS 5.0 is PKLite'd... (I am using
DR-DOS 6.0.) DR-DOS -does- have most of its utilities in a PKLite'd
form, but I thought that Microsoft/IBM don't do that...

> Looked the virus up in the info table of f-prot and it says the virus
> replicates only in compressed form??! Also Virstop didn't stop
> backup.exe from running.  I think this is a false alarm (or I hope it
> is).

> Does anyone has more information regarding the Stanco virus?

It is a virus written in Turbo Pascal and compressed with PKLite. Was
first detected in Genoa, Italy. The size is about 7500 bytes. It is** PGP publi
c key available on request. **   Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: AMN@vms.brighton.ac.uk (Anthony Naggs)
Newsgroups: comp.virus
Subject: Re: Auto-detecting virus (PC)
Date: 4 Sep 92 00:09:43 GMT

Denis Beauregard, <beaurega@ireq.hydro.qc.ca>, says:
> I would like to write a program that will check if it is per se
> holder of a virus.  The method I have in view :
>
> Compile the program.
> Compute the checksum of the program.
> Put the checksum in the program.
> When starting the program : Stop the program if the checksum has been altered.

This is the most common method used by programmers to fight viruses.
I have lost count of the number of articles here and in magazines that try
something similar.

> Advantages :
> 1- User can not modify the program to remove the copyright notice
>    (whic I can code anyway)

Yes.

> 2- Virus modifying hte program would be catched immediately so that
>    my programs will be reputed for being virus-safe

No.  For two reasons:
1.  Any virus attached to your program can operate before your program does
    the checksum.  So your program can only say "program changed", after the
    virus has done what it wishes.
2.  The increasing number of "stealth" viruses are able to hide by making
    their changes invisible.  So when an infected program is run the virus
    becomes a TSR and stops you, or your program, seeing the changes made by
    the virus.

> Also, I never saw a self-protected program.  Even an anti-virus program
> has as instructions : use the included diskette if infection is known.
> I think this is because DOS can be infected, but I feel these programs
> are not self-immunated (but I can be wrong).

A number of programs, including most anti-virus programs, include checks
similar to yours.  The problems, especially with "stealth" viruses, mean
that this feature is often not mentioned, and is not relied upon.

Yours,
Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: +44 273 589701                           Great Britain
Email: (c/o Univ of Brighton) amn@vms.brighton.ac.uk  or  xa329@city.ac.uk
From: KDC@ccm.UManitoba.CA (Ken De Cruyenaere 204-474-8340)
Newsgroups: comp.virus
Subject: "New" 1530 virus ? (PC)
Date: 8 Sep 92 21:42:36 GMT


 A new virus has turned up on our campus.

McAfee v95 identifies it as "1530" but will not clean it.

CPAV (1.2) does not detect it.

 F-PROT (V2.05) does not detect it (even in HEURISTICS) (!)
 When infected, VIRSTOP does note that it has been changed and tells
one to  boot from a clean diskette, but VIRSTOP doesn't stop the boot
at that point (?!).

 It appears to infect .EXEs and .COMs.  It seems to go for
COMMAND.COM first.  Infected files increase in size (by apprx 1960)
but the date doesn't change.

 The following search string seems to be unique to the virus:
 06 56 57 50 53 51 52 8C DE
 (but hasn't been tested very thoroughly at this point)

  - Ken
- ---------------------------------------------------------------------
Ken De Cruyenaere - Computer Security Coordinator - Computer Services
University of Manitoba - Winnipeg, Manitoba, Canada, R3T 2N2
Bitnet: KDC@CCM.UManitoba.CA   Voice:(204)474-8340 FAX:(204)275-5420
From: cass8806@elan.glassboro.edu (KYLE CASSIDY)
Newsgroups: comp.virus
Subject: scads of viri... (PC)
Date: 9 Sep 92 21:58:25 GMT

i'd been having hard drive problems for a while, a few bad sectors a
week would pop up, so i was on my way to getting a new drive anyway
.. i run v-shield at startup and i ftp quite a bit, well last night
v-shield said it found A-VIR in memory, i powered down, booted from a
clean floppy and ran scan, which claimed to find a whopping 25
different viri. there appeared to be significant hard drive dammage to
a small portion of the drive.
	what i'm wondering is, could this be a false positive? i don't
see how i could have picked up such a high degree of virus infestation
that went unnoticed by v-shield.... i haven't tried rebooting the
machine since then, i figured i'd try and get a general consensis on
what to do from the powers that be first.

thanks.
kc