HDTenEightyP/NetNews huggingface dataset:
From: PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics)
Newsgroups: comp.virus
Subject: Re: I Need an unattended scanner (PC)
Date: 16 Aug 92 22:16:25 GMT

cass8806@elan.glassboro.edu (KYLE CASSIDY) writes:
> 	I'm using V-shield93 right now, and i'm wondering if i should use 
> this in conjunction with a more sophisticated scan program, but i'd like one 
> that i can set to scan the disk when i'm not around (like at 3 in the 
> morning) i'm running windows and i leave the machine on 24 hours. are there 
> programs that do this?

Look for the program WCRON, which lets you schedule programs to be run
under MS Windows. I think it came out in comp.binaries.ibm.pc in
volume 15, and it is on at least wuarchive for anonymous ftp in
/mirrors2/win3/util.

Of course, the problem is to get a decent scan when running under
windows, since there are some restrictions on raw disk accesses and
what happens to the warning message if it does find a problem, but (I
think) you should do fairly well with other programs in the Vshield
family.

I think there's still room for an automatic virus scanner/change
detector that runs "in the background" - even as part of a screen
saver? Anyone got one of those?? As the complexity of virus detectors
increases (to cope with lots of new and sophisticated viruses) I
suspect that scan-as-you-load programs will have to go, while
change-detect-as-you-load (or as part of disk compressiuon schemes, as
padgett suggested), and scan-as-you-write-to-disk or scan-when-idle
systems will be more popular.

Mark Aitchison.
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Re: Jerusalem virus (CVP)
Date: 11 Aug 92 16:31:30 GMT

>  Robert Slade writes:
>>addition of the virus code to the end of the file, with a redirecting
>>jump added to the beginning of the program.
>
>This is accurate for infection of EXE files, but not for COM files.

Yep.  Blew that one.

>>                        ....  In an effort to avoid anti-semitism, it
>>was referred to by its "infective length" of 1813 bytes.  For COM
>>files.  ....
>
>I agree with almost everything here, but I think it's a bit presump-
>tuous to conclude that the reason for the name "1813" had anything to

True.  However I *do* recall a message (in the early days before V-L)
by one Y. Radai complaining that it was unfair and possibly
anti-semitic to call it the Israeli virus ...  :-) In any case, a
warning to me not to get too cute.  Apologies.

>>Press article, and, of course, made much of.  It also gave rise to
>>another alias, the I.D.F. virus.
>
>I think you're confusing the Jerusalem with another virus here.  The
>above story and name fit the Frodo (= 4096) virus.  To the best of my
>knowledge, they do not fit the Jerusalem.

Absolutely correct, I *did* get the names mixed up.  When I went back
and checked the files, I found that the alias for the Jerusalem
arising out of this was only "Defence Forces", not IDF.  It was, in
any case, used only rarely and for a short time.
 
==============
Vancouver      ROBERTS@decus.ca         | "A ship in a harbour
Institute for  Robert_Slade@sfu.ca      |  is safe, but that is
Research into  rslade@cue.bc.ca         |  not what ships are
User           p1@CyberStore.ca         |  built for."
Security       Canada V7K 2G6           |           John Parks
From: cass8806@elan.glassboro.edu (KYLE CASSIDY)
Newsgroups: comp.virus
Subject: I Need an unattended scanner (PC)
Date: 12 Aug 92 14:54:23 GMT


	I'm using V-shield93 right now, and i'm wondering if i should use 
this in conjunction with a more sophisticated scan program, but i'd like one 
that i can set to scan the disk when i'm not around (like at 3 in the 
morning) i'm running windows and i leave the machine on 24 hours. are there 
programs that do this?
	sorry for taking the lazy way out and posting this.

	thanks.

- -- kyle cassidy
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Where's Waldo?! Was: Re: Waldo ?? (PC)
Date: 18 Aug 92 07:07:50 GMT

Hello Mr. Reeves,

The "Waldo" message is an error message from Windows version of CorelDraw.
I was under the impression that this error message only appeared in beta
test versions of the software (which would be usually limited to a few
beta test sites) but it may have been present in the production version.
You should be able to contact the manufacturer for a patch.

Regards,
 
Aryeh Goretsky
Technical Support

/in reply to/
treeves@magnus.acs.ohio-state.edu (Terry N Reeves) writes:
>Anyone know of a virus/trojan/joke/ etc that self-identifies as Waldo?
>
>I have not seen it, unfortunately I have only a sketchy report of a
>message seen periodically on a pc running windows 3.1 & corel draw
>2.0.  I ma told a "waldo virus" is identified. Unfortunately I can't
>even be sure the word virus was in the actual message.
>
>f-prot 2.04c finds nothing not even with heuristic scan. (two false +
>only) scan 93 ditto.
>
>Anyone??
- -- 
- - - -
McAfee Associates        | Voice (408) 988-3832 | mcafee@netcom.com  (business)
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | ObQuote: "Log... from Blammo"
Santa Clara, California  |                      | 
95054-3107  USA          | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
ViruScan/CleanUp/VShield | USR Courier DS 14.4Kb| or GO VIRUSFORUM
From: dklefkon@well.sf.ca.us (Richard W. Lefkon)
Newsgroups: comp.virus
Subject: Preliminary Conference Announcement
Date: 18 Aug 92 20:49:43 GMT


                  (preliminary announcement 8/92)
 
SIXTH INTERNATIONAL COMPUTER VIRUS & SEURITY cONFERENCE
 
WED-FRI  MARCH 10-12,  NEW YORK'S PENN STATION RAMADA AND THEATRE MARRIOTT
 
Spons. by DPMA Fin. Ind. Ch. in coop with ACM-SIGSAC,
BCS, CMA, Computerworld, COS, EDPAA/ph, ISSA/ny, IEEE-CS
 
GROUP PRICES:
    $975  for  FOUR registrants (one new)
    $1185 for  FOUR registrants (all first time attendees)
    $178 on-site nightly lodging for FOUR (2 rooms) 
             (individual registration - divide by 3)
 
  5 TRACKS - 53 VENDORS - 91 SPEAKERS - Learn the Latest Practical Expertise
 
   Concentrations include CIO/SVP, LAN, Technical/Research, Justice, Telecom

Every Registrant Receives 800+ Page Complete Bound Proceedings
 
Session speakers and chairs include
 
Klaus Brunnstein (Hamburg), Fred Cohen (ASP), Tom Duff (AT&T),
Harold Highland (Compulit), Stuart Katzke (NIST), Karl Levitt (Davis),
Guillermo Mallen (Mexico), Bill Murray (Deloitte), Eiji Okamoto (Japan),
Jane Paradise (Apple), Donn Parker (SRI), Padgett Peterson (Martin-Marietta),
Gene Spafford (Purdue), Gail Thackeray (Phoenix), Ken van Wyk (CERT/CMU),
Bill Vance (IBM).
 
To learn about the other 74 speakers (papers are still arriving), please
 
WRITE:   Ides of March Conference, Box 894, New York, NY 10268
 
CALL:    (800) 835-2246 x190
 
FAX:     (303) 825-9151
 
E-MAIL:  jsb@well.sf.ca.us
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Re: help, high weirdness (PC)
Date: 18 Aug 92 23:42:03 GMT

hurd@sfu.ca (Peter L. Hurd) writes:
>Hi, I've been having strange hassles with my machine lately, symptoms
>include;
>1)  Inability to boot from a floppy.  It boots from c: always, no error
>message if I leave a non-bootable floppy in there, and no booting from
>a bootable.

What kind of a computer do you have?  Several models have CMOS/BIOS
options which allow you to disable floppy booting, or to "boot" from
the B: drive.

>2)  Keyboard spaceyness, it gets to thinking that the shift is down, so
>even numbers show up as @#$%^, and the alt ,and ctrl keys don't quite
>do what I expect them to (usually happens in WP5.1)

This is very widely known and seen behaviour, and I see it myself more
often in Word Perfect than in other programs.  (Mind you, I use WP a
*lot*.)

>3)  My default settings in WP5.1 just reset, my Canadian WP expects US
>lexicon, and other things reset to original.

Again, this is a very common problem.  All you have to do is go back
into the "initial setting" setup and tell it that you want to use the
UK langauge modules.  (If it doesn't find this info, it "defaults" to
the US files.)

>4) QEMM sent me this error twice when loading F-PROT (or was it
>VIRSTOP?)

We've had a report about this type of thing, and I believe frisk is
working on it.

>5)  VSHEILD sent me this once
>
>VSHEILD 4.9V93
>Sorry an impossible internal error occurred
>Error code is 8522

Only once?  how often do you use it (ie. boot up)?

>6) F-PROT 2.04b and Scan 93 find nothing, although vshield found an
>[emp] on a floppy and f-prot concurred, but I think I got that one
>before it had a chance to do anything.  F-prot heuristic search
>reports that the shareware utility Directory control DC106f.zip
>searches for executables.

Well, that sounds like a reasonable thing for a disk/program manager
to do.

>Is it viral? ( He asks the impossible to answer question )
>thanks for any help or advice.

Nothing you have said so far sounds like there is any viral activity.

>- -- Pete Hurd, hurd@sfu.ca       
>Behavioural Ecology Research Group
>Dept.Biol.Sci., Simon Fraser Univ.

Check with Bill Kloubek or myself.
 
============= 
Vancouver      ROBERTS@decus.ca         | "Remember, by the
Institute for  Robert_Slade@sfu.ca      |  rules of the game, I
Research into  rslade@cue.bc.ca         |  *must* lie.  *Now* do
User           p1@CyberStore.ca         |  you believe me?"
Security       Canada V7K 2G6           |    Margaret Atwood
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Scan93 Calls Michangelo "Stoned" (PC)
Date: 18 Aug 92 12:33:50 GMT

voorhis@aecom.yu.edu (Adrienne Voorhis) writes:

>      There has been some discussion recently about how (unnamed
> versions of) McAfee's Scan program are announcing an infection by
> Stoned when other virus scanners are calling it Michelangelo.

>      A copy of Michaelangeo that I have saved from April 1992 is
> detected by Scan89 as Michaelangeo, but is detected by Scan93 as
> Stoned.  My guess is that other posters that have reported this
> phenomenon are not dealing with a new variant of Michaelangelo.  It's
> just that the newest version of Scan got sloppy and detects all
> Michealangeo infections as Stoned.  (I haven't heard that
> Michaelangelo has any other strains detected.)

Your guess is correct. SCAN has become significantly worse in virus
identification since version 89. Since Michelangelo is indeed a Stoned
variant, it is not surprising that SCAN detects it as such.

>     Not knowing the actual virus that has infected your machine can be
> a real problem.  Previous posts, for example, have described the
> special problems that users face when disinfecting a computer that has
> been infected by both Stoned and Michelangelo.  If the scanner does
> not even distinguish between the two, how is the user supposed to know
> why he or she is having no luck disinfecting the computer?

A very good argument why exact virus identification is very important!

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev           Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226       Fachbereich Informatik - AGN
** PGP public key available by finger. **     Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de     D-2000 Hamburg 54, Germany
From: ygoland@edison.SEAS.UCLA.EDU (The Jester)
Newsgroups: comp.virus
Subject: Request For Information (PC)
Date: 11 Aug 92 09:30:51 GMT

I have recently joined this group and the Virus Research community in
general and am looking for information regarding viruses, the more
technical the better. More specifically, however, I am looking for
information regarding the hardware level set up of the IBM pc.  For
example:Information regarding what interupts exist, what their
location is, and what triggers them. The fundamentals behind the bios,
the structure of a disk boot record, etc. Basically information
regarding all the things viruses destroy or use to replicate
themselves. I would ask for virus code but having seen what an
irrational outbreak this causes, I will refrain (grin).

Towards this end I have accessed all sites listed in the 'Anti-viral
Documentation archive sites' I got from this list. I have amassed 4
megs of information and have reviewed all of it and have read in
detail 90% of it (I should have the last few articles done by
tomorrow). Unfortunatly there is a definate 'conspiracy of silence' in
these papers as they regularly refuse to go into the sort of detail I
need in order to write an anti-viral product. While the reasoning
behind this may be that this also prevents me from writting a virus, I
assure you that if this is the intention, its a futile one. But, from
what I'v seen so far, this debate is a long winded one and has been
re-treaded far to many times for me to seriously rehash it now.
Suffice it to say that I am looking for more detailed information
regarding encryptions used, modes of transportation, and most
importantly:Specifics on IBM pc architecture. My goal is to determine
the feasability of writting an active protection program which will be
loaded before whatever os the 80x86 machine is running and act as a
'supervisior'. To this end I have nicknamed my idea TRON, based on the
movie of the same name.

	Thank you for your time,
			Yaron (The Jester) Goland
- --
			The Jester
"You can lead a herring to water, but you have to walk really fast,
or he'll die."-Stolen from my Evil Mistress (TM)
               NWILSON@MIAVX1.ACS.MUOHIO.EDU
From: ebazergh@gmuvax.gmu.edu
Newsgroups: comp.msdos.programmer,comp.lang.c++
Subject: WANTED: Serial port data exchange code
Date: 22 Aug 92 17:56:33 -0500
Organization: George Mason University, Fairfax, VA.

I'm looking for code which can help me add an HEAD-TO-HEAD modem play
feature to a game I am currently writing for IBM Compataibles.
What I need is the basic way of getting the computers on both sides to wait
until the other is ready, then the actual exchange of info while the
game is being played. I already have a library of serial routines, so please
don't send me a reply with library names. I need actual code or even
pseudo-code in order to help me implement this feature.
 
Can anyone help me?
 
THANX!
 
P.S. Please reply by E-MAIL, I rarely visit this newsgroup...
 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 Eric R. Bazerghi                    |      BitNet:  EBAZERGH@GMUVAX.BITNET
 Student                             |    InterNet:  EBAZERGH@GMUVAX.GMU.EDU
 George Mason University             |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 4400 University Drive               |  What do you have when a room is half
 Fairfax, VA  22032                  |  full with women who have PMS and half
                                     |  full with women with yeast infections?
                                     |  A whine and cheese party!
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 
Newsgroups: comp.msdos.programmer,comp.graphics,comp.sys.ibm.pc.programmer
From: leo@zelator.in-berlin.de (Stefan Hartmann)
Subject: Re: Direct SVGA memory access
Organization: Puplic-Access-Xenix-System
Date: Thu, 20 Aug 92 20:02:29 GMT

In <1992Aug20.141357.20611@alw.nih.gov> gregh@alw.nih.gov (Gregory Humphreys) writes:

>Okay.  I want to write to SVGA memory without using BIOS calls on my 486.  I can do it great with int 10, but it's slow as all hell.  What is happening is after I calculate the address for the VRAM, everything is getting modded into the top 64k of VRAM (one display pages worth, I guess).  Imagine the 1024x768x256 screen sectioned into 12 horizontal bars, and anything that you write is put into the TOP one.  ANyhow, I think this is because I'm not changing display pages.  So I tried Three things:

>1)

>void Plot(x,y,Color)
>int x,y,Color
>{

>	int Page
>	long offset;
>	char far *address;

>	Page = y/64;
>	outport(0x3CD,Page);

>	offset = 1024*y + x;
>	address = (0xA0000000L + offset);
>	*address = Color;
>}


>2) 


>void Plot(x,y,Color)
>int x,y,Color
>{

>	int Page
>	long offset;
>	char far *address;
>	char far *PageAddress;

>	Page = y/64;
>	PageAddress = MK_FP(0000,0x462); /* The Low Memory address of the current
>						Page Number */

>	*PageAddress = Page;	

>	offset = 1024*y + x;
>	address = (0xA0000000L + offset);
>	*address = Color;
>}

>3)

>void Plot(x,y,Color)
>int x,y,Color
>{

>	int Page
>	long offset;
>	char far *address;
>	
>	Page = y/64;
>	
>	_AH = 5;
>	_AL = Page;

>	geninterrupt(0x10);

>	offset = 1024*y + x;
>	address = (0xA0000000L + offset);
>	*address = Color;
>}
>	
>The Third one at least gave me some results - everything I had drawn got moved to the bottom half of the screen and above it was about 300 horizontal blue bars that flickered a lot.  Any ideas?  This is a Trident 8900 card w/ 1 meg VRAM on a 486/33 using Borland C++ 3.0.  HELP ME DAMMIT!  Can you tell I'm frustrated? YES!!!!


>-- 
>Greg Humphreys    |  "Playing not to win is like sleeping with your 
>gregh@alw.nih.gov |  sister - sure, she's a great piece of tail, 
>                  |  and she's got a bag full of goodies, but it's 
>(301) 402-1817    |  just plain illegal."  -Charlie Sheen, "Hotshots"

Hi,
get yourself VGAKIT41.ZIP  ! it is a driver library for all SVGA cards
in 256 color modes.
So if you includes these drivers into your program, it will work on
the most standard SVGA cards..

It is available on some FTP-servers. Just ask archie. It is ASM and
C-Source-code. Also there is VESAVGA.ZIP a vesa driver library.

Best regards Stefan Hartmann.
email to: leo@zelator.in-berlin.de


-- 
 
*************************************************************
*  Stefan Hartmann       This is how to contact me:         *
*  EMAIL: leo@zelator.in-berlin.de                          *
*  Phone : ++ 49 30 344 23 66      FAX : ++ 49 30 344 92 79 *
*************************************************************
Xref: sparky comp.msdos.programmer:39 comp.graphics:9016 comp.sys.ibm.pc.programmer:345
From: gregh@alw.nih.gov (Gregory Humphreys)
Newsgroups: comp.msdos.programmer,comp.graphics,comp.sys.ibm.pc.programmer
Subject: Direct SVGA memory access
Date: 20 Aug 92 14:13:57 GMT
Organization: National Inst. of Health, DCRT, CSL

Okay.  I want to write to SVGA memory without using BIOS calls on my 486.  I can do it great with int 10, but it's slow as all hell.  What is happening is after I calculate the address for the VRAM, everything is getting modded into the top 64k of VRAM (one display pages worth, I guess).  Imagine the 1024x768x256 screen sectioned into 12 horizontal bars, and anything that you write is put into the TOP one.  ANyhow, I think this is because I'm not changing display pages.  So I tried Three things:

1)

void Plot(x,y,Color)
int x,y,Color
{

	int Page
	long offset;
	char far *address;

	Page = y/64;
	outport(0x3CD,Page);

	offset = 1024*y + x;
	address = (0xA0000000L + offset);
	*address = Color;
}


2) 


void Plot(x,y,Color)
int x,y,Color
{

	int Page
	long offset;
	char far *address;
	char far *PageAddress;

	Page = y/64;
	PageAddress = MK_FP(0000,0x462); /* The Low Memory address of the current
						Page Number */

	*PageAddress = Page;	

	offset = 1024*y + x;
	address = (0xA0000000L + offset);
	*address = Color;
}

3)

void Plot(x,y,Color)
int x,y,Color
{

	int Page
	long offset;
	char far *address;
	
	Page = y/64;
	
	_AH = 5;
	_AL = Page;

	geninterrupt(0x10);

	offset = 1024*y + x;
	address = (0xA0000000L + offset);
	*address = Color;
}
	
The Third one at least gave me some results - everything I had drawn got moved to the bottom half of the screen and above it was about 300 horizontal blue bars that flickered a lot.  Any ideas?  This is a Trident 8900 card w/ 1 meg VRAM on a 486/33 using Borland C++ 3.0.  HELP ME DAMMIT!  Can you tell I'm frustrated? YES!!!!


-- 
Greg Humphreys    |  "Playing not to win is like sleeping with your 
gregh@alw.nih.gov |  sister - sure, she's a great piece of tail, 
                  |  and she's got a bag full of goodies, but it's 
(301) 402-1817    |  just plain illegal."  -Charlie Sheen, "Hotshots"
Newsgroups: comp.programming
From: ar559@cleveland.Freenet.Edu (Jan Buitenhuis)
Subject: Software Publisher Sought
Organization: Case Western Reserve University, Cleveland, Ohio, (USA)
Date: Thu, 13 Aug 92 17:04:21 GMT


Hello,

I am looking for a Software Publisher that's
potentially interested in publishing a 
software development tool for MS Windows.

Does anybody know one?

Thanks, Jan
Xref: sparky comp.programming:2304 comp.unix.programmer:4291 comp.lang.c:12307 comp.arch:8898
From: desj@ccr-p.ida.org (David desJardins)
Newsgroups: comp.programming,comp.unix.programmer,comp.lang.c,comp.arch
Subject: Re: What would you like in a debugger?
Date: 14 Aug 92 01:54:48 GMT
Organization: IDA Center for Communications Research, Princeton

Stephen R. van den Berg <berg@physik.tu-muenchen.de> writes:
>- The ability to single step in a disassembly window (next to the source
>  window), priceless at the times that you have narrowed down the problem,
>  looked over the code over and over, can't see the bug, suspect a compiler
>  error, and want to make sure.

I'd like to see source-level debugging of assembly language.  I don't
know about other systems, but the Cray Research debugger (cdbx), for
one, doesn't support this.  Note that this isn't at all the same as just
disassembling the instructions; the debugger should handle
assembly-language symbols and macros.

Given this, you could hope for something better than what Stephen asked
for.  Given the original source code in a high-level language (say, C),
and the assembly language output by the compiler, it would be especially
nice to be able to do source-level debugging on both simultaneously.
Perhaps the way to do this would be some command for switching between
the C source and the assembly-language source.

This would also make sense with other forms of interactive code.  For
example, switching between C++ source and the intermediate C code
produced by cfront.

                                        David desJardins
From: avh@usho34.hou281.chevron.com (Alan V. Hardin)
Newsgroups: comp.programming
Subject: what skills does a programmer need
Date: 16 Aug 92 19:37:26 GMT
Organization: Chevron


I have worked for a big Oil company for 13 years as a programmer,
and we have been shrinking along with lots of other companies.
One thing I have noticed is that the company was going in one
direction, especially with computers and data processing, and then
recently changed direction - unix and c.  If the people, including
programmers, did not make the transition, basically on their own,
they were lopped off.  

We are certainly following a trend of buying more software than
developing lately, and buying expertise we do not have yet.  My
real question is how much time do most of the programmers spend out
there on education and keeping up with the latest trends, or are
most of you like we were, kept pretty busy in the same environment
using a lot of local tools.  

Also what kind of skills most a programmer have today, if he wants
to have a good chance at getting another job, once your current company
eventually dumps on you.  Are things like unix, c, c++, yacc, lex,
make, X, motif, and windows MUSTS or is the fact you have been
developing algorithms and working with computers for 10+ years enough.

So the two quetions are,  how much of your time goes to training,
and what kind of skills are musts for programmers to have today.
-- 
   | Alan V. Hardin, Seismic Division      Mail: avh@chevron.com |
   | Chevron Exploration Services Co.      Tel:  (713) 596-2059  |
   | P.O. Box 42832                        Fax:  (713) 596-3041  |
   | Houston, Texas  77242-2832            Home: (713) 935-0414  |