HDTenEightyP/NetNews huggingface dataset:
From: tck@netlink.cts.com (Kevin Marcus)
Newsgroups: comp.virus
Subject: Polymorphic listing, Stealth in memory (PC)
Date: 10 Apr 92 03:31:01 GMT

Hmm.  I do not fully agree with your "Polymorphic Virus List".  I
believde that a truly polymorphic virus would actually mutate some of
it's code -> therefore making it so it would require more than a
"decryptor", as a decryptor could change.  I believe a large portion
of the viruses you listed were in fact Encryptive viruses, with no
metamorphosis features at all.

From my understanding, the current "mutating/polymorphic" viruses are
all encryptive, BUT they actually change their encryption algortyhms.
Therefore, if one discovers one of the encryption algorythms, it will
not be useable to identify all strains, whereas with a virus such as
V2P1/1260, V2P2, V2P6, and V2P6Z, for example, the encryption
algorythm does not change at all, though the key does.  Therefore, one
could find the encryption algorythm (and decryption, for that matter)
and actually decrypt the virus itself into the real virus.  With a
polymorphic virus, this is not so.

Perhaps my terminology is a bit messed up, Lets get it cleared up...
  Polymorphic = Metamorphic = Mutation
  Encryptive does NOT equal any of the above.

Yes?
And, of course, as stated, a virus could be polymorphic and encryptive (I
believe all the polymorphic viruses out there are of this type, indeed)

Subject: stealth in memory

Vesselin Bontchev writes:
> They are stealth in files, not in memory you know.

Yes, true, but I beileve the Fish Virus re-encrypts itself in memory,
which coudl make a simple string scanner a bit messed up if they
didnt' have a good string, yes?

- --
INTERNET:  tck@netlink.cts.com (Kevin Marcus)
UUCP:   ...!nosc!ryptyde!netlink!tck
NetLink Online Communications * Public Access in San Diego, CA (619) 435-6181
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: Increasing CBCS Security (PC)
Date: 2 Apr 92 15:57:47 GMT
Organization: Lehigh University

In Message 26 Mar 92 13:20:24 GMT,
  bontchev@fbihh.informatik.uni-hamburg.de (Vesselin writes:

>I suggest that you combine SCAN with at least F-Prot (a very cheap
>alternative). If you want to spend more money, get Dr. Solomon's
>Anti-Virus ToolKit. And, of course, F-Prot - the two combine very
>nicely (AVTK identifies viruses exactly and detects more viruses,
>while F-Prot is better in detecting new variants of the known
>viruses).

Thanks for the free advertising :-) :-) :-)  Actually, I agree with Alan
Solomon the we have the two best scanners - we just disagree which is number
one and which is number two.

Anyhow, a few F-PROT related comments ....

   Version 2.03 is now ready for distribution - a few people have copies
   of the "pre-release", but it is not the official 2.03.   I will
   probably be posting a message to VIRUS-L/comp.virus tomorrow,
   announcing 2.03 formally.

   Saying that Alans AVTK detects more viruses is slightly misleading -
   there are a few viruses that I don't detect - either very new ones
   that Alan has, but I don't or "garbage" viruses that don't work...
   For example, the AVTK detects the Starship virus, but as far as I know
   nobody in the West has been able to make it replicate, so I have
   simply not bothered to detect it.

   Also, If you consider my heuristic analysis (yes, yes, Vesselin, I
   know what you think about it)...I detect practically all of those
   "extra" new/garbage viruses that my scanner misses.

- -frisk
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: F-PROT warning: false positive? (PC)
Date: 13 Apr 92 10:58:49 GMT

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:

Sorry for quoting myself, but here's some additional info:

> frisk@complex.is (Fridrik Skulason) writes:

> > >>> A related question: f-prot identifies nearly all the Norton Utilities
> > >>> programs

> > The reason for this is that the programs use OPTLINK, (a linker which
> > adds PKLITE-like compression to executables as they are linked).  My
> > heuristics did not include a rule to specifically exclude OPTLINK
> > (I have rules to exclude PKLITE, LZEXE, DIET, KVETCH, ICE, EXEPACK etc)
> > so it detected "highly suspicious self-modifying code" - which,
> > strictly speaking is true.  This was fixed in 2.03.

Nope. The heuristic analyser of F-Prot 2.03a still flags all the
Norton Utilities (version 6.01, English, unpacked during the
installation) as very suspicious.

> > This (at least WORD.COM) is a documented false positive - see ANALYSE.DOC.
> > I am working on reducing the number of false positives, but I fully agree
> > that heuristic analysis should only be used by experienced users....there
> > are still some false positives....

WORD.COM from Microsoft Word 4.0 seems to be a very badly written
program... A Russian heuristic checker that I got recently flags it as
"infected by a 130-byte virus"... :-)

BTW, Frisk, your heuristic analyser now seems to flag the COM files
that are produced by a Borland C++ 2.0 program, compiled to EXE file
with full debug information and then the debug information tripped
into a TDS file (by TDSTRIP) with the simultaneous converion of the
program into COM file (Tiny model and TDStrip options -s -c). Not that
this is completely wrong, since those files really modify their first
three bytes in memory when executed - just like viruses, but maybe you
should exclude this case particularly...

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: KPETERSO@BENTLEY.BITNET
Newsgroups: comp.virus
Subject: Questions about Virus Authors
Date: 12 Apr 92 19:35:00 GMT

Hello all!  I am in the MBA program at Bentley College, taking a
course in "End User Computing".  I am working on a paper about PC
virus software and was hoping that some of you may be able to help me
out in my research (and join my bibliography list!).  I am still short
on information about the authors of virus software, particularly: 1)
what type of person writes a virus? 2) author's education/background,
3) what is the author's motivation?

If anyone would like to share any information, please respond to me at
the address listed below.  Any information will be accepted and
appreciated.  Thanks in advance!

Karen Peterson          Bitnet ID: KPETERSO@BENTLEY
DBA
Bentley College
Waltham, MA
From: ridgelyb@copper.ucs.indiana.edu (Brian Ridgely)
Newsgroups: comp.virus
Subject: Wanted: Virus Jokes
Date: 10 Apr 92 19:00:36 GMT

Some friends and I are discussing the evolution of computer jokes and
are particularly interested in jokes about computer viruses.  We would
appreciate if you could mail or post any jokes you remember, from the
earliest up to the Michaelangelo jokes, along with your best guess on
the year.  Thanks!

Brian Ridgely
ridgely@alma.edu
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Telephonica and Floppy Discs (PC)
Date: 9 Apr 92 21:40:19 GMT

Robert.Turner@brunel.ac.uk (Robert Turner) writes:

> Our 386 machines run Dr. Solomons' Guard program along with an INT-13h
> modifier written by one of our people here that protects a small 'C'
> disc (with DOS etc). Anyway, I was carrying out a disinfection of
> telephonica as I have done hundreds of times before, typing 'XCOPY A:\
> D:\TMP /S /E', without even doing a 'DIR' on the disc, prior to
> re-formatting.  Anyway, Guard obediently put up a warning message, this
> was bypassed, and the disc motor started.

Was Guard configured to complain when you are copying an infected
file? Because this can be disabled...

> Then without any warning the computer complained about 'Write Protect on
> Drive C' (from out INT-13h program). Now, nothing else was running, and
> therefore the only assumption that I can make is that somehow Telephonica
> managed to get executed.

There is a possibility that the XCOPY program has been already
infected. However, I tend to believe that there's another reason.
Where is GUARD.DRV? Is it on the "write-protected" hard disk? Is it
configured to swap the virus signatures? Maybe Dr. Solomon just opens
the signature file for both reading and writing and the write
protection caused problems? Although it seems quite unbelivable; his
programs are not usually that stupid... Try to call S & S
International and ask for help - I was told that they have a pretty
good tech support... From my own experience, even their secretary
seems to understand viruses... :-)

> My question is whether it is possible for a boot sector virus to be
> executed by doing a 'DIR' or other directory access. I believe that this

No way.

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: 72571.3352@CompuServe.COM (Wolfgang Stiller)
Newsgroups: comp.virus
Subject: New Integrity Master (PC)
Date: 9 Apr 92 00:33:29 GMT


 Stiller Research announces release of Integrity Master version 1.12b

Integrity Master(tm) provides complete, easy to use, data integrity for
your PC plus virus protection. It can also be used to provide file
change management and security on your PC.  As well as scanning for
known viruses, it detects unknown viruses and unlike other products
(such as McAfee's scan) will detect files which have been damaged
but not infected by a virus.

New with V1.12:
- --------------
  Version 1.12b recognizes over 50 additional viruses by name (since
  V1.11a).

  For people who want to run totally unattended or who don't want to have
  to hit a key to acknowledge serious problems, we have added the /NE
  (Nonstop except for Emergencies) command line parameter and halt option.

  IM does additional consistency checking between the files themselves
  and their associated directory entries.  This allows detection of
  missing or incorrectly chained clusters even if IM has never been used
  before on the disk.

  The programs SETUPIM.EXE and IM.EXE are now further compressed for use
  on smaller disks.

  Unattended (batch) checking runs faster.

Integrity Master V1.12b was released on March 18th and should by now be
available on most systems. It is available on all SDN and ASP afiliated
BBSes as well as SIMTEL-20 here on internet.

Regards, Wolfgang                                 Wolfgang Stiller
                                                  Stiller Research
                                                  2625 Ridgeway St.
                                                  Tallahassee, FL 32310
                                                  U.S.A.
From: pjs@mulga.cs.mu.oz.au (Peter Stuckey)
Newsgroups: comp.virus
Subject: Norton quote (PC)
Date: 2 Apr 92 02:14:39 GMT
Organization: Lehigh University

POSTED for Roger Riordan
- ----------------------------------------

 rsr@garnet.berkeley.edu (Roger Rosenblum) asks

>Yikes! Is that quote really attributable to Peter Norton?  If
>so, does anyone know where, when, or in what context he said it?

Peter Norton visited Australia in early 1990 (Jan or Feb if my memory
is correct), and gave a public talk at Melbourne University.  I asked
him if his firm was planning to do anything about viruses.  He
launched into a tirade about urban myths, starting with the story
about crocodiles in the NY sewers, and going on to a story going
around in his youth about a girl with a beehive hairdo.  A spider
built its' nest in it, then bit her & she died.

From the vehemence and length of his answer I am sure he had given it
many times before.

Roger Riordan              PH: +61-3 521-0655  Fax: +61-3 521-0727
CYBEC Pty Ltd
PO Box 82, Hampton Vic 3187, AUSTRALIA.
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: IBM Anti-virus Service (PC)
Date: 9 Apr 92 19:07:03 GMT

ian@vnet.ibm.com (Ian Stirling) writes:

> I just picked up this announcment on our internal board and have been
> given permission by both IBM and the newsgroup moderator to post it here.

>      o  Access to all of the anti-virus software used by IBM (VIRSCAN,
>         VSTOP, Verifiers, Disinfectors, CHECKUP) plus any new software
>         developed on any platform during the contract period.

As an IBM employee, you should know that the product mentioned above
are restricted to IBM Internal Use Only and not generally available to
the rest of the world (except VIRSCAN). It's a pity, though, since
VSTOP seemed pretty good to me the last time I saw it...

Or am I mistaken and the programs made generally available? Dave?
Donny?

Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev        Virus Test Center, University of Hamburg
Bontchev@Informatik.Uni-Hamburg.De  Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226    Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
From: perry@eugene.gal.utexas.edu (John Perry)
Newsgroups: comp.virus
Subject: FP-203A.ZIP is on eugene (PC)
Date: 7 Apr 92 13:33:48 GMT
Organization: Lehigh University

FP-203A.ZIP is available on eugene.gal.utexas.edu (129.109.9.21). It
will also be available on beach.gal.utexas.edu (129.109.1.207)
sometime this week. If you have any questions or problems, please send
e-mail to perry@eugene.gal.utexas.edu.

- --

John Perry - perry@eugene.gal.utexas.edu
From: polk@csmes.ncsl.nist.gov (Tim Polk)
Newsgroups: comp.virus
Subject: anti-virus BBSes
Date: 3 Apr 92 21:28:39 GMT
Organization: Lehigh University

A friend without internet access is looking for a reliable BBS source
for Jan Terpstra's virus signature database.  I have been unable to
assist him; all the sites I've checked are out-of-date or only stock
McAfee.  If anyone has a good source (especially near Washington, DC
but anywhere in the US or Canada is of interest) I would appreciate
the info.  It is probably best to direct replies to me; I'll forward
the list to anyone who is interested.

Thanks, Tim Polk
From: sgr4211@uk0x08.ggr.co.uk
Newsgroups: comp.virus
Subject: Queries about F-Prot 2.02D (PC)
Date: 6 Apr 92 13:44:00 GMT

I    find  that  (running  in  interactive  mode) I only get a report if
something "suspicious" was found.  It doesn't appear to consider  packed
files  as  "suspicious",  so  there  is no mention of them being present
*unless* I have some sort of problem, eg viruses present or some kind of
"invalid" file.  When I *do* get a report, it notes all the PKLITE, DIET
and EXEPACK files as "not scanned".  I thought  2.02D  was  supposed  to
scan  such  compressed  files - is this a bug in the reporting, or is it
really not scanning them?

Personally, I think that all files genuinely not scanned should *always*
appear in a report, regardless of whether or not  F-Prot  "thinks"  that
there was a "problem".

Also, I notice that some of the viruses in the "information" browser are
picked-out in yellow, and these ones  have  an  asterisk  against  their
names  when  you  look  at  the  accompanying  text.  Any idea what this
represents?  Didn't notice any link between them.  Couldn't see anything
in the documentation about it (don't think it's been updated for 2.02D).

Steve Richards.
From: rmg53668@uxa.cso.uiuc.edu (Ryan M. Grant)
Newsgroups: comp.virus
Subject: Re: Defence from mutating viruses. (PC)
Date: 10 Apr 92 06:07:36 GMT

kiae!rtech!vl!ALS@vl.ts.kiev.ua writes:
>    ... made some
>    testing of what would be if I can change some codes of MS-DOS resident
>    part to make it more virus-safe.
>    ...changes in MSDOS.SYS (in memory, of course, not
>    in disk file).

	Does this mean I run the program from the command line?
	Can I set it up, in other words, not to run?
		ie. Norton Utilities freak out

>    [RLock can remove the read-only bit]

	If your program can remove the read-ony bit, how hard would it be
	for a virus programmer who has seen your program?

>    prevent direct access to disk
>    to all programs EXCEPT COMMAND.COM.

	Do any programs useful try this? Disk caches?
	(Just looked and norton cache uses DOS, but how about the others?)

>    As a result only very DOS-depended viruses can ignore this defence.

	What could they do?  Are DOS versions that hard to keep track of?
	What if DOS 5 sticks around a while?

>    I think that idea of writing of virus defence as native part of DOS has
>    future. Anti-viral packets can be simply modified and quickly sent to
>    PC users when new DOS version was upgraded, while viruses have long way
>    to their "users".
>    And what are you thiking about it?

	Sounds really good
				- Ryan Grant
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Write protecting with software (PC)
Date: 9 Apr 92 18:49:57 GMT

writes: Alexander Shehovtsov, (8-044)266-70-28 (9:00 - 18:00 Kiev, Ukraine)

>    Results were surprising - nearly 95% of viruses were unable to infect
>    files after setting RLock defence. Some of them even didn't try to remove
>    Readonly and failured, other failured with removing and very intellectual
>    viruses that used tracing Int 21 chain to jump directly into MS-DOS
>    Int 21h routine failured too because RLock protection of ReadOnly attribute
>    became a part of MS-DOS itself.

	Actually confirms the V-L discussions over the last two years
about software protections - almost anything will work so long as it
is unknown and unanticipated. The read-only bit worked as long as
no-one knew about it (not very long).

>    And what about 5%? These viruses used direct access to disk via Int 13h
>    or DOS internal tables to infect files without removing ReadOnly attribute.
>    I used the second idea to prevent their deeds: wrote another programm
>    modifying IO.SYS and MSDOS.SYS that can prevent direct access to disk
>   to all programs EXCEPT COMMAND.COM.

More dangerous since while this will protect against Int 21 functions,
what about direct calls to Int 13 ? Things operating from the BIOS can
always bypass DOS.

>    RLock and HDD are DOS-depended and were written for MS-DOS 4.0, 4.01
>    and 5.0.
>    As a result only very DOS-depended viruses can ignore this defence.

Again, this will not provide any protection against things operating
on the BIOS level or even things reading from the DOS level and
writing through the BIOS. The versions mentioned will even tell you
how to reach the BIOS directly if you ask nicely. I agree that this
mechanism could be effective against most common file infectors seen
thusfar, but what about the DIR-II class which uses a BIOS technique.

Having said that, the programs will probably work as indicated to
reduce the 50% +/- of infections that stem from file infectors. My
feeling though is that a much more effective defense can be mounted
from the BIOS level to do the same thing (remember BYPASS) by write
protecting an entire partition, will also protect against MBR and Boot
Sector infections the other 50 % +/-), and is not DOS version or even
necessarily OS dependant.

Am glad to see people thinking about solutions though.

					Warmly,
						Padgett
From: rslade@sfu.ca (Robert Slade)
Newsgroups: comp.virus
Subject: Re: Questions about AAVIRUS (PC)
Date: 7 Apr 92 18:37:38 GMT

James_Williams%ESS%NIAID@nih3plus.BITNET writes:

>1.  Have any of the virus experts on this list looked at AAVIRUS?  What
>    is your opinion of it?

I have had a brief look at it, and, yes, I agree it is a neat and
needed program.  I have not reviewed it in depth yet.

>2.  How affective is a checksum of the boot record again stealth viruses
>    or polymorphic viruses?

This would not be effective against stealth BSIs unless there is
additional security checking.  To the best of my knowledge, there are,
as yet, no polymorphic BSIs.

>3.  Are there better packages which do the same the thing?

Yes.  Padgett Peterson's DISKSECURE, FixMBR and SafeMBR work along the
same lines, as well as supplying the additional security checking
necessary.  I have not, as I said, fully reviewed AAVIRUS, but at
present I would recommend Padgett's stuff.
at
From: PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics)
Newsgroups: comp.virus
Subject: Re: Heuristic scanner flaws (PC)
Date: 2 Apr 92 23:03:00 GMT
Organization: Lehigh University

CSCRDW%CURIE@epavax.rtpnc.epa.gov (Ron Whittle) writes:
>>From:    padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
>>Incidently, the original SafeMBR.com and its removal tool 2to1.com have been
>>superceeded by the much more capable FixMBR program which does not trip
>>F-Prot 2.02d.
>
>   This posting shows that the heuristic analysis is already flawed,
> and most people haven't even implemented it yet.  If you can write a
> program that will overwrite the MBR and F-Prot 2.02d heuristic scanner
> doesn't trip on it, then a virus could use the same code that you are
> using.

Well, you could say that F-Prot is doing a good job, since SafeMBR is
a good-guy program, so perhaps F-Prot is being very clever in not
reporting it as suspect :-).

Seriously, though, it should be possible to have programs that simply
write to the MBR pass that sort of test - where it should fail is if
the program is part of a boot sector, or at execution time when the
actual contents of what it is writing are checked. However, I'm sure
it is simply much harder to write heuristic scanners to spot such
activities in executable files as opposed to boot sectors.

Since it is also possible (in fact possibly easier) to rewrite a
program to avoid scanners looking for particular byte sequences, you
really have to ask: "Is a heuristic scanner (or mixed method scanner)
going to be better than the conventional string match scanners?" ... I
think the answer is YES!

But I also that such scanners are a long way from the total answer.
It shouldn't come as a surprise to people that scanners aren't
perfect. You have to use them in conjunction with other anti-virus
methods. I expect to see a type of scanner much better than the
up-coming generation of heuristic ones, but even that could not, for
example, pronounce whether Norton's utilities (such as a disk editor)
is a virus or not... only software watching what is happenning can do
that. I am very surprised that such software isn't part of the current
generation of 386-based software.  Instead of a message like "An
application has just corrupted the system area, you'll have to close
down everything and re-boot!" we should be seeing "An application
tried to corrupt memory areas that don't belong to it, do you want me
to nuke it?" (or words to that effect).

(This discussion is getting interesting, at last!)
Bye,
Mark Aitchison.
From: jaflrn!jaf@uunet.UU.NET (Jon Freivald)
Newsgroups: comp.virus
Subject: FAQ & files available by E-Mail
Date: 9 Apr 92 01:26:21 GMT

As previously posted, the Virus-L FAQ is available via E-mail here.  The
mail-server has passed local testing with for sending non-text files and
should be ready for general use.  For instructions, send E-mail to
file-request@jaflrn.uucp (if that bounces, try
jaflrn!file-request@uunet.UU.NET) with the word "help" in the message body.

For a file listing or the Virus-L FAQ, send a message with one of the
following lines:

        get index
        get dos/virus/virus-l.faq

If you have any problems, please report them to me ASAP!  I hope this to be
a reliable service and will endeavor to correct any reported problems.

Jon

=============================================================================
		       Jon Freivald ( jaf@jaflrn.uucp )
	 Nothing is impossible for the man who doesn't have to do it.
=============================================================================