HDTenEightyP/NetNews huggingface dataset:
From: MC0170@mclink.it (Stefano Toria)
Newsgroups: comp.virus
Subject: Virus questionnaire, pls
Date: 19 Aug 92 09:15:31 GMT

I am planning to set up a survey to obtain some information on the
extension and characteristics of the virus problem in Italy.

The idea would be to gather figures on facts such as:

- - number of reported events
- - number of affected PCs
- - means of identification of the viral nature of the event
- - reported strain and variant
- - nature, extension and cost of the cure
- - etc.

Putting into practice one of Rob Slade's sound advices on prevention,
I have already assumed that I am going to fail :-) i.e. that I am
going to have a response rate <= 0.1% after the third poll. But I wish
to go on anyway; the question is where can I obtain (by e-mail or ftp,
if possible) information that I can use to set up a good questionnaire
without having to start from scratch and re-invent the wheel.  I know
for sure that this kind of surveys are being regularly performed
somewhere in the world; the ideal thing would be to lay my hands on a
question sheet for one of the latest issues.

My total, eternal gratitude :-) shall go to anyone who shall provide
even the leanest shred of help on the subject.

Stefano Toria
- - ------------------------------------------------------------------------
Stefano Toria  <mc0170@mclink.it> |
MC-link, Rome, Italy              | "Godi fanciullo mio: stato soave,
Voice: (+ 396) 4180300            |  stagion lieta e' codesta"
Fax:   (+ 396) 8413057            |
- - ------------------------------------------------------------------------
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Troi Virus (PC)
Date: 11 Aug 92 08:41:21 GMT

king@ug.cs.dal.ca (Brian David King) writes:

>set to 00-02-80. Checking by hand, we found approximately 25 of these
>files, yet scan only detected 17 infections. Is there any way of being
>sure they are all removed?

Sure...use a different scanner :-)  :-)

- -frisk
From: padgett%tccslr.dnet%uvs1@uvs1.orl.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Floptical Disk Update
Date: 11 Aug 92 15:02:06 GMT

You may recall that some months ago I mentioned some products that are
liable to cause a step cahnge in how we think about PCs. One was Disk
Compression and the other was Floptical Disks.

Disk Compression (being software) was accepted first. Floptical Drives
took a bit longer but in this weeks InfoWorld (Aug. 10 pg 78) I see that
the hardware is here and getting close to the predicted price (touch
higher on the drive/lower on the disks).

I know nothing about the company other than I plan to order some disks
for my drive but the virtues of 21MB (42 MB compressed) floppy storage
are evident.

The first thought from an anti-virus standpoint is the ability to have
an entire software recovery suite on a single disk. Those of you
fortunate enough to have Bernoulli drives know how much of an advantage
this can be ( oops, just infected everything with 4096 - no problem, just 
recover the whole 40 MB from the image file).

The other advantages should be obvious: mail/fax/bbs system that only 
spins when needed. OS/2 on a single floppy (compressed). No more
hour-long swap-the-floppy installations.

Now if they would just come out with a plug replacement module to connect
to a regular floppy controller....

				Warmly,

					Padgett
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Forward of Re: viruses (PC)
Date: 11 Aug 92 08:37:34 GMT

KARGRA@GBA930.ZAMG.AC.AT writes:

>Eric Webb asked, if it would be a good advice, to use f-prot's tsr
>under windows, too. I think yes, but don't know if it works. Did not
>try it until now.

Nope, it is not of much use.  I am working on designing a Windows version
of my F-PROT package, but the current VIRSTOP only works within DOS, not
under Windows.

- -frisk
From: ocl@cc.imperial.ac.uk (Olivier M.J. Crepin-Leblond)
Newsgroups: comp.virus
Subject: Re: Jerusalem virus (CVP)
Date: 18 Aug 92 14:06:43 GMT

Y.Radai denies ever objecting to the name "Israeli" virus but
remembers objecting to the name PLO given to the virus by some people.
I remember his message regarding the above. The coincidence of dates
was due to the triggering of the virus on friday 13th.  It was finally
agreed that political issues regarding Israel and the middle east in
particular were to be ignored in this case, because there was no
evidence (and there still isn't any) that the virus was written for
political purposes. In fact, some pointers now show the origin of the
virus to be Italy - not at all the same part of the world. Moral of
the story: a new virus can be isolated in a different country than
where it originated.

PS. I was indeed surprised when Padgett advanced the theory of
anti-semitism, which I had never heard of before.  Maybe the ":-)" had
something to do with it...

O.
- -- 
Olivier M.J. Crepin-Leblond, Digital Comms. Section, Elec. Eng. Department
 Imperial College of Science, Technology and Medicine, London SW7 2BT, UK
      Internet/Bitnet: <ocl@cc.ic.ac.uk> - Janet: <ocl@uk.ac.ic.cc>
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: McAfee GENP/GENY identification (PC)
Date: 18 Aug 92 11:18:03 GMT

james.roy@synapse.isis.org writes:

> I certainly agree that IDEALLY one would like to identify the exact
> virus and be able read up about it and also have a utility to clean it
> out of the system.

> However, in practice, there are too many viruses coming out for any
> anti-virus company to keep up, you risk not getting updates in time even
> if available, cleaning is not 100%, new polymorphic viruses are
> self-mutating and as they improve will become invisible to scanners and
> other heuristic techniques.

> Rather than look for the perfect scanner, one should accept their
> limitations and only use them as gross filters for incoming software.

The above is, of course, true in general. However, some scanners ARE
better than others. The fact that a particular scanner (SCAN in this
case) is not able to provide good virus identification, does not mean
that good virus identification is impossible. It just means that this
particular scanner is a rather poor tool for identifying viruses. For
instance, Dr. Solomon's Anti-Virus ToolKit provides MUCH better
identification than McAfee's SCAN (I am not comparing the other
features), regardless that both products exist in one and the same
virus population.

> Generic protection virus control is essential in a modern computing

They are just one line of defense. I would refrain from calling it
"essential", but I agree that it is useful.

> Our firm distributes Victor Charlie which can deal with all known and
> unknown viruses.

My deep regards to your company and to the product (greetings to Alan
Dawson if you happen to see him), but please refrain from claims that
it can deal with unknown viruses. I have seen the product about two
years ago. It had the same claims associated with it, yet it miserably
failed to deal even with some of the existing viruses. Polymorphism
and advanced stealth were serious obstacles against it then.

I do not doubt that it has been much improved since then, yet I am
pretty sure that it won't be able to deal with all unknown viruses...
The virus authors out there are pretty ingenious, you know... I
strongly doubt that a single company is able to thinks of and prevent
all kinds of attacks, let alone of all possible but still unknown
attacks.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev           Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226       Fachbereich Informatik - AGN
** PGP public key available by finger. **     Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de     D-2000 Hamburg 54, Germany
From: ygoland@edison.SEAS.UCLA.EDU (The Jester)
Newsgroups: comp.virus
Subject: os/2 changes to boot sector (OS/2)
Date: 18 Aug 92 19:41:43 GMT

(Note:This post is being crossposted to comp.os.os2.apps and
comp.virus in the hopes that one,or both, of the two groups can be of
service)

I currently run a program called 'Integrity Master' by Wolfgang
Stiller. Among other things, this program checks the boot sector of
each partition against a copy it made of the partition,
to detect any changes. My harddrive is a 210 western digital
pyranna(sp) which is currently set up with three partitions:
	OS/2 Boot Manager Partition-A 1 meg partition 
	Dos Partition-A 1 meg partition
	FAT/HPFS-I have one last partition which is 200 or so megs
		 and is then subdivided into two logical partition,
		 the first is fat and the second is hpfs.

For further reference paritions and logical partitions will be
refered to as follows:
	C Drive-The 1 meg dos partition
	D Drive-The first logical drive in the last partition, it is
		of type FAT.
	E Drive-The second logical drive in the last partition, it
		is of type HPFS.

My Problem is as follows:When I run IM (Integrity Master) under os/2
to initialize the boot sector, I don't have any problems. However if
I then change to dos, dos will say that the D drive boot sector
has changed! In addition it will say that there is a self executing
program in my D drive dos boot sector! In addition if I then do NOT
re-initalize my data (i.e. its still comparing my current boot
sector to the picture it has in it's memory) and return to os/2, 
IM will still say that there is a problem! Matters are further
complicated by the fact that I just had a cmos failure. The specific
failure was that my harddrive and both my disk drives settings were
set to 'disabled'. This could very well be a battery failure (even
though I'v only had the mother board for 6 months) and I am getting
a batter pack to take care of that eventuality. Finally, thinking
that this was all very strange, I ran scan 93 which reported that
everything was fine. In addition, other than my mysterious cmos
erasures, I have not had any problems running dos, os/2, or any of
my applications.

My Question is as follows:Does os/2 change the boot sector of
drives under it's control? In addition, I understand why my first 1
meg, boot manager, partition would have a self booting program in it
but why should my D drive have one? Os/2 does NOT boot from D drive
and dos boots from C drive! So should there be a self running
program on my D drive? I'm very concerned as this sort of activity
is standard viral activity. And finally, is there any known virus
which targets cmos and clears out sections of it? 

Thank you for all help, answers can be posted or mailed to me as I
am an avid reader of both groups and I regularly read my mail.

	Thanks again,
			Yaron (The Jester) Goland
- --
"Only the blind see in color."
"Any union based upon pigment is foolish ignorance designed to
give power to those few who enjoy power's taste above the common
welfare."
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Is "Bloody" a virus? (PC)
Date: 18 Aug 92 10:41:46 GMT

lewin@brokaw.lcs.mit.edu (Jonathan Lewin) writes:

> My PC has begun to display the words "Bloody" and "Jun 4, 1989" on
> boot-up.  Is this a known virus? 

Yes, it is. It is a Stoned variant and infects in a similar way. There
are at least 4 different known variants.

> If it is, could someone PLEASE tell
> me, and advise me how to get rid of it? 

Since it is a master boot sector infector, to remove it from your hard
disk it is enough to boot from a DOS 5.0 system diskette and execute
FDISK /MBR. After that you can boot from your hard disk and examine
all diskettes. The virus can be removed from the infected ones - just
copy the files from them somewhere else, then reformat the diskette
and copy the files back. Make sure that the virus is not memory
resident and active, otherwise it will re-infect the diskettes. Most
popular scanner/removers like F-Prot and CLEAN are able to remove this
virus.

> The PC it is on is vital to a
> small company, and I don't want it to start losing files.

Due to way it infects disks, it may damage some hard disks and
high-capacity diskettes when it infects them. Therefore, the damage is
noticed at once. If it has not damaged your hard disk, it means that
it won't do it in the future. However, diskettes with strange formats
(e.g., backups made by some backup programs) might be irreparably
damaged.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev           Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226       Fachbereich Informatik - AGN
** PGP public key available by finger. **     Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de     D-2000 Hamburg 54, Germany
From: jody@lib.haifa.ac.il (Yosef Branse)
Newsgroups: comp.virus
Subject: Need Advice on Evaluating and Ordering Antivirus Software (PC)
Date: 19 Aug 92 10:53:41 GMT

I am not very knowledgeable about computer viruses, but I need some
advice regarding antivirus software from an administrative angle.

I want to install such software in the library's ATs, a number of
which are in a public area for searching CDROM databases. We have had
several incidents of viruses getting into the hard disks via the
diskettes used for downloading the results of searches. (I can't write
protect the hard disk, because then the CDROM search software falls;
it needs to write to the disk.)

I currently have McAfee's VSHIELD (version 89) installed at these
sites, and it works well, as far as I can tell. I know how to use SCAN
and CLEAN when an infection occurs.

I understand that in order to make the installation legal, I'll need a
site license. Since I am just a small cog in a large institution, that
means a formal purchase request, and I may need to justify the
selection.

This brings me to my main question: what evaluation criteria are used
in selecting antivirus software? Are there studies available - a la
Consumer Reports - of the various programs, recommending the best
ones? I am satisfied with the McAfee product, but I have access to
FPROT and could obtain others if need be.

Price, of course, is another concern. How do the various packages
compare in terms of their charges for site licensing? Do they offer
special rates for academic institutions?

Any information or references to previous material - whether in
published form, or available via E-mail or FTP - would be greatly
appreciated. I don't need an extensive technical analysis of any
program, just an overall evaluation of its efficacy and
price-worthiness.

Thank you

****************************************************************************
* Yosef (Jody) Branse             University of Haifa Library              *
*                                 Mt. Carmel, Haifa 31905, Israel          *
*                                 Tel.: 972 4-240288                       *
*                                 FAX:  972 4-257753                       *
* Israeli U. DECNET: HAIFAL::JODY                                          *
* Internet/ILAN:     JODY@LIB.HAIFA.AC.IL                                  *
****************************************************************************
From: krvw@cert.org (Kenneth R. van Wyk)
Newsgroups: comp.virus
Subject: Macintosh virus rumors (Mac)
Date: 17 Aug 92 18:07:06 GMT

Over the weekend, numerous reports of a potential new Macintosh virus,
(tentatively) named "Aliens 4" have been floating around the networks.
After speaking with the originator of the report and having received
numerous (5 and counting, so far) cross-postings of the preliminary
reports, I would like to stress the need for calm, rational response
to this problem.  A couple of critical facts:

o The virus, if indeed it is a virus, has not yet been isolated and
  analyzed.
o As such, the preliminary reports were based on rough, empirical
  observations, and may well be incorrect and/or incomplete.  At the
  very least, these preliminary reports are not sufficient to
  disinfect any systems.

I am sure that we (as a community) are all grateful for the work that
is being done to isolate and analyze this virus, but until more
information is known about it, we must be careful to not jump to
conclusions, since this only serves to promote panic.

Everything posted about the virus until it has been properly analyzed
is strictly conjecture.  For this reason, I will NOT be re-posting any
of the preliminary bulletins to VIRUS-L/comp.virus until the virus has
been analyzed.

Calmly,

Ken

Kenneth R. van Wyk
Moderator VIRUS-L/comp.virus
Technical Coordinator, Computer Emergency Response Team
Software Engineering Institute
Carnegie Mellon University
krvw@CERT.ORG       (work)
ken@THANG.PGH.PA.US (home)
(412) 268-7090  (CERT 24 hour hotline)
From: padgett%tccslr.dnet%uvs1@uvs1.orl.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: 4096 (frodo) false alarm? (PC)
Date: 12 Aug 92 12:41:48 GMT

>(How on earth can random memory or parts from tsr's I load look like
> a 4096 virus???)

Actually not that difficult. All scanners look for strings in memory,
generally in the range of 8-20 bytes long. Though 4096 reduces
available memory when it loads, you are *assuming* that SCAN (or
whichever) only checks that part of memory. T'aint necessarily so
since it is famous for detecting inactive viruses in the disk buffers.

One cross-check is the memory count that scan gives while searching
memory since this indicates the 64k block currently being searched.
For the 4096, if this is not at the TOM, it either is not an active
virus OR it's not the "plain vanilla" 4096. (I suspect that this last
is the reason SCAN does not restrict 4096 memory SCAN to the TOM. Then
again...).

What apparently happened was that Windows *happened* to put a string
in memory matching the 4096 signature (remember the room full of
monkeys with typewriters). The question is: would you rather have an
occasional false alarm or false "safe". Even Vessilin admits that SCAN
is one of the better detectors, its main liability is in identifying
what it has detected, but then that's why everyone has more than one
protection layer, right ?

This is a natural fallout of the competitive nature of the business
that has put a higher premium on speed of scanning than accuracy
(editorial).

						Warmly,
							Padgett
From: RADAI@vms.huji.ac.il (Y. Radai)
Newsgroups: comp.virus
Subject: Re: Jerusalem virus (CVP)
Date: 14 Aug 92 13:46:22 GMT

Robert Slade writes, concerning the Jerusalem virus:
>>>                        ....  In an effort to avoid anti-semitism, it
>>>was referred to by its "infective length" of 1813 bytes.  For COM
>>>files.  ....
>>
>>I agree with almost everything here, but I think it's a bit presump-
>>tuous to conclude that the reason for the name "1813" had anything to
>>do with avoiding anti-semitism.  ....
>
> True.  However I *do* recall a message (in the early days before V-L)
> by one Y. Radai complaining that it was unfair and possibly
> anti-semitic to call it the Israeli virus ...  :-)  ....

Sorry, but your recollection is not too accurate.  I never used the
term "anti-semitic" in anything I ever wrote on viruses, and I never
complained about the Jerusalem virus being called the "Israeli" virus.
(Quite the opposite!  I even submitted a report on the virus in
_Computers & Security_, entitled "The Israeli PC Virus".)  The only
complaint I made concerning its name was against calling it the "PLO"
virus, and this not because of anti-semitism, but simply because there
was never the slightest shred of evidence for the PLO's having a hand
in it.  The whole story about "terrorist" authorship was apparently
invented by a journalist in the NY Times of 31 Jan 1988, and his
reason for advancing that hypothesis was nothing more than the
coincidence of dates (as I determined through personal correspondence
with him).

Hmm, on the other hand, since June 92 we now have the Palestinian
virus (the author calls it the "M.S Jurusalem Virus" and claims to be
a "Palestinian Boy").  For those unfamiliar with this virus, it's a
non-resident virus which prepends 15392 bytes to COM/EXE files, writ-
ten in Pascal.  It displays a political message, but claims "to avoide
making any damage to your files" (this is apparently not always true).

                                     Y. Radai
                                     Hebrew Univ. of Jerusalem, Israel
                                     RADAI@HUJIVMS.BITNET
                                     RADAI@VMS.HUJI.AC.IL
From: JFORD@UA1VM.UA.EDU (James Ford)
Newsgroups: comp.virus
Subject: New Uploads on risc (PC)
Date: 19 Aug 92 15:25:06 GMT

Two files have been uploaded on risc.ua.edu (130.160.4.7) in the
directory /pub/ibm-antivirus:

File validation info: (size/date/val1/val2)
htscan18.zip  103,976  8-13-1992   2B21   1E71     (replaces htscan17.zip)
vsig9207.zip   29,352   8-2-1992   C16E   135D

(This VSIG9207.ZIP should just replace the previous vsig9207.zip, the
 only difference being the 'forgotten' safety-checksum).

- ----------
If I had my life to live over again, I'd make the same mistakes sooner.
- ----------
James Ford -  Consultant II, Seebeck Computer Center
              The University of Alabama (in Tuscaloosa, Alabama)
              jford@ua1vm.ua.edu, jford@seebeck.ua.edu
              Work (205)348-3968  fax (205)348-3993
From: george@mulgulgum.asis.unimelb.EDU.AU (George Ferenc)
Newsgroups: comp.virus
Subject: Re: Waldo ?? (PC)
Date: 18 Aug 92 03:09:37 GMT

treeves@magnus.acs.ohio-state.edu (Terry N Reeves) writes:
> Anyone know of a virus/trojan/joke/ etc that self-identifies as Waldo?
> 
> I have not seen it, unfortunately I have only a sketchy report of a
> message seen periodically on a pc running windows 3.1 & corel draw
> 2.0.  I ma told a "waldo virus" is identified. Unfortunately I can't
> even be sure the word virus was in the actual message.
> 
> f-prot 2.04c finds nothing not even with heuristic scan. (two false +
> only) scan 93 ditto.

Hi,

This is not a virus. If you are runing an old (i.e. not the latest)
version of Corel Draw under Windows 3.1, the program will crash when
you use the 'Blend' function. It worked fine under Windows 3.0.

Hope it helps,

George.
- -- 
o*****************************************************************************o
* George Ferenc       Information Technology Services, Melbourne University   *
* Analyst/Prog...     No, Software Engineer. At least it's trendy.            *
* E-Mail address      george@asis.unimelb.EDU.AU                              *
* Tel. (B/H)          (03) 344 6393                                           *
* Tel. (A/H)          Are you kidding ?                                       *
o*****************************************************************************o
* Trying to establish voice contact. Please talk to your keyboard.            *
o*****************************************************************************o
From: exuptr@exu.ericsson.se (Patrick Taylor)
Newsgroups: comp.virus
Subject: Re: Floptical Disk Update
Date: 14 Aug 92 14:55:44 GMT

padgett%tccslr.dnet%uvs1@uvs1.orl.mmc.com (A. Padgett Peterson) writes:

>The other advantages should be obvious: mail/fax/bbs system that only 
>spins when needed. OS/2 on a single floppy (compressed). No more
>hour-long swap-the-floppy installations.

Of course, there's probably a Murphy law like "as soon as you get a larger
media, someone figures out a reason to use even larger installations".
 ----------------------------------------------------------------------------
    "This must be Thursday.  I never could get the hang of Thursdays"
                                                       - D Adams
  - Patrick Taylor
    Ericsson Network Systems
    exuptr@exu.ericsson.se                       "Don't let the .se fool you"
    alternately, exuptr@ZGNews.Lonestar.Org