Anti-Viral Resources

Jim Wright Iowa State University jwright@atanasoff.cs.iastate.edu

July 6, 1989

This document attempts to describe all of the research papers, reports, and anti-viral programs available through the comp.virus/virus-l anti-viral archive system. I will attempt to keep it as up to date as possible, although it is quite clear that this is nearly an impossible task. In this version, I have complete and up to date listings of all programs available through the IBMPC archive system, as well as a number of reports on IBMPC viruses. It is possible (OK, it is certain) that some reports are not yet available, and that not all available reports are listed. My next addition to this list will be to add Amiga programs and reports. In the more distant future, I’ll be going for the general research papers, including mainframe/minicomputer/workstation viruses. If anyone would like to volunteer to add listings for the Atari ST, Apple II or Macintosh, I’d be glad to incorporate it into this list. At this time, I have no plans to do this myself.

Anti-Viral Resources, version 1.0, Jim Wright, Page 1

Contents

1 IBMPC Virus Info 2 1.1 1704vir.txt . . . . . . . . . . . 2 1.2 405 . . . . . . . . . . . . . . . 2 1.3 A-VirTst.arc . . . . . . . . . . 2 1.4 Alameda . . . . . . . . . . . . 2 1.5 AllVirus.arc . . . . . . . . . . 2 1.6 April1st . . . . . . . . . . . . 2 1.7 Austrian . . . . . . . . . . . . 2 1.8 Brain . . . . . . . . . . . . . . 2 1.9 Cascade . . . . . . . . . . . . 2 1.10 dBase . . . . . . . . . . . . . 3 1.11 DirtyDz9.arc . . . . . . . . . 3 1.12 DOS62 . . . . . . . . . . . . . 3 1.13 Eval.txt . . . . . . . . . . . . 3 1.14 Friday13th . . . . . . . . . . . 3 1.15 Greenbrg.arc . . . . . . . . . 3 1.16 Immunity.txt . . . . . . . . . 3 1.17 Israeli . . . . . . . . . . . . . 3 1.18 Italian . . . . . . . . . . . . . 3 1.19 Lehigh . . . . . . . . . . . . . 3 1.20 Oropax . . . . . . . . . . . . . 4 1.21 Troj2.arc . . . . . . . . . . . . 4 1.22 Vaccine.Rev . . . . . . . . . . 4 1.23 Vir-Asm.doc . . . . . . . . . . 4 1.24 Vir3.arc . . . . . . . . . . . . 4 1.25 VirBlkJk.doc . . . . . . . . . 4 1.26 VirDoc2.txt . . . . . . . . . . 4 1.27 Virus.arc . . . . . . . . . . . . 4 1.28 Virus-B.doc . . . . . . . . . . 4 1.29 ViruSim.txt . . . . . . . . . . 5 1.30 VProInfo.doc . . . . . . . . . 5

2 IBMPC Anti-Virals 5 2.1 Alert13U.arc . . . . . . . . . . 5 2.2 BombChek.arc . . . . . . . . 5 2.3 BombSqad.arc . . . . . . . . . 5 2.4 CAware.arc . . . . . . . . . . 5 2.5 Check-OS.arc . . . . . . . . . 6 2.6 CheckMem.c . . . . . . . . . . 6 2.7 Chk4Bomb.arc . . . . . . . . 6 2.8 ChkLHArc.arc . . . . . . . . . 6 2.9 ChkSum.arc . . . . . . . . . . 6

2.10 ChkUp35.arc . . . . . . . . . 6
2.11 Condom.arc . . . . . . . . . . 6
2.12 Delouse1.arc . . . . . . . . . . 7
2.13 Detect2.arc . . . . . . . . . . 7
2.14 DProt102.arc . . . . . . . . . 7
2.15 DProtect.arc . . . . . . . . . . 7
2.16 DVir1701.exe . . . . . . . . . 7
2.17 Early.arc . . . . . . . . . . . . 7
2.18 EPW.arc . . . . . . . . . . . . 7
2.19 File-CRC.arc . . . . . . . . . 8
2.20 FileCRC.arc . . . . . . . . . . 8
2.21 FileTest.arc . . . . . . . . . . 8
2.22 FSP 16.arc . . . . . . . . . . . 8
2.23 Immune.arc . . . . . . . . . . 8
2.24 Inoculat.arc . . . . . . . . . . 8
2.25 MD40.arc . . . . . . . . . . . 8
2.26 NoBrain.c . . . . . . . . . . . 9
2.27 NoVirus.arc . . . . . . . . . . 9
2.28 ProveCRC.arc . . . . . . . . . 9
2.29 Sentry.arc . . . . . . . . . . . 9
2.30 Sentry02.arc . . . . . . . . . . 9
2.31 SysChk1.arc . . . . . . . . . . 9
2.32 TrapDisk.arc . . . . . . . . . 10
2.33 UnVirus.arc . . . . . . . . . . 10
2.34 Vaccine.arc . . . . . . . . . . 10
2.35 VaccineA.arc . . . . . . . . . 10
2.36 VCheck11.arc . . . . . . . . . 10
2.37 Vaci13.arc . . . . . . . . . . . 10
2.38 VDetect.arc . . . . . . . . . . 10
2.39 VirPres.arc . . . . . . . . . . 11
2.40 Viruscan.arc . . . . . . . . . . 11
2.41 VirusCK.arc . . . . . . . . . . 11
2.42 VirusGrd.arc . . . . . . . . . 11

1 IBMPC Virus Info

1.1 1704vir.txt

This is a description of the 1704 or Cascade virus.

Author . Jim Goodwin
Date …. 1989

1.2 405

This is a description of the 405 virus.

Author . Dave Ferbrache
Date …. April 1989

1.3 A-VirTst.arc

This is a report on implementing anti-viral programs. This is directed at users, rather than software developers. It gives criteria for judging different classes of anti-viral products, and also gives a step by step recommended procedure for conducting the tests. Highly recommended.

Author . John McAfee
Date …. 1989

1.4 Alameda

This is a description of the Alameda, Yale, Merrit, Pecking or Seoul virus. Also included are the Sacramento virus, the SF virus and the Golden Gate virus.

Authors Dave Ferbrache & Jim Goodwin & Chris Bracy

Date …. April 1989

1.5 AllVirus.arc

A listing of 48 different IBMPC viruses, with a short description of each.

Author . Jim Goodwin
Date …. April 1989

1.6 April1st

This is a description of the April 1st virus.

Authors Dave Ferbrache & Jim Goodwin & Y. Radai

Dates … May 1988 to April 1989

1.7 Austrian

This is a description of the Austrian or 648 virus.

Authors Dave Ferbrache & Jim Goodwin
Date …. April 1989

1.8 Brain

This is a description of the Brain, Pakistani Brain, Basit, Brain-HD, Hard Disk Brain, Houston, Clone, Shoe Virus, UIUC, or Jork virus.

Authors Dave Ferbrache & Jim Goodwin & Carl Fussell & others

Date …. April 1989

1.9 Cascade

This is a description of the Cascade, 1701, Falling Tears, Autumn Leaves, 1704 or Black-Jack virus.

Authors Dave Ferbrache & Jim Goodwin & Otto Stolz

Date …. January 1989, April 1989

1.10 dBase

This is a description of the dBase virus.

Author . Ross Greenberg
Date …. March 1989

1.11 DirtyDz9.arc

This is the “Dirty Dozen”, a listing of viruses, Trojans and other illicit programs that IBMPC users ought to be aware of. This is version 9b. Periodic updates are released.

Editors . Tom Sirianni & Sally Nueman
Date …. January 1989

1.12 DOS62

This is a description of the DOS-62 or UN-ESCO virus.

Author . Dave Ferbrache
Date …. April 1989

1.13 Eval.txt

This is a review of a number of anti-viral products available for the IBMPC. The reviewers had access to a large collection of “live” viruses, so their conclusions should have some merit.

Authors Jim Goodwin, Lynn Marsh & Tim Sankary

Date …. May 1989

1.14 Friday13th

This is a description of the Friday the 13th, COM or 512 virus.

Author . Dave Ferbrache
Date …. April 1989

1.15 Greenbrg.arc

This is a transcript of an on-line chat with Ross Greenberg over the GEnie network. Ross is the author of the FLU SHOT series.

Authors various
Date …. circa FLU SHOT+ version 1.2

1.16 Immunity.txt

This article purportedly offers a system whereby an IBMPC can gain immunity to viral attacks. The method is basically to rename COMMAND.COM, and then patch DOS to use the new name.

Author . J. Winslade
Date …. March 1988

1.17 Israeli

This is a description of the Jerusalem, Israeli, Friday the 13th, PLO, New Jerusalem, Black Hole, Russian, Century or Oregon virus.

Authors Dave Ferbrache & Jim Goodwin & Y. Radai

Date …. May 1988, April 1989

1.18 Italian

This is a description of the Italian, Bouncing Ball or Vera Cruz virus.

Authors Dave Ferbrache & Jim Goodwin & Y. Radai

Date …. March 1989, April 1989

1.19 Lehigh

This is a description of the Lehigh virus.

Author . Ken van Wyk
Date …. February 1989

1.20 Oropax

This is a description of the Oropax virus.

Author . Thomas Lippke
Date …. March 1989

1.21 Troj2.arc

This file contains the text of a lawsuit filed by a BBS sysop against a user who uploaded a Trojan program.

Author . William Christison
Date …. August 1988

1.22 Vaccine.Rev

This file is a review of the commercial program “Vaccine”. Version 2.0 of this package from WorldWide Data Corporation is reviewed.

Author . J. D. Abolins
Date …. unknown

1.23 Vir-Asm.doc

This document announces the availability of disassembled viruses to qualified applicants.

Author . InterPath Corporation
Date …. unknown

1.24 Vir3.arc

This is a description of suggested methods to use when developing anti-viral products. The history, methods and counter-attacks against viruses are explored.

Author . Tim Sankary
Date …. 1989

1.25 VirBlkJk.doc

This is the text of an announcement on Virus-L detailing the operation of the “Black-Jack”, “17+4” or “1704” virus.

Author . Otto Stolz
Date …. January 1989

1.26 VirDoc2.txt

This document discusses the various types of viruses, and the different anti-viral products available. Includes some good step by step instructions.

Author . InterPath Corporation
Date …. July 1988

1.27 Virus.arc

This is a collection of documents dealing with the virus problem. Among the files included are a description of the SCA virus affecting Amiga computers and the Christmas Exec affecting IBM mainframe systems. There is also an overview of microcomputer viruses and mainframe viruses.

Authors various

Dates … range from November 1987 to February 1988

1.28 Virus-B.doc

Virus-B is a deactivated version of the Friday the 13th virus. This virus is being made available to qualified applicants on a limited basis. Virus-B is to be used in studying virus behavior and testing anti-viral measures.

Author . InterPath Corporation
Date …. unknown

1.29 ViruSim.txt

Viru-Sim is a COM and EXE virus simulator to be used in testing anti-viral measures and for demonstration of viral replication. Virus-Sim is available directly from the authors.

Author . National BBS Society
Date …. unknown

1.30 VProInfo.doc

This is an addendum to the article “Anti-Virus Measures”. This covers the “Virus-Pro” product from International Security Technology, Inc.

Author . Bob Jacobson
Date …. March 1989

2 IBMPC Anti-Virals

2.1 Alert13U.arc

A program to watch the files on a disk by computing checksums. Menu driven with online help.

Version . 1.3u
Status . . Shareware, $20
Author . Robert Reed
Date …. 1988

2.2 BombChek.arc

This package includes two “old” programs and two “new” programs. The programs appearing elsewhere are Chk4Bomb and BombSqad. The new programs are WPHD, a program to “write protect your hard drive”, and FPHD, to “format protect your hard drive”.

Version . unknown
Status . . Freely redistributable
Author . unknown
Date …. November 1985

2.3 BombSqad.arc

This is a resident program which attempts to intercept all disk activity. You can intercept reads, writes, verifies and/or formats.

Version . 1.2
Status . . Freely redistributable
Author . Andy Hopkins
Date …. unknown

2.4 CAware.arc

This is a collection of files which allow you to create applications which know their own CRC values. This way your programs can detect any tampering, and take appropriate action. This version for Turbo C. The source (available upon payment) “should” work with Microsoft C.

Version . 1.0 (?)
Status . . Shareware, $10 or $15
Author . Gilmore Systems
Date …. 1988

2.5 Check-OS.arc

A simple program to check the date, size and

checksum of COMMAND.COM, IBMBIO.COM and

IBMDOS.COM. Includes source.

Version . 1.3 (?)
Status . . Public domain

Authors R. J. Bartlett & Erik Ohrnberger

Date …. March 1988

2.6 CheckMem.c

The source to a simple program to check the memory in a PC. Looks for the Brain virus.

Version . 1.0 (?)
Status . . Public domain
Authors Joseph Sieczkowski (?)
Date …. unknown

2.7 Chk4Bomb.arc

This program scans the binary of an executable program and attempts to find all ASCII strings and all potentially dangerous disk activity.

Version . 1.00
Status . . Freely redistributable
Author . Andy Hopkins
Date …. October 1985

2.8 ChkLHArc.arc

This is a utility that will inspect self-extracting archives packed with LHArc, and try to determine if they contain potentially destructive automatic scripts.

Version . 1.1
Status . . Freely redistributable
Author . PAL Software
Date …. April 1989

2.9 ChkSum.arc

A simple checksum program to detect changes to the files named on the command line. Includes source code.

Version . 1.0 (?)
Status . . Freely redistributable
Author . Bob Taylor
Date …. unknown

2.10 ChkUp35.arc

This is another program to compute CRCs of files. This program uses “randomized” CRCs in an attempt to thwart “intelligent” viruses. Also included is extensive documentation.

Version . 3.5
Status . . Shareware, $25
Author . Richard Levin
Date …. June 1989

2.11 Condom.arc

This program is used to check executables against “reference” copies of the same program also stored on your disk.

Version . 1.0 (?)
Status . . Freely redistributable

Authors Charlie Ros5e [sic] & Gerry Williams

Date …. February 1988

2.12 Delouse1.arc

This program computes checksums for a number of specified files. The user can select one of three different checksum methods. Distributed with source.

Version . 1.0
Status . . Public domain
Author . Phillip Nickell
Date …. March 1988

2.13 Detect2.arc

“The Detective” tracks all files on a disk. It claims to be able to spot all additions, deletions and changes. It uses two CRCs, in addition to file listings. (Update of “Virus Detecter”.)

Version . 1.2

Status . .

Shareware, $25 (crippled version distributed)

Author . PC Solutions
Date …. August 1988

2.14 DProt102.arc

A memory resident filter which captures BIOS and DOS calls and attempts to write-protect floppy and hard drives.

Version . 1.02
Status . . Shareware, $5
Author . GEE WIZ Software
Date …. November 1985

2.15 DProtect.arc

A memory resident filter which captures BIOS and DOS calls and attempts to write-protect floppy and hard drives. This archive includes a disassembly of the executable.

Version . 1.01
Status . . Shareware, $5
Author . GEE WIZ Software
Date …. October 1985

2.16 DVir1701.exe

This program detects and optionally removes the 1701 virus in .COM files.

Version . v1.0
Status . . Freely redistributable
Author . McAfee Associates
Date …. 1988

2.17 Early.arc

This is an “Early Bird” which attempts to get the “worm”. This program scans an executable looking for uses of interrupts 13h and 26h, and also for OUT instructions.

Version . 1.0 (?)
Status . . Freely distributable
Author . unknown
Date …. unknown

2.18 EPW.arc

Although there is no documentation with this program, it appears to be a password program for executable files.

Version . v1.2
Status . . Shareware, $15 – $40
Author . Alan D. Jones
Date …. 1987

2.19 File-CRC.arc

This is another enhancement to Ted Emigh’s CRC checking program. This includes an option to use one of three CRC polynomials, or choose your own.

Version . 1.0 (?)
Status . . Public domain
Author . Jim Van Zandt
Date …. after May 1988

2.20 FileCRC.arc

This program computes CRCs for all files on a disk. Source code is included.

Version . 1.0 (?)
Status . . Public domain
Author . Ted Emigh
Date …. May 1988

2.21 FileTest.arc

A program to calculate CRCs for a given set of files. Based on code released to the public domain by Ted Emigh.

Version . 1.0 (?)
Status . . Public Domain
Author . L. Levine
Date …. March 1988

2.22 FSP 16.arc

This is FLU SHOT+ version 1.6. FSP is a resident program which attempts to intercept all “suspicious” disk accesses. Access protection will discriminate based upon file name extension. Also includes facilities to checksum files.

Version . 1.6
Status . . Shareware, $14
Author . Ross Greenberg
Date …. 1989

2.23 Immune.arc

This is a RAM resident program which will prevent the infection and spread of two strains of the Israeli or Friday the 13th virus, and two strains of the April 1st virus.

Version . 1.0 (?)
Status . . Freely redistributable

Author .

Yuval Rakavy, Omri Mann & Y. Radai

Date …. 1988

2.24 Inoculat.arc

This is a simple program that sets the directory entry for COMMAND.COM to read only. (This was apparently written before such utilities were wide-spread.) This will defeat the early versions of the Lehigh virus. Also includes program to make directory entry read/write.

Version . 1.0 (?)
Status . . Freely redistributable
Author . Wes Brzozowski
Date …. 1988

2.25 MD40.arc

This is a utility to remove generic boot sector or partition table viruses such as the Pakistani Brain, Den Zuk, Bouncing Dot, Stoned, Alameda or any other boot/partition virus. This version works only with MSDOS 4.0. Contact author for similar utilities for other versions of MSDOS.

Version . 1.0 (?)

Status . .

Shareware, $25 initial cost + $5 per usage

Author . McAfee Associates
Date …. May 1989

2.26 NoBrain.c

Source code for a program to remove the Brain virus from diskettes. Code is for the CI86 compiler from Computer Innovations.

Version . 1.0 (?)
Status . . Public domain
Author . Joseph Sieczkowski (?)
Date …. unknown

2.27 NoVirus.arc

This program will scan a command processor, comparing it to a second copy stored elsewhere on the disk. It will “correct it if necessary”. Should work also work for any other type of file.

Version . 1.0 (?)
Status . . Shareware, $10
Author . Yan Seiner
Date …. 1988

2.28 ProveCRC.arc

This program purports to “prove” that CRC checking is not a reliable method for detecting viruses. Unfortunately, the author seems to be unaware of the fact that a CRC is based on a polynomial, and there are many polynomials which can be used for CRC checks. This just “proves” that with advance knowledge of the polynomial, a virus can evade a CRC check.

Version . 1.0 (?)
Status . . Freely redistributable
Author . Gilmore Systems
Date …. unknown

2.29 Sentry.arc

Sentry is a program to detect viruses using CRC checks. It claims to be extremely quick, because the program only checks the “vulnerable” portions of executable programs.

Version . 1.8
Status . . Shareware, $15
Author . McAfee Associates
Date …. unknown

2.30 Sentry02.arc

This program computes CRCs for all specified files. It claims to run quickly, since it only checks the most vulnerable portion of each executable. This saves the time normally required to scan the entire disk.

Version . 2.0
Status . . Shareware, $15
Author . McAfee Associates
Date …. May 1989

2.31 SysChk1.arc

Computes a checksum of COMMAND.COM,

                                        IBMDOS.COM and IBMBIO.COM. Returns an

ERRORLEVEL if value is not the same as specified on command line.

Version . 1.0
Status . . Freely redistributable
Author . Terratech
Date …. 1988

2.32 TrapDisk.arc

This is a memory resident program which attempts to intercept all BIOS and DOS attempts to access any disk drive. Can selectively intercept reads, writes, verifies and/or formats.

Version . 1.0
Status . . Public Domain
Author . unknown
Date …. unknown

2.33 UnVirus.arc

This program will scan a disk for any of five viruses and repairs any infections found. It will optionally only report infections, not attempting any repairs. The viruses this program knows of are two strains of the Israeli or Friday the 13th virus, two strains of the April 1st virus and the Ping-Pong or Italian virus.

Version . 1.0 (?)
Status . . Freely redistributable
Author . Yuval Rakavy & Y. Radai
Date …. 1988

2.34 Vaccine.arc

A simple program to check the size and date of a given file. A message to the screen reports success or failure.

Version . 1.0 (?)
Status . . Freely redistributable
Author . unknown
Date …. May 1987

2.35 VaccineA.arc

The document accompanying the program says nothing about the operation of the program. It is mostly an announcement of the presence of the Lehigh virus. The program implements a file compare, to be used to check if the COMMAND.COM file has been changed.

Version . 1.0 (?)
Status . . Freely redistributable
Author . John Gidman
Date …. February 1988

2.36 VCheck11.arc

This program will calculate checksums for all files and compare file sizes. It has an option to only perform this check at the initial boot each day, bypassing it thereafter.

Version . 1.1E
Status . . Shareware, $25
Author . Systemberatung Axel Dunkel
Date …. January 1989

2.37 Vaci13.arc

The program Vacine [sic] apparently checksums your operating system files and keeps a record of this in a separate file. This can then be checked each time you boot.

Version . 1.3
Status . . Shareware, no price given
Author . Art Hill
Date …. 1988

2.38 VDetect.arc

“Virus Detecter” tracks all files on a disk. It claims to be able to spot all additions, deletions and changes. It uses two CRCs, in addition to file listings.

Version . 1.1

Status . .

Shareware, $25 (crippled version distributed)

Author . Tim OBrien
Date …. August 1988

2.39 VirPres.arc

This is a package of electronic visual aids for virus seminars, demonstrations, classrooms, etc. This package requires a VGA monitor.

Version . 1.0
Status . . Freely Redistributable
Authors Frank Nalls & Jim Goodwin
Date …. May 1989

2.40 Viruscan.arc

This program will scan an entire diskette or hard drive and identify any virus it finds. This version knows of 19 different viruses. Included in this list are 10 viruses which the authors claim account for 90% of reported IBMPC infections.

Version . 0.2V19
Status . . Shareware, $15
Author . McAfee Associates
Date …. 1989

2.41 VirusCK.arc

This is a relatively simple program which merely checks the date and size of a specified file.

Version . 1.0 (?)
Status . . Shareware, $10
Author . Matt Cohen
Date …. 1988

2.42 VirusGrd.arc

This package is distributed without documentation. A copyright notice naming I. P. Technologies can be found in the code.

Version . 1.0 (?)
Status . . Freely redistributable
Author . I. P. Technologies
Date …. unknown