HDTenEightyP/NetNews huggingface dataset:
From: ian@bvsd.Co.EDU (Ian S. Nelson)
Newsgroups: comp.virus
Subject: Re: Vshield vs Virstop (PC)
Date: 7 Jan 93 16:07:13 GMT

bill.lambdin%acc1bbs@ssr.com (Bill Lambdin) writes:

>1. Some programs will not run after the CRC is added to the file. So it is 
>   necessary to remove the CRC. Scan filename /RV will remove the CRC.

I beleave there is an option that will store the checksum in a datafile of
your choice.
- -- 
Ian S. Nelson			I speak for only myself.	
finger for a PGP public key.
From: aryeh@mcafee.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: Jerusalem (Israeli) Virus (PC)
Date: 7 Jan 93 01:26:20 GMT

Hello Bill Lambdin,

You write:
>Quoting from Samid Hoda to All About Jerusalem (Israeli) Virus on 12-20-92
[asking about how to remove the Jersualem virus]

>McAfee's Clean can remove this virus fairly easy to remove. It would be a 
>very good idea to re-boot the computer from a known clean bootable 
>diskette. If you don't have a clean bootable diskette, go ahead and type 
>the following on the command line.
> 
>CLEAN C: [JERU]
> 
[...deleted...]

Since the Jerusalem virus also infects overlay files.  I would recommend
the use of the the /A and /NOPAUSE switches, which tell CLEAN-UP to check 
all files on the disk for the virus and remove it if found regardless of 
their extension, and not to pause when it has filled up the screen with
messages, respectively.

Regards,

Aryeh Goretsky
Technical Support


- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET: aryeh@mcafee.COM
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | IP# 192.187.128.1
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: False positive in the new PKZIP (PC)
Date: 6 Jan 93 21:03:27 GMT

Hello, everybody!

As most MS-DOS users probably know, the very popular archiver PKZIP
from PKWare Inc. has not been updated from version 1.10 since about
two years. The new version was in "about to be released final
beta-test" during more than a year. This, of course, caused a lot of
bogus, hacked, or trojanized versions to be released by malicious
people to fool the legitimate users. The number of hacks is probably
above 10.

A few days ago, PKWare finally decided to release a new version of
their archiver, called 2.04c. Regardless of the long developpment
period, the program turned out to contain a few minor bugs and even
errors in the documentation. But this is not so interesting from the
computer virus point of view... :-)

What is interesting is that somebody used an out-of-date version of
Symantec's Norton Anti-Virus to scan the new archiver. It seems that
this version causes a false positive - the program is flagged as
infected by Maltese Amoeba. The confusion is increased by the fact
that all executables in the package are self-compressed with PKLite
1.20. This caused the heuristic scanner of F-Prot to report that those
files are suspicious, because they contain a program that modifies
itself in memory (of course - the decompressor unpacks the compressed
code) - something often used by viruses.

As a result, a major hoax was started; the archiver was several times
uploaded and deleted at wuarchive.wustl.edu; and the number of
messages about that in comp.compression is reaching the record caused
by the famous posting that informed about the claims of a company to
produce an archiver which is able to achive compression rate of 16:1
for any file... :-)

I obtained a copy of the new version of PKZIP, examined it manually
with a debugger, and scanned it with about a dozen scanners. The
result is that NONE OF THE EXECUTABLE FILES IS INFECTED. Even a recent
version of NAV (2.1 with signature updates of December) does not
report the false positive any more. PKWare has confirmed that this is
a "real" version.

So, please done's pay attention to the rumors, if they reach you. The
VALIDATE codes of the self-unpacking archive containing the new
version of PKZIP is:

          File Name:  PKZ204C.EXE
               Size:  188,818
               Date:  1-5-1993
File Authentication:
     Check Method 1 - 0DC8
     Check Method 2 - 045E

The actual Date: field may be different; it was destroyed while I was
downloading the file.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: as194@cleveland.Freenet.Edu (Doren Rosenthal)
Newsgroups: comp.virus
Subject: Virus Simulator MtE Supplement (PC)
Date: 23 Dec 92 03:13:17 GMT


Doren Rosenthal
3737 Sequoia
San Luis Obispo, CA USA 93401
 
To: Vesselin Vladimirov Bontchev, Virus Test Center, University of Hamburg
 
In response to your questions posted on this forum about my Virus 
Simulator MtE Supplement.
 
     > 1) Does is simulate perfectly the behavior of the MtE?
 
YES.  Although  safe  and controlled, these dummy  sample  programs  behave 
identically to those produced MtE mutation engine viruses.
 
     >I.e.,   are  the  dummy  files  generated  by  it  the  same  as   if
     >generated  by  the MtE? If not, then it is not good as  a  simulator,  
     >because the simulation is not
     >perfect enough.
 
YES. The dummy simulations are the same as those encrypted by the 
MtE mutation engine.
 
     >2) If the answer of the above question is "yes", then it means that it
     >uses the MtE itself to encrypt the dummy files - because using
     >anything else would mean imperfect simulation. If it uses the MtE, do
     >you include the MtE itself in the generated dummies?
 
YES.  At  the hart of the simulations is an actual  MtE  mutation 
engine.
 
     >3) If the answer of the above question is "no", then the simulation is
     >again not good enough, since the only way a scanner could detect the
     >unencrypted replicants of an MtE-based virus is to scan for a scan
     >signature of the unencrypted body of MtE. If the answer of the above
     >question is "yes", then it is pretty easy to extract the MtE from the
     >unencrypted dummies... Therefore, you are distributing malicious
     >software...
 
I  disagree. Although these are real MtE viruses, steps have been taken  to 
insure  they  will  only  infect  the  dummy  test  programs  provided  and 
modifications or reverse engineering has been discouraged.
 
     >Conclusion: regardless how you answer to the above questions, either
     >the simulator is useless, or you are distributing malicious
     >software... Hmm, I was able to draw this conclusion even without
     >having to look at the simulator... Pretty good, isn't it?... :-)
 
I'm  disappointed  that  you would pass yourself off as  a  fair  and  open 
scientist  and researcher open to new ideas. Then ask what would appear  to 
be  legitimate questions and without giving my response a fair  hearing  or 
even  examining  the  Virus  Simulator  MtE  Supplement  yourself,  draw  a 
conclusion and announce your findings in a public forum. 
 
I also do not appreciate being accused of distributing malicious  software. 
If you have evidence of this you should present it before posting  anything 
else on this forum or use the forum for a public apology.
 
     >Leaving the ethical problems aside, do you try all kinds of flags
     >(i.e., the contents of the AX register before calling the MtE)?
     >Because, if you don't, you'll be able to generate only a small subset
     >of the code that can be generated with the MtE...
 
The  Virus Simulator MtE Supplement exercises as may flags and  options  as 
possible.
 
Doren Rosenthal
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Anti-viral Documentation archive sites last changed 07 July 1992
Date: 3 Jan 93 01:05:53 GMT

Anti-viral Documentation archive sites	last changed 07 July 1992

cert.org
        Kenneth R. van Wyk <krvw@cert.org>
        Access is available via anonymous ftp, IP number 192.88.209.5.
        This site maintains archives of all VIRUS-L digests, all
        CERT advisories, as well as a number of informational documents.
        VIRUS-L/comp.virus information is in:
                pub/virus-l/archives
                pub/virus-l/archives/predig
                pub/virus-l/archives/1988
                pub/virus-l/archives/1989
                pub/virus-l/archives/1990
                pub/virus-l/archives/1991
                pub/virus-l/archives/1992
                pub/virus-l/docs
                pub/virus-l/docs/reviews
        CERT information is in:
                pub/cert_advisories
                pub/cert-tools_archive

csrc.ncsl.nist.gov
        John Wack <JWack@nist.gov>
        This site is available via anonymous ftp, IP number 129.6.54.11.
        The archives contain all security bulletins issued thus far from
        incident response teams (CERT, CIAC, FIRST members).  It also
        contains many security-related publications and resource informa-
        tion about viruses and other threats, as well as archives of
        VIRUS_Ls and RISK forums.  The NIST computer security BBS is also
        accessible from this system by logging in to account 'bbs'.

lehiibm1.bitnet or ibm1.cc.lehigh.edu
        Ken van Wyk <LUKEN@LEHIIBM1.BITNET> new: <krvw@cert.org>
        This site has archives of VIRUS-L.  Access is through ftp,
	IP address 128.180.2.1 or by e-mail to LISTSERV@LEHIIBM1
	(or LISTSERV@ibm1.cc.lehigh.edu).
        The directory of interest is VIRUS-L.

uk.ac.hensa.micros
        HENSA/micros Managers <hensa@uk.ac.hensa.micros>
        Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
        NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
        FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
        Software archive for UK higher education sector. Anti-Viral stuff
        is not collected into a distinct area. Hostname is in UK format.
        (This site previously known as uk.ac.lancs.pdsoft.)

unma.unm.edu
        Dave Grisham <dave@unma.unm.edu>
        This site has a collection of ethics documents.
        Included are legislation from several states and policies
        from many institutions.
        Access is through ftp, IP address 129.24.8.1.
        Look in the directory /ethics.
From: bill.lambdin%acc1bbs@ssr.com (Bill Lambdin)
Newsgroups: comp.virus
Subject: Re: Untouchable (PC)
Date: 29 Dec 92 01:37:00 GMT

Quoting from Y. Radai to All About Re: Untouchable (PC) on 12-12-92

YR> I was referring to Ver. 26 of UTScan.

I am using version 25.10 of UTScan.

When was 26 released?

Bill

- ---
 * WinQwk 2.0 a#383 * CASINO activates Jan 15th
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Viral Based Distribution System
Date: 5 Jan 93 22:40:49 GMT

ygoland@edison.SEAS.UCLA.EDU (The Jester) writes:

> Yes.. I understand. And may I say I STRONGLY disagree with Dr.
> Cohen's definition.

Any human-language definition will be inexact. For an exact definition
you should check his mathematical definition that involves Turing
machines... I think it is explained in his paper "Computational
Aspects of Computer Viruses", published in "Computers & Security". It
is also explained in his Ph.D. thesis (although the paper is better)
and is mentioned (without any explanation, which is rather confusing)
in his booklet "A Short Course on Computer Viruses".

> A program in the login script that checks if you
> have been updated and then updates you is NOT a virus. The program in
> the loader does NOT reproduce itself it reproduces another program
> which is itself NOT a virus.

No, you still do not understand. The "virus" is not just the login
script - it is the whole package. The login script is just the active
segment that seeks for "infectable" machines and transfers the rest of
the "virus code". It is actually a worm, but Cohen's definition does
not seem to make a difference between a virus and a worm.

> loader installs an infected program =) For me the acid test of a virus
> is:Can it reproduce itself?

Correct. So, the copy of the anti-virus package on the server
reproduces itself on each workstation when this workstation tries to
log in. Automatic update. Reproduction. Virus-like behavior.

> Is the login script programming trying to
> run around and find other login scripts or executable files to infect?

Another misunderstanding comes from the fact that most people
distinguish between a "virus" (i.e., something that modifies
executable files) and a "worm" (i.e., something that copies itself as
a whole). While it is useful to make such a distinguishment for
practical reasons, there is no real theoretical difference (e.g., what
"files" do the boot sector viruses infect? How about the companion
viruses? They do not modify anything...).

> No. It doesn't infect anyone! 'Damnit Jim, its not alive!'

Yup, it does. It "infects" the workstation with a copy of the
"virus/worm" - the anti-virus package.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Atari ST Anti-viral archive sites last changed 07 July 1992
Date: 3 Jan 93 01:05:23 GMT

Atari ST Anti-viral archive sites	last changed 07 July 1992

atari.archive.umich.edu
        Jeff Weiner <weiner@atari.archive.umich.edu>
        Service via FTP and mail, FTP preferred.
        Login as "anonymous", password is your mail address.
        For instructions on the mail server, send the message
                help
        to <atari@atari.archive.umich.edu>
        "Index" contains complete listing with descriptions.
        "CompInd.Z" contains same list but is compressed.
        "ls-lR.Z" contains compressed ls -lR listing.
        All anti-viral material is contained in ~atari/utilities/virus
        The IP number for this site is 141.211.164.8, but may change.

twitterpater.Eng.Sun.COM
        Steve Grimm <koreth@twitterpater.Eng.Sun.COM>
        Access to the archives is through mail server.
        For instructions on the archiver server, send
                help
        to <archive-server@twitterpater.eng.sun.com>

uk.ac.hensa.micros
        HENSA/micros Managers <hensa@uk.ac.hensa.micros>
        Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
        NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
        FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
        Software archive for UK higher education sector. Anti-Viral stuff
        is not collected into a distinct area. Hostname is in UK format.
        (This site previously known as uk.ac.lancs.pdsoft.)
From: glarwill@educ.ucalgary.ca (Glen Larwill)
Newsgroups: comp.virus
Subject: New Virus? (PC)
Date: 7 Jan 93 07:53:02 GMT

I run a BBS in Calgary Alberta, Canada.  Today, one of my users
claimed he had a virus on his system and was having some "trouble".
He didn't specify what was going on with his system.  I asked him to
send me a copy of one of the files he had that were infected.  He
uploaded two files.  The smallest one appears to be a dropper program.
It contains 80h bytes of a program (non-virus) that send a few escape
sequences to PRN:.  F-Prot (2.06a) in Secure Scan mode shows the
smaller file as a possible variant of SVC, and doesn't find anything
in the larger file.  In Quick Scan mode, it says they are both Dark
Avenger viruses.  MacAfee's VScan99 doesn't find anything wrong with
either of these files.

I haven't completly disasembled the smaller file yet, but I have found
that it installs it's self in upper memory (using about 2100 bytes).
It hooks interupt 21H and watches for Load and Exec, Create File,
Close File, Open File, Get and Set File Attribs calls to Int 21.  It
also contains the following text...

"JERICHO.Eurystheus.Calgary AB".

I have not disasembled the larger file yet, but it contains the following
text
"JERICHO by Eurystheus<FoG>.Calgary" in the same location.  It seems that 
these are two slightly different versions of the same virus.

If this is a new virus, what is the safest way to send these files via the 
Internet, and who do I send them to.

Glen Larwill, glarwill@educ.ucalgary.ca
Sysop of The Interlink, Fidonet 1:134/93
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Is this a new virus? (PC)
Date: 5 Jan 93 22:18:57 GMT

tck@bend.ucsd.edu (Kevin Marcus) writes:

> >0,0,8. This is irrelevant. What is rellevant is that the problem with
> >Michelangelo occurs exactly because the "standard" Stoned variant put
> >the original MBR at 0,0,7 - at the same place as Michelangelo, and
> >because the two viruses do not recognize each other.

> Oh, come on, it is relevant.  The original problem: Disinfection of a
> Stoned and MIchelangelo infection.  Where they move the orig. MBR is
> quite important, because in one case, it is possible to remove the
> viruses by pulling the original MBR up, and in the other, it is not.

That's exactly what I am trying to tell you, but maybe I am not
expressing myself clearly enough. The Stoned+Michelangelo problem
occurs exactly because both viruses store the original MBR at ONE AND
THE SAME PLACE, therefore the original MBR gets lost. Such system
cannot be disinfected, because there is no original MBR. The only
solution is to put a new MBR, which the anti-virus program must carry
with itself. Of course, some care should be taken not to destroy any
PARTITION TABLE information.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Macintosh Anti-viral archive sites last changed 17 August 1992
Date: 3 Jan 93 01:06:55 GMT

Macintosh Anti-viral archive sites	last changed 17 August 1992

dftnic.gsfc.nasa.gov
        Brian Lev <lev@dftnic.gsfc.nasa.gov> <SDCDCL::LEV> <LEV@DFTBIT>
        This site offers the "MacSecure" package, made up of John Norstad's
        Disinfectant, and a pair of locally developed HyperCard stacks:
        Joe McMahon's "Anti-Viral Doc" and Brian Lev's "MacHelper".
        Floppy disk:
                Advanced Data Flow Technology Office
                Code 930.4
                Goddard Space Flight Center
                Greenbelt, MD 20771 (Attn: Brian Lev)
        DECnet Copy from DFTNIC::CLDATA:[ANONYMOUS_FTP.FILES.MAC]
                BinHex (ASCII) format as MACSECURE31.HQX
                binary format as MACSECURE31.SEA
        Anonymous FTP from DFTNIC.GSFC.NASA.GOV (128.183.10.3)
                BinHex (ASCII) format as [.FILES.MAC]MACSECURE31.HQX
                binary format as [.FILES.MAC]MACSECURE3.SIT

eugene.utmb.edu
        John Perry <perry@phil.utmb.edu>
        This site can be reached through anonymous ftp.
        The Macintosh anti-viral archives can be found in the
        directory /pub/virus-software/macintosh.  The IP address is
	129.109.1.21.  A backup site is maintained at beach.utmb.edu,
        IP address 129.109.1.207.  Look in [ANONYMOUS.PUB.VIRUS.MAC].

ifi.ethz.ch
        Danny Schwendener <macman@ethz.uucp>
        Interactive access through DECnet (SPAN/HEPnet):
                $SET HOST 57434  or $SET HOST AEOLUS
                Username: MAC
        Interactive access through X.25 (022847911065) or Modem 2400 bps
        (+41-1-251-6271):
                # CALL B050 <cr><cr>
                Username: MAC
        Files may also be copied via DECnet (SPAN/HEPnet) from
                57434::DISK8:[MAC.TOP.LIBRARY.VIRUS]

rascal.ics.utexas.edu
        Werner Uhrig <werner@rascal.ics.utexas.edu>
        Access is through anonymous ftp, IP number is 128.83.138.20.
        Archives can be found in the directories mac/virus-catchers
        and mac/virus-docs.

src.doc.ic.ac.uk
	Lee McLoughlin <ukuug-soft@doc.ic.ac.uk>
	Automatically maintained mirror copy of the sumex archive.
	Anonymous FTP from src.doc.ic.ac.uk (146.169.2.1)
		cd mac/sumex/info-mac/virus
	Janet NIFTP (for UK users)
		Host: uk.ac.ic.doc.src
		User: guest
		Pass: your email address
From: jwright@cfht.hawaii.edu (Jim Wright)
Newsgroups: comp.virus
Subject: Apple II Anti-viral archive sites last changed 07 July 1992
Date: 3 Jan 93 01:04:52 GMT

Apple II Anti-viral archive sites	last changed 07 July 1992

brownvm.bitnet
        Chris Chung <chris@brownvm.bitnet>
        Access is through LISTSERV, using SEND, TELL and MAIL commands.
        Files are stored as
                apple2-l xx-xxxxx
        where the x's are the file number.

uk.ac.hensa.micros
        HENSA/micros Managers <hensa@uk.ac.hensa.micros>
        Terminals: host uk.ac.hensa.micros, user "hensa", password "hensa"
        NIFTP: host uk.ac.hensa.micros, user "hensa", password "hensa"
        FTP: host micros.hensa.ac.uk, user "hensa", password "hensa"
        Software archive for UK higher education sector. Anti-Viral stuff
        is not collected into a distinct area. Hostname is in UK format.
        (This site previously known as uk.ac.lancs.pdsoft.)
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Yet another undocumented MS-DOS 5.00 FDISK "Feature" (PC)
Date: 5 Jan 93 18:01:14 GMT

FDISK /STATUS (but UNFORMAT/PARTN/TEST/L is better 8*)

					Warmly,
						Padgett
From: robert.heuman@rose.com (robert heuman)
Newsgroups: comp.virus
Subject: Viruses in OS/2 HPFS (OS/2)
Date: 7 Jan 93 08:48:15 GMT

Date Entered: 01-07-93 03:45
Just to inject a further complication into the discussion of HPFS, I
have just installed IBM OS/2 Advanced LAN Version 3.0.  If any
reasonable security is required, HPFS must be used.  The install
requires replaceing the version 2.0 286HPFS with a new 386HPFS.

I DO NOT know what the differences are, but there must be some, as one 
needs to remove protection and copy, using supplied utilities, certain 
information re existing user set-up, etc., before installing the new 
LAPS and LAN software in the HPFS partition.

Therefore, I suspect that IF someone writes a virus that impacts 286
HPFS it MIGHT NOT work on a 386HPFS partition, but, of course, I do 
not know.

If anyone has information on the differences between the two flavours, 
it might help in the discussion, and the issue of possible virus 
intrusion into the partition.

This does not change, as far as I can see, the possible infection of 
DOS files saved on the partition, etc.

R. S. (Bob) Heuman
- ---
   RoseReader 1.70 P001886: This Canadian has an Opinion...His Own!
   RM 2.00 : RoseNet<=>Usenet Gateway : Rose Media 416-733-2285