HDTenEightyP/NetNews huggingface dataset:
From: CCTR132@csc.canterbury.ac.nz (Nick FitzGerald)
Newsgroups: comp.virus
Subject: Re: f-prot 2.04c ??? (PC)
Date: 14 Aug 92 05:00:59 GMT

dab6@po.CWRU.Edu (Douglas A. Bell) writes:
> I found f-prot2.04c on wuarchive.wustl.edu in the pub/MSDOS_UPLOADS
> directory.
> 
> Is it for real ?  Its release date is 8/12/92, and that's today.

Four things:

1.  Frisk very recently said that this version, maybe renamed to 2.05,
might be released RSN.

2.  Was that really the filename?  Kind of a giveaway if it was.  8-)

3.  Why do large ftp sites use inadequate OS's, ftp implementations or
whatever?  Upload directories should be able to be made "write-only"
so the "world-at-large" can't do silly things through them, like "dir"
and "get".  One of the hacked, so-called PKZIP 2.x's was widely spread
from ftp sites' upload dirs.

4.  Why do people make -posts- like Douglas's when something like this
happens?  You don't have to look far through the digests/newsgroup to
find Frisk's Email address - indeed, you don't have to look far in the
F-PROT package for the same info.  Think about the process people - if
Frisk announces a new version and it's not already uploaded he and the
site moderator will be inundataed with messages saying "Where's it
gone?", "I couldn't find it", etc, etc.  It takes a finite amount of
time from upload to inform the moderator to having it moved to its
final resting place, and it had just been uploaded.  If this is a
trojan, Douglas has just told the world that 2.04c is "out" - the
implicit warning that he hasn't seen a release announcement will be
ignored by a disconcertingly large number of users (they will want to
be the first to d/l it from an ftp site and u/l to their favourite BBS
so they get the kudos of being up with the play - and the u/l
credits). Better he had shut up in public and talked with Frisk in
private, letting Frisk make the appropriate decisions regarding
warning the ftp site moderators, etc, etc.  Don't give me any horse
puckey responses about "freedom of speech" and "the public's right to
know", either.

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 Nick FitzGerald, PC Applications Consultant, CSC, Uni of Canterbury, N.Z.
 n.fitzgerald@csc.canterbury.ac.nz    (64)(3)  642-337 Voice,  642-332 FAX
From: padgett%tccslr.dnet%uvs1@uvs1.orl.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: MS-DOS 6.0 with Anti-Virus ? (PC)
Date: 12 Aug 92 13:31:21 GMT

I wrote:

>>I see in the new PC-Week that MS-DOS 6.0 is scheduled to contain anti-
>>virus software from Central Point.

Frisk replied:

>Well, if they do this, they could hardly have picked a better product
>for the rest of the anti-virus community to compete against, as
>outperforming CPAV is generally considered extremely easy...

Actually, it would be a surprise if the entire CPAV product was
included. More likely would be some sort of trivial checksumming
routine that would tell you *something* virus-like happened, and a
discount coupon for the *real* product.

This could easily be part of a disk-compression device driver (also
rumored) since disk compression routines generally use checksumming to
verify integrity and operate at the file (not sector) level. I have
had some discussions with one of the major aftermarket compression
companies on this subject and on "read-only" container files
(partitions). Still vulnerable to a sophisticated attack but an order
of maganatude better than what is in OSs today.

I would be pleasently surprised to see an effective MBR/DBR routine
included.  Of course that would give a number of disk protection
products fits (Watchdog, PC-Safe, PC-Guardian, my DiskSecure, etc.) if
it were effective as would any sort of BIOS Interrupt validation (but
then CP, like most other AV vendors have been slow to do any
BIOS-level programming (dig)).

However, as I have been saying for the last few years, the above two
techniques would stop the spread of all of today's viruses and that
would not be a bad thing.

						Warmly,
							Padgett
From: as789@cleveland.Freenet.Edu (Francisco J. Diaz)
Newsgroups: comp.virus
Subject: Re: MS-DOS 6.0 with Anti-Virus ? (PC)
Date: 15 Aug 92 04:57:33 GMT

Yep, I have confirmes thia with a BETA tester and programmer from
Microsoft down here in their Caribbean branch and he told me that
it will include Disk Compression and Antivirus utilities, as well
as a set of very ppopular backup, defrags and others utilites
from well known companies...To be exact he mentioned CPAV, Double
Disk, Symantec and Central Point as the main players in the new OS
as well as enhancements in the OS overall...I'll keep his name
anonymous because he's a good guy and don't want to get him fired
from his job....:-)
- -- 
|     Francisco J. Diaz Rivera     |                           |
|     University of Puerto Rico    | If the shoe fits, buy it! |
|  "I hate calculus classes!" :-)  |           - Imelda Marcos |
|     STUD137@CUTB.UPR.CLU.EDU     |                           |
From: virus-l@lehigh.edu
Newsgroups: comp.virus
Subject: Windows, Multitasking, & Viruses (PC)
Date: 11 Aug 92 14:34:31 GMT

>After asking for tech advice, I got the following answers on win3-l.
>These make me think, that the danger of infections is not bigger
>within windows than under plain dos. Though the claims of these
>companies are still dangerous and produce a wrong sense of security.

The danger of Windows infections lies not in Windows itself but in two
other areas:

1) Windows will execute more files (extensions) than DOS

2) Windows will *hide* some activities from DOS that could include a virus.

Of course the same holds true for a Unix or OS/2 "DOS box" or DesqView
(which I use) or any other shell.

Element 1 is a natural outgrowth of the fact that DOS will execute
*anything* presented to it for execution, the .COM, .EXE, and .BAT
convention is an easily modified function of COMMAND.COM not DOS.

Element 2 is more subtle and deals with the fact that Windows (etc.)
are more closely intertwined with DOS than any anti-viral product that
I know of and can bypass the best current TSRs that I know of through
use of the "undocumented" functions.

For example, in one of my Desqview "windows" that I use for new files,
it is necessary to reload the DOS level antivirus routines again
inside the Window because they were "disconnected" when DesqView
loaded.

In the same manner, the best "tunneling" I have seen is QEMM's
"stealth" mode of memory management - I only found out what was
happening because one of my BIOS programs checks itself and found that
its Int 13 access had been taken away from it !

NetWare loaded after anti-virus routines (since the best AV routines
load from CONFIG.SYS or earlier, this is common) will "take away"
network access making it easy to accidently run an infected file even
though the user *knows* (s)he is runiing an AV product.

IMHO, future AV products *must* cease to be "one-stop" loads and will
require a load sequence starting with the BIOS, another from DOS, and
a "reconnect/ verify" for each critical Window coupled with
self-checking along the way.  There are several interesting
possibilities for this but again IMHO the dynamicism of the malicious
software field makes it evident that what we consider "state of the
art" today will be trivial tomorrow.

					Warmly,

						Padgett

      "Gauntlet" was the first of Clint Eastwood's comedies.
From: ZMUDZINSKIT@uvax6.disa.mil (zmudzinski, thomas)
Newsgroups: comp.virus
Subject: Re[1]: Windows, Multitasking, & Viruses (PC)
Date: 14 Aug 92 14:51:50 GMT

> "Gauntlet" was the first of Clint Eastwood's comedies.
 
Yeah, but "The Good, the Bad, and the Ugly" was the movie that made
him an international singing star!  NOT!
 
BTW, the "Baker & Byrd" morning show [WASH-AM radio] used to include a
character called "Clint" that was a dead-ringer.  "Clint" used to end
every other sentence with "punk!" and interact violently with other
characters.  Mr. Eastwood's lawyers "suggested" that they stop doing
"Clint", so he's been replaced with "Sean", a rough-hewn, balding
actor with a definite Scotish brogue.  (Mr. Connery's lawyers haven't
found out about "Sean".  Yet!)
 
/z/

UTTERLY-USELESS-PSEUDO-CRYPTOGRAPHIC-SIGNATURE-CHECKSUM: 42
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: (c) Brain - part 1 (CVP)
Date: 13 Aug 92 18:59:17 GMT

HISVIR6.CVP   920810
 
                        (c) Brain - part 1
 
The "Brain" virus is probably the earliest MS-DOS virus.  At one
time it was the most widespread of PC viral programs.  (Yet more
support for the "superiority" of boot sector viral programs in terms
of numbers of infections.)  Extensive study has been done on the
Brain family, and those wishing further details should consult Alan
Solomon's analyses (which, unfortunately, are too detailed for full
inclusion in the Anti-Virus Toolkit).  In spite of this, and in
spite of the existence of address and phone number information for
the supposed author, we still have no first, second or even third
hand reports of the production of the virus, and so little can be
said with absolute certainty.  (We do have a first hand report from
the author of the Den Zuk variant, for which I am grateful to
Fridrik Skulason.)
 
The Brain "family" is prolific, although less so than Jerusalem. 
(Seemingly, any "successful" virus spawns a plague of copies as
virus-writer-wannabes use it as a template.)  Again, like the
Jerusalem, it seems that one of the lesser variants might be the
"original".  The "ashar" version appears to be somewhat less
sophisticated than the most common "Brain", and Brain contains text
which makes no sense unless it is "derived" from ashar.  Brain
contains other "timing" information: a "copyright" date of 1986, and
an apparent "version" number of 9.0.
 
Brain is a boot sector infector, somewhat longer than some of the
more recent BSIs.  Brain occupies three sectors itself, and, as is
usual with BSIs, repositions the normal boot sector in order to
"mimic" the boot process.  As the boot sector is only a single
sector, Brain, in infecting a disk, reserves two additional sectors
on the disk for the remainder of itself, plus a third for the
original boot sector.  This is done by occupying unused space on the
diskette, and then marking those sectors as "bad" so that they will
not be used and overwritten.  The "original" Brain virus is
relatively harmless.  It does not infect hard disks, or disks with
formats other than 360K.  (Other variants are less careful, and can
overlay FAT and data areas.)
 
Brain is at once sly and brazen about its work.  It is, in fact, the
first "stealth" virus, in that a request to view the boot sector of
an infected disk, on an infected system will result in a display of
the original boot sector.  However, the Brain virus is designed
*not* to hide its light under a bushel in another way: the volume
label of infected diskettes becomes "(c) Brain" (or "(c) ashar" or
"Y.C.1.E.R.P" for different variants).  Hence the name of the virus.
 
copyright Robert M. Slade, 1992   HISVIR6.CVP   920810

===================
Vancouver          ROBERTS@decus.ca         | "Power users think
Institute for      Robert_Slade@sfu.ca      |  'Your PC is now
Research into      rslade@cue.bc.ca         |  Stoned' is part of
User               p1@CyberStore.ca         |  the DOS copyright
Security           Canada V7K 2G6           |  line." R. Murnane
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: F-Prot 2.04c (PC)
Date: 19 Aug 92 15:18:56 GMT

gerald@vmars.tuwien.ac.at (Gerald Pfeifer (Prak Gusti)) writes:

>Three days ago I downloaded F-Prot 2.04c (fp-204c.zip) from the net.

>The 'Program - Performance' info in the interactive shell boosts a
>much higher number of viruses and virus-families to be detected than
>under version 2.04a.  The documentation, however, does *not* mention
>any advances/extensions/...  (The documentation files seem to be
>nearly unchanged since 2.04a)

It is unchanged - I only change the "new.xxx" file for the major
versions - that is, it will be changed for 2.05.  However, please note
that 2.04c is not an official release, and was not supposed to be
widely distributed.

And yes, I have indeed added over 100 new viruses since 2.04..

- -frisk
From: gerald@vmars.tuwien.ac.at (Gerald Pfeifer (Prak Gusti))
Newsgroups: comp.virus
Subject: F-Prot 2.04c (PC)
Date: 17 Aug 92 10:11:49 GMT

Three days ago I downloaded F-Prot 2.04c (fp-204c.zip) from the net.

The 'Program - Performance' info in the interactive shell boosts a
much higher number of viruses and virus-families to be detected than
under version 2.04a.  The documentation, however, does *not* mention
any advances/extensions/...  (The documentation files seem to be
nearly unchanged since 2.04a)

So I wonder, what really has changed and what the newly detected
viruses are!  Does anyone know?

Thanks, 
  
  Jerry, sign of the mouse

PS: Besides, does anyone know the rational behind F-Prot's version numbers? 
..............................................................................
. Gerald Pfeifer (Jerry)                 Technical University Vienna, Austria .
. gerald@kongo.vmars.tuwien.ac.at                                             .
..............................................................................
From: padgett%tccslr.dnet%uvs1@uvs1.orl.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: VM viruses from PCs (IBM VM/CMS)
Date: 11 Aug 92 12:40:26 GMT

>- - Is there a case of VM virus infiltrated from a PC ?

There are none but it could be written (code to select one of two
environments would be (relatively) easy, one of three (e.g. PC, MAC,
3090) more difficult, etc. Haven't seen one yet unless you count the
Morris Worm. Like the worm (and unlike virus writers) it would take a
professional. The hard part would be getting it *executed* on the
mainframe.

>- - What is the usual procedure of uploading files from PCs to VM
>  in the States? I mean, do you let a PC user upload his/her files
>  to VM or are those files scanned by the computer center to make
>  sure that they are "clean" before uploading ?

None, people like to live on the slope of a volcano (soil is so rich
that it supports laziness).
				Warmly,
					Padgett

     "Define the essential spirit defined by both *Smokey and the Bandit* 
      (1977) and *The Gumball Rally* (1976)" Contrast with the Iranian
      Desert Incident (1980)."
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: F-PROT 2.04b? (PC)
Date: 11 Aug 92 08:45:58 GMT

PCOEN@drunivac.drew.edu (Paul R. Coen) writes:

>I've only seen F-Prot 2.04b available at one or two sites, and no mention
>of an official release.  Does anyone know whether or not it's been officially
>released?  If not, what is it that those few sites are distributing?

2.04b is a real version, but it was never officially distributed, and should
not be in general circulation.  I sent a copy to a few users that encountered
totally new viruses, that 2.04a could not handle, but I (by mistake) left
a copy in the anonymous ftp directory on complex.is, and some people must have
downloaded it from there.

Anyhow, I just finished 2.04c (which I might release under that name or
rename to 2.05)....

- -frisk
From: dab6@po.CWRU.Edu (Douglas A. Bell)
Newsgroups: comp.virus
Subject: f-prot 2.04c ??? (PC)
Date: 12 Aug 92 16:51:58 GMT

I found f-prot2.04c on wuarchive.wustl.edu in the pub/MSDOS_UPLOADS
directory.

Is it for real ?  Its release date is 8/12/92, and that's today.

Douglas Bell-
From: treeves@magnus.acs.ohio-state.edu (Terry N Reeves)
Newsgroups: comp.virus
Subject: Waldo ?? (PC)
Date: 17 Aug 92 18:39:15 GMT

Anyone know of a virus/trojan/joke/ etc that self-identifies as Waldo?

I have not seen it, unfortunately I have only a sketchy report of a
message seen periodically on a pc running windows 3.1 & corel draw
2.0.  I ma told a "waldo virus" is identified. Unfortunately I can't
even be sure the word virus was in the actual message.

f-prot 2.04c finds nothing not even with heuristic scan. (two false +
only) scan 93 ditto.

Anyone??
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Running SCAN under OS/2 (Was: Re: Stone virus and OS/2. (PC) (OS/2))
Date: 11 Aug 92 22:23:49 GMT

Hello John,

REGY106@csc.canterbury.ac.nz (John, RegyTech Systems.) writes:
>	We have found the stoned virus on some of our dos pc's.  So I
>thought I would run scan over mine.  I'm using OS/2 2.0 with a HPFS
>disk.  Scan found a file open and died.  Is there a way around this?
<rest of message deleted>

Try running SCAN with the /UNATTEND switch, this tells SCAN to skip
over any files that are in use by another program and can not be
shared (accessed) while in use.

Regards,
 
Aryeh Goretsky
McAfee Associates Technical Support
- -- 
- - - -
McAfee Associates        | Voice (408) 988-3832 | mcafee@netcom.com  (business)
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | ObQuote: "Log... from Blammo"
Santa Clara, California  |                      | 
95054-3107  USA          | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
ViruScan/CleanUp/VShield | USR Courier DS 14.4Kb| or GO VIRUSFORUM
From: jp_torunski@chezrob.pinetree.org (JP Torunski)
Newsgroups: comp.virus
Subject: Re: I Need an unattended scanner (PC)
Date: 14 Aug 92 16:30:20 GMT

cass8806@elan.glassboro.edu (KYLE CASSIDY) writes:
> that i can set to scan the disk when i'm not around (like at 3 in the 
> morning) i'm running windows and i leave the machine on 24 hours. are there 

The easiest way would be to scan when you know you won't use the computer 
anymore that day (ie right before bed).

                                        JP

JP Torunski             |       jp_torunski@chezrob.pinetree.org
Straight out of Stittsville, Ontario
Chez Rob's Int'l Mail Exchange 613/230-5307 (data)
From: cohen@fitmail.fit.qut.edu.au (Mr Fred Cohen)
Newsgroups: comp.virus
Subject: Netware and viruses - some new results (PC)
Date: 19 Aug 92 13:06:46 GMT

At QUT, we have set up an experimental network to test viruses in
networked environments, and the first results have just come in -
unbelievable!

I will be talking about this at length at the Virus Bulletin
conference in a few weeks, but I though Virus-L readers would like to
hear a bit before that.

Test 1: Exhaustive test of netware preotection setting on files and
directories against common viruses.

Result: Only 3 of the 15 bits provide any protection - Execute ONLY?
NO GOOD!!!  Read ONLY? NO GOOD!!!

Result: Novell manuals are completely backwards in their depiction of
the rights granted through inheritance!!!  If you follow the manual,
you get wiped out!

Test 2: Exhaustive testing of Unix based server - still underway Test
3: Same for OS/2 LAN Manager - to be reported at conference Other
tests?  Let me know what you want to know, and I will try to do it
ASAP

Conclusion: It is almost impossible to manage netware for safety
against viruses, but it is probably possible if you are a GOOD ENOUGH
sys admin.  More conclusions to follow as they come available.

FC
From: C20260@prime-a.plymouth.ac.uk
Newsgroups: comp.virus
Subject: windows multitasking and viruses (PC)
Date: 14 Aug 92 11:42:36 GMT

I've just read Padgetts comments on the need for scanners to be
reloadable when running with netware, windows etc. My immediate
response is YES! he's absolutely right. In fact I recently emailed
FRISK on the topic of Netware and Virstop, and was pleased to see in
his mailing in this bulletin to the effect that Windows support should
be coming soon. We are making increasing use of both Netware and
Windows, and the problems described by Padgett are very real. In some
areas we can overcome our main problem, boot sector viruses, by remote
booting, but this option is not suitable in all cases, and doesn't
help with file infectors. The frustrating thing is that products like
NAV and CPAV which provide Windows support ( and NAV seems to cope
with a Netware connection) have such mediocre tsr scanners as to be
practically useless. (Yesterday my evaluation copy of CPAV allowed a
Campana/telecom-boot infection to go ahead).

Keith Selmes, University of Plymouth Computing Service.
Do I need a disclaimer in th U.K. ?
From: hurd@sfu.ca (Peter L. Hurd)
Newsgroups: comp.virus
Subject: help, high weirdness (PC)
Date: 14 Aug 92 23:00:04 GMT

Hi, I've been having strange hassles with my machine lately, symptoms
include;
1)  Inability to boot from a floppy.  It boots from c: always, no error
message if I leave a non-bootable floppy in there, and no booting from
a bootable.
2)  Keyboard spaceyness, it gets to thinking that the shift is down, so
even numbers show up as @#$%^, and the alt ,and ctrl keys don't quite
do what I expect them to (usually happens in WP5.1)
3)  My default settings in WP5.1 just reset, my Canadian WP expects US
lexicon, and other things reset to original.
4) QEMM sent me this error twice when loading F-PROT (or was it
VIRSTOP?)

EXCEPTION 13 @ 29FF:0000  ERROR CODE 0000
AX=4904  BX=8BD6  CX=FF13  DX=FF56  SI=8DFF  DI=8C9F  BP=0094
DS=A673  ES=0498  SS=A673  SP=984E  FLAGS=7006

INSTRUCTION: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

5)  VSHEILD sent me this once

VSHEILD 4.9V93
Sorry an impossible internal error occurred
Error code is 8522

6) F-PROT 2.04b and Scan 93 find nothing, although vshield found an
[emp] on a floppy and f-prot concurred, but I think I got that one
before it had a chance to do anything.  F-prot heuristic search
reports that the shareware utility Directory control DC106f.zip
searches for executables.

Problems 4 & 5 occurred without any changes to the programs or
autoexec.bat files, and dissapeared without any changes.

Is it viral? ( He asks the impossible to answer question )
thanks for any help or advice.
- -- 
- -- Pete Hurd, hurd@sfu.ca          |   Truth never set anyone free,
Behavioural Ecology Research Group |   it is only doubt which will
Dept.Biol.Sci., Simon Fraser Univ. |   bring mental emancipation.
Burnaby B.C. V5A 1S6 Canada        |               -- Anton LaVey
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Re: VM viruses from PCs (IBM VM/CMS)
Date: 11 Aug 92 16:08:17 GMT

D03G005@saksu00.bitnet (Umit Dericioglu 4676034 (Work)) writes:
>- - Is there a case of VM virus infiltrated from a PC ?

Mainframe viral programs tend to use source code, mail systems and
interpretters.  Therefore, a terminal is jsut as likely a point of
access as a PC.

>- - What is the usual procedure of uploading files from PCs to VM
>  in the States? I mean, do you let a PC user upload his/her files
>  to VM or are those files scanned by the computer center to make
>  sure that they are "clean" before uploading ?

Object code uploaded from a PC would not "infect" the mainframe in the
sense of becoming active and reproducing or affecting operations.
However, mainframes are often used as file servers for PCs, and
therefore it would be a good idea to scan all software before upload
so that the mainframe does not become a vector for viral spread
amongst the PCs themselves.
 
==============
Vancouver      ROBERTS@decus.ca         | "If you do buy a
Institute for  Robert_Slade@sfu.ca      |  computer, don't
Research into  rslade@cue.bc.ca         |  turn it on."
User           p1@CyberStore.ca         | Richards' 2nd Law
Security       Canada V7K 2G6           | of Data Security