HDTenEightyP/NetNews huggingface dataset:
From: KDC@ccm.UManitoba.CA (Ken De Cruyenaere 204-474-8340)
Newsgroups: comp.virus
Subject: Taking it offline
Date: 15 Dec 92 21:57:37 GMT

>From:    mcafee@netcom.com (McAfee Associates)

>Given the already-existing number of anti-viral product-related
>messages on comp.virus (and VIRUS-L) lately, perhaps it would be best
>to do this offline in email.
  (some stuff deleted)
>Aryeh Goretsky
>Technical Support

Thank you Aryeh.
Taking specific conversations offline to email is a great suggestion!

I think that, generally speaking, everyone who posts to the digest
should ask themselves

 'Do I really want to send this to thousands of people
  (who may think "<sigh> s/he must like to hear her/himself speak")
  or does this only apply to one or two people?'

This digest is a terrific resource, we should make an effort to
keep it from turning into something nobody likes...

  Ken

- ----------------------------------------------------------------------
 Ken De Cruyenaere      "Having SMOKING and NON-SMOKING sections in a
Security Coordinator    room is like have URINATING and NON-URINATING
 Computer Services      sections in a swimming pool."
University of Manitoba
Bitnet: KDC@CCM.UManitoba.CA   Voice:(204)474-8340  FAX:(204)275-5420
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Integrity Management
Date: 11 Dec 92 18:12:56 GMT

72461.3212@CompuServe.COM (Ross M. Greenberg) writes:

> >...Have just noticed that one of the major anti-virus houses has completed
> >the addition of effective integrity management with the ability to
> >use a single file for storage of all data for checking by their TSR
> >instead of relying on snippets on the end of each program.
>  
> C'mon now, Padgett: my own Virex-PC code has had this ability for
> something like two years.  Heck, even Flu_Shot+ has had that since Day
> One (well, since version 1.1, at least) which means that it's been
> available for about four years by this time...

Well, maybe by "effective" Padgett also means "efficace" (sp?)
integrity checking? I mean, in Bulgaria I've seen a program, that
when run, used to modify COMMAND.COM of PC-DOS 3.30 in such a way that
it displayed the string "FluShot+ is STUPID! Press any key to continue"
and waited for a keypress each time the command interpreter was run...
This was achieved using tunneling techniques, so FluShot didn't detect
the modification of the file on-line. Furthermore, the file was
modified in such a way, that the (rather trivial) checksum algorithm
of FluShot+ didn't detect the changes... I can hardly call such
integrity checking "effective"...

Besides, Padgett does not claim that some company has suddenly
invented the integrity checking; all he says is that a company that
did not provide such features in their package, has finally decided to
do so... This is always good news; let's only hope that the integrity
checking provided will be secure enough...

Regards,
Vesselin

P.S. No, I wasn't on vacation; I attended the EICAR anti-virus
conference in Munich, so I was absent for about a week... :-)
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: aryeh@mcafee.com (McAfee Associates)
Newsgroups: comp.virus
Subject: SCAN for OS/2 uploaded to mcafee.COM... (OS/2)
Date: 11 Dec 92 19:24:46 GMT

I have uploaded to mcafee.com

pub/antivirus
OSCAN99.ZIP     SCAN for OS/2 Version 99 scans OS/2 PC's for viruses

VIRUSCAN for OS/2

This is the first release of SCAN for OS/2 (OS2SCAN).
Like it's DOS-based counterpart, VIRUSCAN (for DOS), OS2SCAN
searches PC's for computer viruses. However, OS2SCAN contains
several important differences:

- -     Since OS/2 operates in a protected mode environment it can
      only check its own area of memory or "memory image" for
      viruses.  Viruses in a DOS session or VDM will not be
      detected in memory by OS2SCAN.

- -      OS2SCAN checks "extended filenames" and HPFS-partitioned
       drives as well as DOS (FAT) drives.

- -      OS2SCAN does not have the /CHKHI, /M, /MAINT, /NOMEM,
       or /UNATTEND switches that VIRUSCAN does.

- -      The /SAVE switch does not modify the OS2SCAN.EXE file.
       Instead, it creates a SCAN.INI file.

- -      OS2SCAN does not return an ERRORLEVEL for DOS batch files.

OS2SCAN Version 99 detects all viruses the current version of VIRUSCAN
does and is otherwise similar to VIRUSCAN.

NOTE:  OS2SCAN requires IBM OS/2 Version 2.00(GA) or above.


VALIDATE for OS/2

To validate the OS2SCAN.EXE file for changes and/or tampering, a new
version of the VALIDATE program has been created, OS2VAL.EXE.  It
should be used to validate all OS/2 executable files, as the DOS-based
VALIDATE.COM will return incorrect information for Check Method 1 if
run against an OS/2 .EXE file.


OTHER OS/2 PROGRAMS

CLEAN-UP for OS/2 (OS2CLEAN.EXE) is still in the beta-test cycle and
should be available around the end of the month.


VALIDATE values are as follows:

SCAN FOR OS/2 V99 (OS2SCAN.EXE)     S:178,352  D:12-09-92   M1: 78A3  M2: 10CA
VALIDATE for OS/2 (OS2VAL.EXE)      S:39,824   D:12-09-92   M1: BFD6  M2: 09DB

Regards,

Aryeh Goretsky
McAfee Associates Technical Support

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET: aryehg@mcafee.COM
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | IP# 192.187.128.1
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Preventive Methods (PC)
Date: 11 Dec 92 08:16:13 GMT

fwilliam@dev1.smcm.edu (Frank Williams) writes:

>I am looking for software that will prevent an infected floppy diskette  
>from transfering a virus to a hard disk.

Sorry - this is not really possible.  You cannot use software to *prevent*
the hard disk from becoming infected, if you boot from an infected floppy disk,

This can be achived via hardware methods, but software can only detect boot
sector infections after the fact - not prevent it.

- -frisk
From: OPQ@PSUVM.PSU.EDU
Newsgroups: comp.virus
Subject: Pink dos color -Virus? (PC)
Date: 13 Dec 92 05:41:32 GMT

Help! My default dos foreground color is Pink not low intensity white.
Is this possibly a virus? I booted from a protected floppy master disk
- - no change!  Virustop runs but identifies no virus. My screen turned
pink in the middle of a Kermit download. I use NOrton contro center
and it indicates that my default color is a pink but in the low
intensity white position in the selection chart. I try to change the
color but when I exit to dos the default is back. Any ides gladly
accepted.
From: cjkuo@ccmail.norton.com (Jimmy Kuo)
Newsgroups: comp.virus
Subject: Memory Detection methods, was: Filler Virus (PC)
Date: 10 Dec 92 02:15:04 GMT

Kevin Markus responds to my posting as follows:
>>BTW, you will not (or should not  :-)  ) see this conflict with NAV.
>>NAV does a more sophisticated search through memory with knowledge of
>>where viruses store themselves.

>Hmm.  That doesn't sound like the most brilliant thing.  It doesn't take
>too long to search through memory, and it's easy for a varient to move
>to a different place in memory.  Or pick a random spot.

If it's a variant, it's a new virus and this line of thought is
meaningless.  A writer of a new variant has the available antivirus
products to make sure they do not detect his new variant so it doesn't
matter how you go about it.  He just doctors his virus, trial and
error, until it no longer gets picked up.

If it's not a new variant, we do detect those viruses that have the
capability of placing itself randomly in memory.  I did say "more
sophisticated."  :-)

Jimmy Kuo                                       cjkuo@ccmail.norton.com
Norton AntiVirus Research
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Stoned Virus (PC)
Date: 16 Dec 92 23:15:37 GMT

a2js@loki.cc.pdx.edu (Jahed Sukhun) writes:

>I am using a FPROT 2.06a.  When I am checking the hard disk for
>viruses, FPROT comes with a message:

>          A NEW VARIANT OF THE STONED VIRUS WAS FOUND. 
>          NO ATTEMPTS TO DISINFECT.

>It doesn't give a name to it or anything.  

Well, of course it does not give a name - it does not match any of the
known variants.

There are several possibilities:

    1) Really a new variant.
    2) An old variant, perhaps corrupted by something, so the checksum
       does not match.
    3) Previously infected, but incorrectly disinfected.

However, without further information I really cannot say what is going
on.

>I have FPROT set to the following settings:

>          -    User defined Strings          Yes

You should not use this, unless you have actually defined some new
strings...othewise it will just slow the program down a.

- -frisk
From: soth@spock.uucp (Samid Hoda)
Newsgroups: comp.virus
Subject: Jerusalem (Israeli) Virus (PC)
Date: 14 Dec 92 12:44:01 GMT


	I need some information on the Jerusalem B virus as it has
infected almost every single file on my system. Does anyone know how
it spreads and how it spreads so fast? Any advice in getting rid of
the virus would be appreciated( except for a low level format as that
is an obvious option.)

- -- 

 ---------------------------------------------------------------------------
/       soth@choate.edu                                                    /
- ---------------------------------------------------------------------------/
- -  _     _     __    __      _______       ____    __    _______  _    _  -/
- - /_/   /_/\  /__/\ /__/\    \  *  /      /___/|  /_/\  /______/ /_/  /_/ -/
- - | |  / _\/| | ||| | _\/|    \ | /      / ___|/ / _\/| |_____|/ |||__||| -/
- - | |_ || | | |--|/ || | |  \  \_/       |_|__/| || | |   | ||   ||/__||| -/
- - | |_/||_|/  ||\\ \||_|/ -+|========>   /__\ || ||_|/    | ||   ||---||| -/
- - \___|\__/   ||/\\/|__/    /            |____|/ \__/     |_|/   ||/  ||/ -/
- ---------------------------------------------------------------------------/
From: Malte_Eppert@f6002.n491.z9.virnet.bad.se (Malte Eppert)
Newsgroups: comp.virus
Subject: Vshield vs Virstop (PC)
Date: 7 Dec 92 22:54:00 GMT

Hi Francisco!

 > Hi All! I have a small question, Which antivirus TSR would you
 > recommend me to use? Vshield or Virstop?

I recommend to check out the new TBAV utilities. I've just tested
them, and - what can I say - they're great. They really don't
interfere even with complex low-level programs after they're correctly
installed, don't eat up much memory and provide multi-layered
protection. They even prevent many stealth-type viruses from
tunneling. Not absolutely perfect (I got Armageddon to successfully
infect a file after allowing it to go TSR), but: nice game this time,
Thunderbyte!

cu!
eppi

- --- Via SCANTOSS V 1.37
 * Origin: No Point for viruses - The EpiCentre! (9:491/6002)
From: mha@baka.ithaca.ny.us (Mark Anbinder)
Newsgroups: comp.virus
Subject: Re: MAC-disk replication-virus? (Mac)
Date: 10 Dec 92 19:23:47 GMT

Mr Gordon S Byron says...

> A user brought my an external 40 MB Hard Disk yesterday which
> she said "wouldn't work". After using various SCSI tricks I got
> the dosk to mount. It replicated itself 6 times on the desktop?

This is characteristic of a SCSI ID problem.  It's possible that the
drive is set to SCSI ID 7, which is reserved for the Macintosh itself.
If not, it may have the same ID as another SCSI device on the chain,
or the controller may be bad.

I would suggest not trying to write to the drive.  Aiming for the one
"in the middle" doesn't work as well with SCSI volumes as with
participants in drunken brawls. :-)

                  PLEASE ACKNOWLEDGE THIS MESSAGE.  
  Some of my outgoing mail has not been arriving at its destination.
- ---------------------------------------------------------------------
 Mark H. Anbinder               |      Technical Support Coordinator
 BAKA Computers Inc.            |              mha@baka.ithaca.ny.us
 200 Pleasant Grove Road        |               (or) mha@tidbits.com
 Ithaca, New York 14850 USA     |   Phone 607-257-2070  Fax 257-2657
- ---------------------------------------------------------------------
From: ygoland@edison.SEAS.UCLA.EDU (The Jester)
Newsgroups: comp.virus
Subject: Request For Polymorphic Virus paper references
Date: 17 Dec 92 08:07:13 GMT

I am currently writing a paper on polymorphic virus design and
detection. The paper's focus is on designing self modifying programs
(my interest in this area comes from my interest in Artificial
Intelligence, the concept of a program that can alter it's own code
facinates me) as well as problems associated with detecting a specific
polymorphic virus.

However I have no desire to reinvent the wheel. Along
this line I have been trying to track down any articles written on
the subject. Unfortunatly, UCLA's computer index leaves a bit to be
desired when it comes to finding virus articles and books. As such
any pointers to articles and books that address the issues of
polymorphic viruses would be appretiated. I am not interested in
loading mechanisms, distribution mechanisms, or payload design. Just
the mechanisms of causing a program to swap, insert, encrypt, or
otherwise alter itself so as to fool scanners and like programs.

		Thank you,
			Yaron (The Jester) Goland
			Junior-Computer Science & Engineering
			University Of California, Los Angeles
- -- 
For some reason unintelligible to me, Lord Acton's dictum that
"Power tends to corrupt and absolute power corrupts absolutely"
is rarely raised in connection with judges, who...possess power
.that comes [close] to being absolute"-Judge Bork
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Filler virus (PC)
Date: 11 Dec 92 17:31:47 GMT

tck@fold.ucsd.edu (Kevin Marcus) writes:

> >BTW, you will not (or should not  :-)  ) see this conflict with NAV.
> >NAV does a more sophisticated search through memory with knowledge of
> >where viruses store themselves.
> >
> Hmm.  That doesn't sound like the most brilliant thing.  It doesn't take
> too long to search through memory, and it's easy for a varient to move
> to a different place in memory.  Or pick a random spot.

Not really. It's rather hard to simply patch a virus, so that you
completely modify its memory installation strategy and still produce a
closely related variant. It's almost certain that you'll get a
completely different virus, which would be detected by a different
scan string.

I suppose that NAV is doing something similar to TbScan/HTScan - each
virus is described with the area of memory it can occupy. Such areas
could be: INT (in the interrupt table), DOS (in a memory hole in DOS),
LOW (as a normal TSR, like Jerusalem), TWIXT (shortening the last MCB
and copying itself above it), VIDEO (in the video buffer), UPPER (in
the memory between the video buffer and the 1 Mb boundary), AT (at a
particular segment), etc. There are a few other possibilities, which I
cannot recall off the top of my head.

This restricted memory search usually works in most cases. That is, it
is silly to look for Stoned in the DOS buffers, when you know that it
installs itself after the top of memory pointed by the BIOS variable
at 0:413h... The method has problems only in a few cases - for
instance, the Number of the Beast and a couple of other viruses
install themselves in the DOS buffers. When you copy an infected file,
there is fair chance that the virus code (although inactive) will be
found in one of these buffers - which is exactly where you should look
for this virus in the first place. The solution is to check whether
the signature is found in an -existing- DOS buffer (when the real
virus installs itself in a buffer, it removes that buffer from the
chain of the available ones), but I know about no program that bothers
to do that...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: chess@watson.ibm.com (David M. Chess)
Newsgroups: comp.virus
Subject: Re: OS/2 Viruses (OS/2)
Date: 9 Dec 92 18:33:20 GMT

> From:    William Webber <webbew@aron01.gs.com>

> Does anybody have any information about OS/2 viruses.

There are currently no known viruses that run under native OS/2.
However, OS/2 DOS sessions are sufficiently compatible that many DOS
viruses function normally there.  So if your machine has DOS sessions,
you may get and spread DOS viruses. Even if your machine doesn't have
DOS sessions, it might inadvertantly serve as a vector for a DOS
virus, by transporting an infected DOS program, or an OS/2 program
with an infected OS/2 "fork" (the code that just prints "This program
requires OS/2" or whatever).  Also, an OS/2 machine can become
infected with a boot-record-infecting virus, since they are basically
operating-system-independant (they run before OS/2 is loaded).  For
technical reasons, existing boot infectors will not spread further
from an infected OS/2 system, but you still don't want the virus
around...

DC
From: sai@kauri.vuw.ac.nz (Simon McAuliffe)
Newsgroups: comp.virus
Subject: Re: Untouchable (PC)
Date: 13 Dec 92 08:07:57 GMT

Nemrod_Kedem@f101.n9721.z9.virnet.bad.se (Nemrod Kedem) writes:

> I've checked this package and I keep getting updates for it. It
> ability to detect unknown viruses is *VERY* good and also it's restore
> engine is good.  I've seen it in action when the Emmie virus was
> found. Untouchable detected changes in the infected files are restored
> them whitout any delay. The restored files where 100% as the original
> uninfected files.

Earlier this year a represtative from Fifth Generation Systems was in
New Zealand showing Untouchable off to the public.  At that time I had
only seen fairly early versions of Untouchable and it definitely was
NOT untouchable.  The newer versions are pretty good though.  Making
random modifications to files or corrupting files doesn't stop
Untouchable for making repairs.  Every time the files come out 100%
restored.  I was quite impressed at the time.

While I am quite impressed with Untouchable, I know of some infection
techniques which it does not detect and cannot recover data from.
Untouchable is not completely generic and it is certainly not
untouchable.  I imagine it won't be long before there are a number of
viruses using infection methods which Untouchable will not detect so
don't put too much faith into it.
From: g.s.byron@stirling.ac.uk (Mr Gordon S Byron)
Newsgroups: comp.virus
Subject: disk replication problem (Mac)
Date: 15 Dec 92 14:03:10 GMT

Thanks to all of those who replied re the disk replication. It turned
out the user *had* changed the SCSI switch and set it to 7. I changed
it to 1 and was soon able to recover files and fix the Allocation
taBLEs. Thanks for all msgs
gordon
From: Malte_Eppert@f6002.n491.z9.virnet.bad.se (Malte Eppert)
Newsgroups: comp.virus
Subject: TBAV 5.01 (PC)
Date: 7 Dec 92 23:19:00 GMT

Hello Vesselin!

You wrote about TBAV 5.01:

 > BTW, the integrity checking seemed -very- weak to me, but I have
 > not tested it completely...

By default TBCHECK checks only the entry point of an executed file.
(You can set it to check the whole file's CRC, but that's documented
to be real slow.)  That's what I think to be the weakness, but could
you explain why? Are there many link viruses (guess that's what
TBCHECK is written for) which don't touch the entry point at infection
time?

BTW: I managed to have Armageddon infect a file after I allowed the
virus to go TSR, though I've activated the whole product palette.
What's that - a special way to put its code into a file, which TB
doesn't recognize?

cu!
eppi

- --- Via SCANTOSS V 1.37
 * Origin: No Point for viruses - The EpiCentre! (9:491/6002)
From: gaw2@cunixa.cc.columbia.edu (Gang Wu)
Newsgroups: comp.virus
Subject: noint - what is it? (PC)
Date: 17 Dec 92 17:42:45 GMT

anyone has any idea what noint virus is? we discovered several of them
here in barnard college and it seemed that the virus can physically
destroy the floppy disk (all the disks we found infected by this virus
has numerous bad sectors after the infection.)

Gang
gaw2@cunixa.cc.columbia.edu
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: "Benevolent" Viruses
Date: 17 Dec 92 19:52:07 GMT

>From:    bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)

>This is a result of the misunderstanding of the definitions. I know at
>least three anti-virus packages, which are "benevolent viruses",
>according to Dr. Cohen's definition. The supervisor installs them on
>the LAN server -once- and each time a user logs in, the package
>automatically installs (or updates) itself on the user's workstation.
>Therefore, the package propagates from the server to the workstations
>like a virus (or like a worm, if we want to be precise).

The interesting fact is that as far as I know this is a concept that
was originally discussed here on V-L with explicit specification two
years ago (before Fred's contest in fact - Anthony ?).

>There's nothing bad in the above...Therefore, there are no ethical problems 
>involved - - if you don't like that policy, don't use that LAN.

Exactly. The same argument may be used about privacy concerns and ANI/
Caller-ID dial-up logging.

				Warmly,
					Padgett


 Just as a final final note, for those who do not wish to bother
 with DEBUG to determine which DOS 5.00 CHKDSK.EXE you have and
 do not trust dates, the following PKZIP CRC-32 and VALIDATE
 results are given:

 PKUNZIP (R)    FAST!    Extract Utility    Version 1.1    03-15-90

 Length    Date    Time   CRC-32    Name
 ------    ----    ----   ------    ----
  16200  04-09-91  05:00  8e2aba28  CHKDSK.EXE  (dangerous)
  16200  11-11-91  05:00  59dbaefb  CHKDSK.EXE  (with "bug fix")

McAfee Validate 0.3 numbers:

          File Name:  chkdsk.exe
               Size:  16,200
               Date:  11-11-1991
File Authentication:
     Check Method 1 - 19D8
     Check Method 2 - 16E2

"Most version numbers have the same relation to reality as the Chevrolet
 horsepower figures that put a '67 Z-28 @ 290 and a '69 L-88 at 430" 
        (and are probably produced by the same people).
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: MS-DOS CHKDSK & why VER /R may not work (& something that might) (PC)
Date: 14 Dec 92 20:05:17 GMT

>From:    Mike Ramey <mramey@u.washington.edu>
>Subject: RE: Dangerous bug in CHKDSK that comes with MS-DOS 5.0 (PC) (fwd)

>I called Microsoft and requested the updated version for my computer
>labs, even tho' we have not encountered the failure conditions yet.  I
>was told that in MS-DOS version 5.0a, the date on COMMAND.COM is
>11-11-91.

Just tried the VER /R trick after booting from a (relatively) old floppy
with IO.SYS, MS-DOS.SYS, and COMMAND.COM all dated 03-22-91 5:10a. Guess
what the report was:

MS-DOS Version 5.00
Revision A
DOS is in low memory

Further, COMP finds no difference between this COMMAND.COM and the one I
just expanded from a new set of distribution disks that is dated 11-11-91.

However, COMP *does* find a difference between the earlier CHKDSK.EXE and
the one dated 11-11-91, which has a three byte change (to make sure that
the CH value is cleared ?)

Assuming that this is causing the problem, DEBUG will find the string: 

 8b 4f 0f 8b f9 (MOV CX,[BX+0F] MOV DI,CX) at offset ds:263e in the "old" and
 8b 7f 0f 32 ed (MOV DI,[BX+0F] XOR CH,CH) is at the same offset in the "new"

CHKDSK.EXE. Both are 16,200 bytes long.

Sounds like there may be more than one revision A  (or why ver /r is
undocumented).

					Warmly,
						Padgett

Note: this was done without any advice/observations from Mircrosoft &
      only represents what I found in minimal testing. Caveat y'all.