HDTenEightyP/NetNews huggingface dataset:
From: 2007do@ankara2.af.mil (CS/DO;675-3254)
Newsgroups: comp.virus
Subject: re: FLIP (PC)
Date: 1 Oct 92 13:47:39 GMT

Vivek Swarup of moh.gov.on.ca writes:

>On 1 of our PCs CPAV detected some virus but could not tell us which
>one.  We obtained a copy of f-prot V2.02 which indicated this system
>had a FLIP Virus. We obtained a new version of f-port (v2.05) which
>indicated the PC has the TELECOM Virus.  Shortly there after we had

   In the process of testing out some virus-scanning software (time-
trials and such), VirX came up with the following:

=============
                           VIRx Virus Scan Report
      Scan run on: Sep 24, 1992 at 16:04:36                   Page: 1

Scanning: C: 
C: is dirty

109 directories examined.  534 files examined.
6 files infected. 0 viruses removed, 0 files deleted
Boot Record was not infected.
Memory check shows 0 viruses found
Options and arguments:
      - Long Search Enabled.
      - Extra Memory Check Enabled
- -----

C:\CPAV\VSAFE.COM  
   Is infected with the Flip (W) virus. 
C:\CPAV\VWATCH.COM  
   Is infected with the Flip (W) virus. 
C:\CPAV\VSAFE.SYS  
   Is infected with the Flip (W) virus. 
C:\CPAV\VWATCH.SYS  
   Is infected with the Flip (W) virus. 
C:\PCTOOLS\VDEFEND.COM  
   Is infected with the Flip (W) virus. 
C:\PCTOOLS\VDEFEND.SYS  
   Is infected with the Flip (W) virus. 

==========
   All the files had been Scanned with Scan vers 95, with the -AV option.
since removing the validation CRCs, everything comes up clean.

   When running one anti-virus program against another, or files CRCed by 
another, ????...

   Hope this helps....

Henry B. Tindall, Jr., SSgt, USAF
Small Computer Support Center
Izmir Air Station, Izmir, Turkey
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Atari ST Anti-viral archive sites last changed 07 July 1992
Date: 1 Oct 92 18:53:30 GMT

Atari ST Anti-viral archive sites	last changed 07 July 1992

atari.archive.umich.edu
        Jeff Weiner <weiner@atari.archive.umich.edu>
        Service via FTP and mail, FTP preferred.
        Login as "anonymous", password is your mail address.
        For instructions on the mail server, send the message
                help
        to <atari@atari.archive.umich.edu>
        "Index" contains complete listing with descriptions.
        "CompInd.Z" contains same list but is compressed.
        "ls-lR.Z" contains compressed ls -lR listing.
        All anti-viral material is contained in ~atari/utilities/virus
        The IP number for this site is 141.211.164.8, but may change.

twitterpater.Eng.Sun.COM
        Steve Grimm <koreth@twitterpater.Eng.Sun.COM>
        Access to the archives is through mail server.
        For instructions on the archiver server, send
                help
        to <archive-server@twitterpater.eng.sun.com>

uk.ac.hensa.micros
        HENSA/micros Managers <hensa@uk.ac.hensa.micros>
        Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
        NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
        FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
        Software archive for UK higher education sector. Anti-Viral stuff
        is not collected into a distinct area. Hostname is in UK format.
        (This site previously known as uk.ac.lancs.pdsoft.)
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: Product Test 45, Virus Prevention Plus, version 5.10 (PC)
Date: 29 Sep 92 14:03:41 GMT

From:    Chris McDonald ASQNC-TWS-R-SO <cmcdonal@wsmr-emh03.army.mil>:
>    b.  I tested the product on a Zenith 248, MS-DOS 3.30 and on a Gateway 2000
>386/25, MS-DOS 5.0.  The minimum system requirement, according to the
>documentation, is IBM or MS-DOS, version 3.3, 4.0, or 5.0 with 512K of free
>memory.  The documentation does identify that certain hardware vendors, such as
>Wyse, Zenith, Tandon and NEC, may modify DOS resulting in incompatibilities
>with Virus Prevention Plus.

Just a bit of clarification here. I do not have the referenced product however
have experienced some of the incompatabilities alluded to above:

1) Zenith - early PC and XT (models 151, 158, & 159) with the Zenith clock/
   calendar add-on had a habit of writing to the DOS Boot Record (DBR) if
   not told to quit. I have not seen it exhibited on AT (248) or later 
   equipment. Early HP Vectras are said to exhibit the same behavious though 
   I have not seen this.

2) Tandon - uses a custom BIOS that actually checks the BIOS for a valid
   partition table (bravo !), permits boot selection (as do Zeniths and NECs) 
   & will halt the boot if not found. Some earlier Tandons with large disks 
   used a sector size of 1024 bytes instead of 512 bytes. Both have been 
   known to cause problems with non-compliant access control and anti-viral 
   programs.

One final comment on the Zeniths - Several people have noted the boot device
selectability while others have said it does not work. My experience is as
follows - it works but if a hard disk is not found, the BIOS will fall back
to the first floppy drive. This check appears to be made before any BIOS
extensions are loaded thus if the Zenith BIOS is set to "none" as when a
hardcard or non-Zenith-standard controller is used, the BIOS will revert 
to boot from floppy drive A no matter what the setting.

Incidently, for several reasons I consider the Zenith one of the best 
software development/testing machines made and if more companies used them
for Alpha testing, there would be much less buggy code released. In the
best American (Anglo-French ? - well, I like Facel-Vegas too) tradition,
they always seem to be able to do more than you expected. Will admit
they do seem to appreciate a gentle touch.

					Warmly,

						Padgett

               (Zenith donations accepted 8*)
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: A few questions (Stardot/V801/Michaelangelo) (PC)
Date: 29 Sep 92 20:09:51 GMT

> From:    "NBECC::KENNEY" <KENNEY%NBECC.decnet@consrt.rockwell.com>

>- - are StarDot and V801 related?

(Other folks have already answered the other questions very nicely).
Yes!  In fact, the two viruses are called StarDot-789 and StarDot-801.
They differ in that the latter has 12 extra NOPs in it (and other
addresses are adjusted accordingly).  Otherwise they are identical.
Don't know why any anti-virus tool would repair them incorrectly; they
are easy to verify and remove (any "disinfector" that doesn't verify
that it's dealing with the usual virus before removing, or otherwise
make sure that the result is the same as before infection, should of
course be chucked into the sea at once, or at least not used to
disinfect important files).  Perhaps just a bug that they can fix.

- - -- -
David M. Chess                     \    Femmes aux tetes de fleurs
High Integrity Computing Lab       \     retrouvant sur la plage la
IBM Watson Research                \     depouille d'un piano a queue
From: garth@nyx.cs.du.edu (Garth E. Courtois Jr.)
Newsgroups: comp.virus
Subject: I need info on the FORM 1704 virus (Boulder) (PC)
Date: 25 Sep 92 19:14:54 GMT

Virucide detected the FORM 1704 virus on my /XT clone and Central Point
removed it.

I would like to find out more about this virus and the damage it causes,
if any.  Could someone who has knowledge of this call in Boulder at
499-7044, please?

- -garth@nyx.cs.du.edu
Garth Courtois Jr.

- --
- --garth@nyx.cs.du.edu         Garth E. Courtois Jr.        (303)-499-7044 
- --
From: mechalas@mentor.cc.purdue.edu (John Mechalas)
Newsgroups: comp.virus
Subject: Recent IBM Virus List? (PC)
Date: 28 Sep 92 17:21:28 GMT

Where can I find a current list of known IBM viruses that is in the
public domain?  I am looking for virus name, type, disinfectant
method, and short description if possible.  I see a lot of lists, but
most of them are either (a) old or (b) copyrighted.

- -- 
John Mechalas                             [This space intentionally left blank]
mechalas@mentor.cc.purdue.edu
Purdue University Computing Center                 Help put a ban on censorship
General Consulting                                        #include disclaimer.h
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: VIRSCAN detects Yankee-Doodle 2885 (PC)
Date: 29 Sep 92 20:19:41 GMT

> From:    mechalas@mentor.cc.purdue.edu (John Mechalas)

Sorry for the delay in responding!  I was out last week on vacation...

>    1) Does VIRSCAN have a tendancy to cause a false positive
>       for Yankee Doodle?  I think we really do have a virus, but
>       I'd like to check this option anyway.

No!  We know of no 2885 false positives at all, so if you've gotten
reports in multiple files, it's almost certainly a real infection.
(If you'd like to uuencode and send me an infected file, I'd be glad
to verify the exact identity.)

>    2) I check F-Prot's virus base, but of course every virus is
>       labeled differently between scanners.  :)  Which version of
>       Yankee Doodle do we have, as in what does this strain do?

I think F-Prot calls it "Yankee (TP-44)".  Not too atrociously
different!  *8) It's not a fascinating virus; it infects COM and EXE
files, and sometimes plays the tune Yankee Doodle at 5pm.  It also
alters the Bouncing Ball virus, if it finds in in memory, but that
basically never happens so isn't interesting (the alteration causes
the altered BB to eventually stop spreading, as I recall).

- - -- -
David M. Chess                           Objects In Mirror
High Integrity Computing Lab                Are Closer Than They Appear
IBM Watson Research
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Boot sector infected ! Virus ? (PC)
Date: 2 Oct 92 17:03:27 GMT

cj@info.ucl.ac.be (Christine Jacqmot) writes:

> The boot sector has been modified with the following byte sequence:
> 08 01 00 02 00 02 00 00 F8 A0 00 1A 00 0E 00 1A

Are those the -first- few bytes of the boot sector? If yes, then the
boot sector does not contain a virus, it is just damaged. The damage
could have been done by a virus, but there is no virus in the boot
sector.

> The effect is the following one:
> whenever we try to read or write a floppy, the displayed message tells us
> that there is "0 byte free, 0 byte allocated" on the floppy and then,
> the contents of the diskette is lost.

The reason for this is that the Drive Parameter Block table in the
boot sector is damaged.

> The problems began after having used CDROM's which contain demo's of
> products available in sharewares (but maybe this is pure coincidence!)

The damage might have been caused by a buggy program, yes.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Introduction to the Anti-viral archives listing of 01 October 1992
Date: 1 Oct 92 18:50:56 GMT

Introduction to the Anti-viral archives	listing of 01 October 1992

This posting is the introduction to the "official" anti-viral archives
of VIRUS-L/comp.virus.  With the generous cooperation of many sites
throughout the world, we are attempting to make available to all
the most recent news and programs for dealing with the virus problem.
Currently we have sites for Amiga, Apple II, Atari ST, IBMPC, Macintosh
and Unix computers, as well as sites carrying research papers and
reports of general interest.  Updates to these lists are made exclusively
by contributions provided by the readers of this group.  My thanks go
out to the many people who keep this information current.

If you have general questions regarding the archives, you can send
them to this list or to me.  I'll do my best to help.  If you have a
submission for the archives, you can send it to me or to one of the
persons in charge of the relevant sites.

If you have any corrections to the lists, please let me know.

The files contained on the participating archive sites are provided freely
on an as-is basis.

To the best of our knowledge, all files contained in the archives are either
Public Domain, Freely Redistributable, or Shareware.  If you know of one
that is not, please drop us a line and let us know.  Reports of corrupt
files are also welcome.

PLEASE NOTE
The Managers of these systems, and the Maintainers of the archives, CAN NOT
and DO NOT guarantee any of these applications for any purpose.  All possible
precautions have been taken to assure you of a safe repository of useful
tools.

Jim Wright
Canada-France-Hawaii Telescope Corporation
jwright@cfht.hawaii.edu
JWRIGHT@UHCFHT
From: rslade@sfu.ca
Newsgroups: comp.virus
Subject: Macmag virus - spread (CVP)
Date: 24 Sep 92 03:03:48 GMT

HISVIRC.CVP   920903
 
                       MacMag virus - Spread
 
Brandow claims to have infected two computers in MacMag's offices in
December of 1987 in order to "seed" the infection.  It probably
isn't beyond the bounds of possibility that a few deliberately
infected disks were distributed as well.
 
A resource (named DREW in the Hypercard stack and DR in its viral
form) was copied into the System folder on Mac systems.  The System
folder, as the name implies, is the "residence" of the operating
system files.  With the resource based structure of the Mac OS, the
operating system can be configured and customized by "dropping"
resources into the System folder.  (MS-DOS users, tired of fiddling
with entries in CONFIG.SYS, conflicting TSRs and the like, might be
warned that this does not always work as easily as it sounds.)
 
"Bootable" Mac disks contained a System folder, in the same way that
"bootable" MS-DOS disks contain the "hidden" system files and
COMMAND.COM.  In those days, "system" disks were much more common
than they are now.  In addition, Mac users would often create
"system" disks that would have specialized configurations.  (I well
remember, at the time, a number of Macintosh programs which would
work with one specific version of the Finder only.  This would put
the user in the position of having to "downgrade" the computer each
time it was desired to run these programs.)  The Mac OS "opens" each
disk inserted into the machine.  Therefore, on an infected machine,
any diskette which was inserted into the drive would have the MacMag
virus into the system folder.
 
The MacMag viral resource was placed into the folder as an "INIT". 
This meant that it would be one of the "initial" programs
automatically run on system startup.  Many, if not most, INITs are
background or resident programs which either monitor or support
different functions on an ongoing basis.  Therefore, this was a
perfect position for a virus.  On an ongoing basis it would be able
to watch for opportunities to spread.
 
The MacMag virus was not a sophisticated piece of programming.  As
one of the earliest (one of the (rarely used) names for it was the
"Macinvirus") Mac viral programs, it didn't have to be.  (Some would
say that Mac viri don't have to be sophisticated anyway.  Although
the Mac world have far fewer viral strains than does the MS-DOS
world, infection rates of a given virus have tended to be far higher
in Mac populations.)  There is no particular secrecy to the MacMag
virus.  Anyone who looked could find it.  Few, however, looked.
 
copyright Robert M. Slade, 1992   HISVIRC.CVP   920903

==============                      ______________________  
Vancouver      ROBERTS@decus.ca    |    |     /\     |    | swiped
Institute for  Robert_Slade@sfu.ca |    | __ |  | __ |    | from
Research into  rslade@cue.bc.ca    |    | \ \    / / |    | Mike
User           p1@CyberStore.ca    |    | /________\ |    | Church
Security       Canada V7K 2G6      |____|_____][_____|____| @sfu.ca
From: pd@nwavbbs.demon.co.uk (Peter Duffield)
Newsgroups: comp.virus
Subject: Re[2]: NAVSCAN (PC)
Date: 23 Sep 92 02:35:23 GMT

cjkuo@ccmail.norton.com writes:

>Robert Slade reports:
>>> Where can i get NAVSCAN?  or When its gonna be out?
>
>It is on Compuserve in the following locations: NORUTL, VIRUS, IBMSYS,
>and UKFORUM.  It is available from the Symantec BBSs: 2400:
>408-973-9598, 9600: 408-973-9834. 

You will also find it for anonymous ftp on wuarchive.wustl.edu in the
directory /pub/MSDOS_UPLOADS

Peter
- --
Peter Duffield                      pd@nwavbbs.demon.co.uk (Internet)
Voice: +44 244 545669               BBS: +44 244 550332

North Wales Anti-Virus Support BBS, FidoNet: 2:250/201, VirNet: 9:441/110
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: F-PROT 2.05a -- available yet ??? (PC)
Date: 3 Oct 92 10:13:28 GMT

mramey@milton.u.washington.edu (Mike Ramey) writes:

>A message from Fridrik Skulason dated 18 Sep 92 announced his intention to
>"upload 2.05a right after this weekend".  Have I missed it?  Is it
>available?  If so, where?  Thanks, -Mike Ramey, UW, Seattle.

Nope - you did not miss anything - there have just been some delays.
I am spending a part of my time on a major revision of the program, so
adding detection/disinfection of the 150+ new viruses does not get
quite as high priority as usually.

The revised "upload" date is Monday, Oct 5th.

- -frisk
From: A.APPLEYARD@fs1.mt.umist.ac.uk
Newsgroups: comp.virus
Subject: Computer virus used for attempted blackmail
Date: 30 Sep 92 07:44:03 GMT


>From UK newspaper "Daily Telegraph", Wed. 30 Sept 1992 p4 col4:-

<Lecturer in 'computer virus threat'>
  A university lecturer tried to blackmail a client company in a
dispute over pay by threatening to inject a computer virus into its
computer, Newcastle upon Tyne Crown Court was told yesterday. Do.Roy
Booth, 28, a computer studies expert, made the threat when the firm,
IMEC, of Washington, [a small town in] Tyne and Wear [in NE England,
<NOT> USA!], refused to pay his 400 pound hotel telephone bill after
he had flown to Phoenix, Arizona [USA], to develop a program for an
American company, the court heard. He had run up the bill in telephone
calls to his wife, who was pregnant. Mr.Christopher Prince,
prosecuting, said that Booth, of Gateshead, Tyne and Wear, retaliated
by placing a message in the company's computer which read: "Files are
being suitably modified so that strange things will begin to
happen...". Dr.Dooth, of Newcastle University, denies blackmail, but
Mr.Prince said: "It may be true that he didn't put the virus into the
machine, but the issue is whether he was making a demand for money
when menace.". The trial was adjourned until today.
From: MEDAL@mail.crk.umn.edu (Don Medal)
Newsgroups: comp.virus
Subject: "Eagle has landed" = virus??? (PC)
Date: 29 Sep 92 20:28:48 GMT

I have a user how swears her computer sometimes comes up with the
following message flashed briefly on the screen:

    "The eagle has landed"

and that it usually won't boot.  I must say I panicked, dug out our
crusty tools and couldn't find anything.  I can't find any reference
in the lists to this phrase, but I have this annoying feeling that
I've read of it once in this context.

When our user support guy goes and checks the machine it checks ok
(Central Point AV) and all *he* sees is "Eagle II VGA Bios" on the
screen for an instant.  The user is adamant that she is correct...

Does anyone recognize the first phrase ("The eagle has landed") as
meaning anything?

Thanks for any help.  We aren't allowed to shoot users here.
   Don
- ----------------------------------------------------------------------
Don Medal                                   internet: medal@mail.crk.umn.edu
Dir UMC Computing Services
116 Dowell Hall             voice:(218) 281-6510 ext 432  home:(701)746- 7779
Crookston, MN  56716          fax:(218) 281-5223
- ------------------------------------------------------------------------ -
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Apple II Anti-viral archive sites last changed 07 July 1992
Date: 1 Oct 92 18:52:59 GMT

Apple II Anti-viral archive sites	last changed 07 July 1992

brownvm.bitnet
        Chris Chung <chris@brownvm.bitnet>
        Access is through LISTSERV, using SEND, TELL and MAIL commands.
        Files are stored as
                apple2-l xx-xxxxx
        where the x's are the file number.

uk.ac.hensa.micros
        HENSA/micros Managers <hensa@uk.ac.hensa.micros>
        Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
        NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
        FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
        Software archive for UK higher education sector. Anti-Viral stuff
        is not collected into a distinct area. Hostname is in UK format.
        (This site previously known as uk.ac.lancs.pdsoft.)
From: hani@gu.uwa.edu.au (Hani Jabr)
Newsgroups: comp.virus
Subject: Stoned on non-dos partition (PC)
Date: 30 Sep 92 05:17:55 GMT

The machine at work is currently running on non-standard PC-MOS 
version 6.1 to 6.2.

This is bad.

A stoned virus has somehow attatched itself to the hard disk and copies
itself to all the floppies inserted in all the floppy drives.

I would appreciate anyone getting back to me about how Stoned works, 
or where it may rest on the hard disk.  The simple solution of deleting 
the partition and reinstalling won't work because the program we use
has a database, backed up and infected. 

Thanks for any help you may give me.

P.S. Any information on Stoned will probably be helpful, so don't
hesitate mail me.

[HAN]
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Recent IBM Virus List? (PC)
Date: 2 Oct 92 16:14:08 GMT

mechalas@mentor.cc.purdue.edu (John Mechalas) writes:

>Where can I find a current list of known IBM viruses that is in the
>public domain? 

If you find one, let me know :-)

Seriously, there is no list that is 100% up to date - with several new
viruses arriving every day it is not possible.  You can get a
reasonably good list from several sources, but no 100% complete.

 I am looking for 

      virus name: Yeah, me too  :-) ....unfortunately, there is still a lot of
                  naming confusion in this field.

      type: I assume you mean "Reasident/Non-resident" and what it infects,
	    right ?

      disinfectant method: I am not sure what you mean by this - I don't
            any publically avalible virus list described the method to
            disinfect them.
            
- -frisk