HDTenEightyP/NetNews huggingface dataset:
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Stacker and viruses (PC)
Date: 2 Apr 92 14:35:35 GMT
Organization: Lehigh University

In Message 26 Mar 92 00:31:06 GMT, wales@CS.UCLA.EDU (Rich Wales) writes:

>I wrote the following a few days ago:
>
>	As I've said above, there is no reason to avoid Stacker
>	or other compressing disk drivers out of concern over
>	viral infection.

There is one reason - (but I'm not saying it's a good reason)

We have several "stealth" viruses that work on a file basis - that is,
when an anti-virus program opens a file for scanning the virus may
intercept the operation, and either disinfect the file (and infect it
again when it is closed) or mess with the read operations, so that the
file appears "clean".

One way to bypass these viruses is to access the file system on a lower
level - that is, read the root directory directly with INT 13 or INT 26
calls, and "walk the FAT" - bypassing the DOS file system entirely.

Now, using INT 26 should not cause problems with stacker, as it operates on
a cluster by cluster basis - but INT 13 calls would just return garbage.

So, if anybody produced a virus scanner, which scanned the disk with
INT 13 calls - or simply JMPing directly into ROM, we could expect
horrible compatibility problems with Stacker and similar programs.

- -frisk
From: JFORD@UA1VM.BITNET (James Ford)
Newsgroups: comp.virus
Subject: New files on risc (PC)
Date: 6 Apr 92 13:32:37 GMT
Organization: Lehigh University

The following files have been placed on risc.ua.edu (130.160.4.7) in
the directory pub/ibm-antivirus for anonymous FTP:

          vds20t.zip  - Virus Detection System, v2.0 (trial version)
        wscan89b.zip  - McAfee's Scan v89b for Windows
         fp-203a.zip  - F-Prot v2.03a
- ----------
A kind heart is of little value in chess.
- ----------
James Ford -  Consultant II, Seebeck Computer Center
              The University of Alabama (in Tuscaloosa, Alabama)
              jford@ua1vm.ua.edu, jford@seebeck.ua.edu
              Work (205)348-3968  fax (205)348-3993
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Warning about Mutation Engine (PC)
Date: 2 Apr 92 14:25:40 GMT
Organization: Lehigh University

In Message 23 Mar 92 17:22:09 GMT,
  bontchev@fbihh.informatik.uni-hamburg.de (Vesselin writes:

>mcafee@netcom.com (McAfee Associates) writes:
>
>>     Three new viruses have appeared in the past two months that
>> utilize the Bulgarian Dark Avenger Mutation Engine.  The source
>> code for this mutation engine has appeared on numerous virus-
>> exchange bulletin boards and is now in the hands of virus writers.
>
>The source?! Are you sure? What we have here is a virus development
>kit, which contains the MtE as a compiled, ready to link OBJ file,
>together with a demo virus in source. As far as I know, the source of
>the MtE itself has not been made available.

Well, at least the documentation in version 0.91-beta states that the
source is not available.

However....

At least two people that I know of have been contacted by "Dark
Avenger" and offered the source code for $5000 - to be paid to Todor
Todorov, I think, who would then forward the money to DA.

If the source is indeed available, I guess somebody must have bought
it...  :-(

Anyhow - my program now detects all three MtE viruses, and *should*
(no promises, though) be able to detect new MtE viruses .

- -frisk
From: ake@dayton.saic.com (Earle Ake)
Newsgroups: comp.virus
Subject: Possible SYSMAN trojan horse (VAX/VMS)
Date: 8 Apr 92 20:32:10 GMT


	This warning came across my desk today from our security
people.  I have typed it in verbatim.

SUBJ: COMPUTER VIRUS WARNING
1.  A POTENTIAL TROJAN HORSE EXISTS WHICH INFECTS THE SYSMAN.EXE
UTILITY ON VAX/VMS SYSTEMS.
2.  THE SYSMAN.EXE TROJAN HORSE WILL PROVIDE A KNOWLEDGEABLE USER
WITH A BACK DOOR INTO THE VMS OPERATING SYSTEM AND INCREASE USER'S
PRIVILEGES.
3.  DETECTION METHODS:
          A. CHECK FOR A LIBRARY ENTRY -
SYSDOLLAR SIGNLIBRARY:OBJ.EXE
          B. THE LENGTH OF SYSDOLLAR SIGNSYSTEM:SYSMAN.EXE EQUALS
             166 BLOCKS
          C. EXECUTE THE FOLLOWING VMS COMMAND:
       DOLLAR SIGNANALYZE/IMAGE SYSDOLLAR SIGNSYSTEM:SYSMAN.EXE
                 CHECK THE IMAGE IDENTIFICATION INFORMATION SECTION.
                 MAKE SURE FIELD IMAGE NAME EQUALS SYSMAN, NOT VA6
4.  NOTE:  ANY OF THE ABOVE COULD INDICATE THE PRESENSE OF THE SYSMAN
           TROJAN HORSE.

Comments:

	It is interesting how someone tried to translate some special
characters into english verbs and made this message much harded to
read.

	The things to check are the existance of a file
sys$library:obj.exe.  The author also mentions checking the size of
the sys$system:sysman.exe file to make sure it is 166 blocks.  While
sysman.exe may have been 166 blocks long for a previous release of
VMS, currently under VMS 5.4-2 it is 192 blocks long.  The VMS 5.3
version is 179 blocks long.  Not a very good check.

	The third way to detect the trojan mentioned should have read:

$ analyze/image sys$system:sysman.exe

That might be a good check to see if it was linked as the program
SYSMAN or VA6.

	I have no direct knowledge of this reported trojan horse.  I
am simply passing along information given to me in the interest of
computer security.

Earle Ake
<ake@dayton.saic.com>
From: perry@eugene.gal.utexas.edu (John Perry)
Newsgroups: comp.virus
Subject: New files on Eugene
Date: 7 Apr 92 20:53:40 GMT

Hello Everyone!

	It is with great pleasure that I make the following
announcement. Thanks to Ken van Wyk, eugene.gal.utexas.edu
(129.109.9.21) now carries almost all of the anti-viral and
security-related documents and software found on cert.sei.cmu.edu.
This is in addition to the latest in anti-viral software. As part of
the re-organization, the anti-viral software can be found in
/pub/virus-software rather than /pub/virus. If you encounter any
problems accessing the new files, please send mail to
perry@eugene.gal.utexas.edu.

- --

John Perry - perry@eugene.gal.utexas.edu
From: pjs@mulga.cs.mu.oz.au (Peter Stuckey)
Newsgroups: comp.virus
Subject: Removing BS viruses with McAfee CLEAN (PC).
Date: 2 Apr 92 02:12:45 GMT
Organization: Lehigh University

POSTED for Roger Riordan
- --------------------------------------

 rsr@garnet.berkeley.edu (Roger Rosenblum) asks

>Two questions: 1.)  Is CLEAN unable to remove some variants of
>the Stoned virus? and 2.) was this disk originally infected with
>the Azusa virus?

When you ask McAfee CLEAN to remove a boot sector virus it simply
puts back the hidden sector, but does not check if it is clean.
When I was a lecturer it was not uncommon to find two BS viruses
on the same disk.  CLEAN will merely replace the first virus with
the 2nd, so you must run SCAN 3 times & CLEAN twice to make sure
such a disk is really clean.

Occasionally we would find Stoned/Brain/Stoned.  If you run CLEAN
repeatedly on such a disk you will get the two viruses
alternately for ever, but no warning that the disk is still
infected.  IF you use CLEAN to remove a BS virus ALWAYS run SCAN
again to make sure the disk is really clean.

So the original disk may well have been infected with both
viruses.  I have confirmed this is still true for CLEAN 8.3V86.
I can supply test disks if anyone wants to verify this.

I assumed in the above that "disk" meant "floppy", but notice a
reference to MBR on re-reading.  I think the above still applies
(I am none too enthusiastic about putting two BS viruses on any
of our hard disks, and many combinations are fatal), but CLEAN
has a 2nd serious bug in fixing MBRs.  In Australia dealers often
booted PCs from infected master disks before partitioning the
hard disk.  CLEAN puts back the whole of the hidden MBR, including
the now incorrect partition information. This has also been
confirmed for CLEAN 8.3V86

Roger Riordan              PH: +61-3 521-0655  Fax: +61-3 521-0727
CYBEC Pty Ltd
PO Box 82, Hampton Vic 3187, AUSTRALIA.
From: martin@cs.ualberta.ca (Tim Martin; FSO; Soil Sciences)
Newsgroups: comp.virus
Subject: Re: Stoned, No-Int, and SCANV86B (PC)
Date: 10 Apr 92 22:15:19 GMT

WALKER@aedc-vax.af.mil (William Walker C60223 x4570) writes:

>In reply to Padgett Peterson's "walks and sounds like a duck" message:
>How does one determine if a virus is actually a "strain" of another
>virus, and not just distantly related to it?  The code for
>"Michelangelo" does not look to me very much like "Stoned," though I
>can see that they function similarly (except for the payload).  There
>are some major differences, such as the structure of the data area and
>the fact that "Stoned" (and closely-related viri) have two consecutive
>jumps which start the code, while "Michelangelo" has just one.
>Something like "Azusa," on the other hand, is obviously a strain of
>"Stoned," as several sections of the code are not only the same as
>those in "Stoned," but are also in the same location, and it also has
>the two consecutive jumps.  I would think that a "virus strain" should
>have a code-level resemblance to the virus of which it is a strain,
>while a virus that is just "related" to another should have just a
>functional resemblance to its counterpart.

It gets a bit trickier when a number of viruses all by the same
author represent a chronological evolution.  The earliest "Empire"
viruses are simply stoned with a few bytes saved and the message
changed.  The last of the family, found near the end of last
summer, have very little resemblence to stoned anymore.  But all
the inbetween stages are evident in the inbetween variants.  So
are these viruses different strains, different variants of one
strain -- Stoned, or several variants of several strains?  I find
the naming convention Vesselin has been promoting is useful, wherein
an Empire variant might be, for example, stoned.empire.canadian.  This
way the name shows the ancestry, the similar grouping, and the particular
strain.  Of course it might be argued that another level of
resolution is needed: for example stoned.empire.b has variations
1, 4, and 6, because of one or two bytes that vary.

Tim.

 -------------------------------------------------------------
  Tim Martin                 *
  Soil Science               *     These opinions are my own:
  University of Alberta      *        My employer has none!
  martin@cs.ualberta.ca      *
 -------------------------------------------------------------
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Fprot & 2to1 (PC)
Date: 2 Apr 92 15:46:55 GMT
Organization: Lehigh University

>padgett@tccslr.dnet.mmc.com (A. Padgett Peterson) writes:
>
>> >I do not know if this has been reported before, fixed etc. but I just
>> >ran F-Prot to check a diskette that had 2to1.com and safembr.com on
>> >it.  Both programs were reported as "Possibly a dropper program for a
>> >new variant of Stoned."  The date of 2to1 is 9/28/91, of safembr
>> >10/12/91 and I am using F-Prot 2.02D.
>
>> This is the virtue of hueristic analysis and I would not really call
>> it a "false positive" since Frisk is picking up the fact that my
>> programs replace the Master Boot Record (MBR) - why the current
>
>Hmm, I'm sorry, but as far as I know, the above message is NOT caused
>by the heuristic analyser (Frisk?).

Vesselin is right - it is the actual scanner.  What happens is - I have
a set of signatures for Stoned.  If I find at least two, I assume a
boot sector is infected and proceed to identify the variant) but if I find
only one I suggest it may be a new variant.

Now, as my program knows that "Stoned" is a BSV, and should not be found
in a com file it displays the message

    XXXXX.XXX seems to be a Stoned-dropper

if it finds 2 (or more) Stoned-signatures in the file.  If, however, the
scanner only finds one signature, it will display the message

    XXXXX.XXX  possibly a dropper program for a new variant of Stoned.

So, in this case the problem is caused by a bad (too short) signature
string for Stoned.  I changed the Stoned signatures in 2.03, so the
problem may have gone away - but I cannot test it - I can't find
2to1 or safembr anywhere...

>known viruses as it currently is... My suggestion is that Frisk
>implements exact identification for the known viruses and moves the
>code to detect new closely related variants in the heuristic analyser.

As I keep telling you :-) there is a good reason why I don't do that -
I like my "sufficiently exact" variant identification, because it allows
me to disinfect a virus even if it has been modified by changing a single
byte - if I used exact identification, I would determine it was a new
variant and had to give up on disinfecting it...On the other hand, if the
virus is modified more - source code modified & reassembled in particular,
I will detect that as a new variant and refuse to disinfect, avoiding
any damage to the files.

Some disagree with my strong emphasis on disinfection - but my experience
is that it is necessary - most users don't keep proper backups... :-)
That's why I can disinfect a higher percentage of viruses correctly than
any other anti-virus producer....at least according to Swoboda's recent
test of disinfection of 24.000 infected files. [If the moderator thinks
it it accecptable I can post his results here...]

- -frisk
From: masjol@dou.dk (J|rgen Olsen)
Newsgroups: comp.virus
Subject: RE:Vesselin B. on NOVELL-VIRUS in #87. (PC)
Date: 13 Apr 92 06:41:00 GMT

At the time I was a member of the NOVELL-MAILBOARD - and there was a
message - I belive it was that issue it covered - from NOVELL
describing how they hired John David to demonstrate the spread of the
VIRUS on a NOVELL network that they sat up according to his
specifications!

He failed to do so - the VIRUS - when analyzed by an outside expert
was demonstrated to be a common variant (I belive it was of Jerusalem)
with no special features!

John D. disagreed with the NOVELL conclusion that the incident he
described involved someone who was careless in SUPERVISOR mode!

Time since then - however - seems to have demonstrated that NOVELL was
right!

Our personal experience in a wide open environment is that the NOVELL NETWARE
is a quite good protection against the spread of Virus, provided :
     a) you have strict guidelines for people with SUPERVISOR rights
        (may only be used from a trusted and newly scanned machine - not
         a unit in the ZOO (student Lab)).
     b) Users have individual passwords and directories so that they
        cannot use the system as a library for infected games.

Combine that with -
     a) periodic scanning of all user directories,
     b) sitewide distribution of an up-to-date scanner, with the
        recommendation that people take home a copy for their
        personal machine and give a copy to all non-commercial entities
        with whome they occationally swap data/diskette's,
        (YES, our licensing of F-PROT actually allows us to do that),
and you are - if not safe - because no one will ever be so - but at a
level where you can concentrate on the real bad ones and let the users
handle ' STONED', Jerusalem, Cascade etc themselves.

Some kind of proof
   - we had 4 reports on Michaelangelo - all from users who had caught it,
     disposed of it - but out of cortesy would like to
     know, if the center would like a copy (we always say YES, THANK YOU).

Regards

J Olsen
University of Odense, Denmark
(masjol@dou.dk)
****************************************************************************
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Mardi Bros (PC)
Date: 2 Apr 92 14:59:43 GMT
Organization: Lehigh University

In Message 24 Mar 92 23:25:17 GMT,
  treeves@magnus.acs.ohio-state.edu (Terry N Reeves) writes:

>F-prot is making a false identification. F-prot 2.02d calls my sample
>of ohio (denzuk varient) mardi bros just as BRENT@morekypr says. Mardi
>Bros is not an alternate name - it is a differnt virus.

Well, it is related - in version 2.03 I now identify the three members
of the family as Denzuko (NOT Den Zuk), Ohio (alias Hacker) and
(Mardi Bros).

The reason for the mis-identification was that the Mardi Bros signatures
were also found in the Ohio virus (quite common for related viruses),
but it was not identical to Mardi Bros, so it would not disinfect it..
I have now fixed this.

- -frisk
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Measuring Michelangelo (PC)
Date: 2 Apr 92 14:44:26 GMT
Organization: Lehigh University

In Message 24 Mar 92 19:25:00 GMT,
  KDC@UOFMCC.BITNET (Ken De Cruyenaere 204-474-8340) writes:

>Do you really think so ?  I would have thought that copies of
>Michelangelo, aside from captive copies, would be few and far between
>after March 6th.  Either:
>
>   --- found and erradicated before March 6th (largely thanks to all
>       the media attention)
>   --- or self destructed when it activated on march 6th.
>       (If Michelangelo doesn't kill itself on March 6th, it certainly
>       draws attention to itself...)

Oh no...

   consider: people may simply have left their (infected) computer
             turned off all day March 6th.

   or:       somebody got infected, removed the virus but did not
             disinfect all floppies - the chances of becoming re-infected
             are fairly high.

However, in my opinion the real danger is elsewhere - some companies
distributed Michelangelo-specific detection programs free of charge -
many people may have received them, found that they did not have
Michelangleo and belive their machines are "clean"....but in reality
they may be infected with "Stoned" or any other (common) virus.

- -frisk
From: vaughan@computing-department.poly-south-west.ac.uk (Vaughan.Bell)
Newsgroups: comp.virus
Subject: International virus symbol..
Date: 7 Apr 92 09:01:14 GMT

I have had a bigger reponse than I expected to the virus symbol stuff
so...  The virus symbol is now available in .PCX .BMP .EPS and .GIF
formats. Mail me for a uuencoded copy of the .ZIP file. Also the virus
symbol in any of it's format is (C) Copyright 1992 Vaughan Bell but is
released into the public domain so it can be copied, printed,
distributed or whatever free of charge.

Also I have been told that people have had trouble printing the
PostScript file, It was produced from Harvard Graphics 2.6 and
exported to postscript. So if any one has had problems mail me for a
new copy, this should hopefully work...

)===--->	Vaughan Bell - vaughan@uk.ac.psw.cd     <---===(
)===--->       Polytechnic South West - Drakes Circus   <---===(
)===--->       Babbage Building - Room 112 - Plymouth   <---===(
)===--->	      Devon - UNITED KINGDOM	        <---===(
From: SINGH_HA@BENTLEY.BITNET
Newsgroups: comp.virus
Subject: Norton Optlink & Heuristics (PC)
Date: 10 Apr 92 00:02:00 GMT

Hi!

Vesselin writes :
>> The reason for this is that the programs use OPTLINK, (a linker which
>> adds PKLITE-like compression to executables as they are linked).  My
>> heuristics did not include a rule to specifically exclude OPTLINK
>..
>..
>
>The problem is that it detected them even when I instructed the
>instalation program to unpack them. However, I guess that this is
>OPTILINK's (or more exactly the unpacker's) problem, not yours... :-)

Are you sure?  I expanded Norton's (Ver 6.01) programs and FPROT (2.03
pre-release) skipped them during a SECURE scan, all except NORTON.EXE
and NHELP.EXE  (the integrator, and the help-engine).  These were not
expanded by the installation routine.  However, I didn't try the
Heuristics option.  Shall try that tonight.  One small detail though,
this happened on a stacker volume (I don't think that should matter).

By the way, Norton Anti-Virus (Version 1.5, August release) has the
same problem.

Harpreet Singh                              Singh_Harp@Bentley.BitNet
- ---------------------------------------------------------------------
Lab Supervisor   |   Bentley College   |   Waltham   |  Massachusetts
- ---------------------------------------------------------------------
"..A person fills in the missing pieces of the puzzle with his
   own personality, resulting in a conclusion based as much on
   instinct and intuition as on fact"
    -  Mr. Data in "The Defector"  |  Star Trek - The Next Generation
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Increasing CBCS Security (PC)
Date: 9 Apr 92 19:23:26 GMT

frisk@complex.is (Fridrik Skulason) writes:

> Thanks for the free advertising :-) :-) :-)  Actually, I agree with Alan
> Solomon the we have the two best scanners - we just disagree which is number
> one and which is number two.

It depends what the user wants. When sorting out a virus collection
I'm using both, but if the two scanners disagree, I tend to believe
more to Alan's (since it has better identification). In the same time,
yours has better disinfection (but I'm not interested in that). And,
Alan tend to support the researcher's requrements better... :-)

>    Saying that Alans AVTK detects more viruses is slightly misleading -
>    there are a few viruses that I don't detect - either very new ones
>    that Alan has, but I don't or "garbage" viruses that don't work...

Nope, I was relying on actual numbers. And I count viruses that you
report as "Possibly a new variant of" and "New or modified variant of"
as detected, regardless of the fact that your scanner obviously
doesn't know them. I'll run the tests again as soon as I get the
newest version of yours, but I simply suspect that you haven't tried
Alan's FindVirus 4.10...

>    For example, the AVTK detects the Starship virus, but as far as I know
>    nobody in the West has been able to make it replicate, so I have
>    simply not bothered to detect it.

We received enough information from the Soviet researchers on how to
make it replicate. As soon as I get some spare time (not soon with all
those 83 messages pending in my e-mail box), I'll try to replicate it.
Just remember that several viruses what "didn't seem able to
replicate" later turned out to be perfectly working ones which didn't
work only on some conditions... And, do you remember The Rat? No one
has bothered to see what it requires in order to replicate...

>    Also, If you consider my heuristic analysis (yes, yes, Vesselin, I
>    know what you think about it)...I detect practically all of those
>    "extra" new/garbage viruses that my scanner misses.

I admit that due to my biasment I never bothered to check how many of
the undetected viruses will be detected by the heuristic analyser.
Shame on me. I'll perform those tests later.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: James_Williams%ESS%NIAID@nih3plus.BITNET
Newsgroups: comp.virus
Subject: Questions about AAVIRUS (PC)
Date: 2 Apr 92 18:40:37 GMT
Organization: Lehigh University

Their is a really neat looking program called AAVIRUS on SIMTEL20 in
the TROJAN-PRO directory.  It creates a checksum and backup of your
boot sector.

Three general questions:

1.  Have any of the virus experts on this list looked at AAVIRUS?  What
    is your opinion of it?

2.  How affective is a checksum of the boot record again stealth viruses
    or polymorphic viruses?

3.  Are there better packages which do the same the thing?

Thanks

- --------------------------------------------
| James Williams                           |
| Bitnet: JWW%ESS%NIAID@NIH3PLUS.BITNET    |
| Internet: JWW@ESS.NIAID.PC.NIAID.NIH.GOV |
| CompuServ: 70304,2462                    |
- --------------------------------------------