Hacker 2/HACKER2.mdf/virus/virusl3/virusl3.44

Text File | 1995-01-03 | 26KB | 607 lines

VIRUS-L Digest   Friday, 16 Feb 1990    Volume 3 : Issue 44

Today's Topics:

Re: The AIDS "Trojan" is a Copy Protection System
New Virus???? (Mac)
CMOS viruses? Nonsense! (PC)
Virus posted to VALERT-L (PC)
Copyright in viral code
re: Universal Virus Detector
re: AIDS program (PC)
Re: The AIDS "Trojan" is a Copy Protection System
Pakastani Virus (PC)
Re: The ethics of virus eradication
Re: AIDS Trojan - self protection
Re: Undetectable Virus (Mac)
Re: The AIDS "Trojan" is a Copy Protection Systemy
Re: Virus Buster (PC)
Re: The ethics of virus eradication
Ohio Virus: Old Dominion U (PC)

VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a non-digested Usenet counterpart.
Discussions are not limited to any one hardware/software platform -
diversity is welcomed.  Contributions should be relevant, concise,
polite, etc., and sent to [e-mail] (that's
LEHIIBM1.BITNET for BITNET folks).  Information on accessing
anti-virus, document, and back-issue archives is distributed
periodically on the list.  Administrative mail (comments, suggestions,
and so forth) should be sent to me at: [e-mail].
 - Ken van Wyk

---------------------------------------------------------------------------

Date:    Wed, 14 Feb 00 19:90:05 +0000
From:    microsoft![e-mail]
Subject: Re: The AIDS "Trojan" is a Copy Protection System

>4.   That the people hurriedly disassembling the program actually
>     committed a breach of the license agreement, and are liable
>     for legal action from PC Cyborg.  Equally, copying of this
>     program is as illegal and is as much piracy as copying any
>     commercial program.

    When a person or company holds property hostage, then lesser laws
can be broken to effect the release of this property.  There
is clear precedent for this.

>I am stunned at the sheer volume of pointless garbage that this
>program has generated, and it makes me seriously doubt any other
>information received from these "experts".  I would also point out
>that self-destructing programs are not new, but one has never caused
>such an outcry before.

   SELF destructing programs are one thing, programs that hold your
computer hostage are another.  It was distributed the way free bars of
soap are distributed.  How would you like to get a bottle of detergent
in the mail that said in fine print "This bottle of soap is not free,
if you use it, send $189.00 to blah blah.  If you don't, you won't
like the consequences.".  Since of course no one reads junk mail, you
use the soap.  It then commences to turn your clothing blue.  THEN you
read the bottle to see what is going on.  If the manufacturer wasn't
arrested, I would sue them for damages.

>If the author of this program is convicted, it will be the first
>conviction ever for the hidious crime of writing a copy protection
>system, and will be one of the biggest farces of justice ever
>witnessed.

    Tell me, what products do you make? I don't EVER want to
use/buy/look at anything from someone that believes he has the right
to cripple my computer if I don't read the fine print.

Brad Thompson                                          [e-mail]
- --------------------   Disclaimer under construction   --------------------

------------------------------

Date:    Thu, 15 Feb 90 13:34:55 -0500
From:    "Chris Khoury (Sari's Son)" <[e-mail]>
Subject: New Virus???? (Mac)

      I was looking thru my Hard Disk today with Disk Tools II (DA)
and noticed a file: _(A2002646)_ on my HD, it's file attributes were
No Copy and Invisibly the File Type is LISA and the Creator is DALE.
It was created on 9/2/02 and it is 2.5K. Anybody know what this is?

------------------------------

Date:    15 Feb 90 19:38:00 +0700
From:    [e-mail]
Subject: CMOS viruses? Nonsense! (PC)

Hi!

Rollo D. Rogers (vol. 3, issue 42) writes:

>this one lives in the setup-memory (CMOS) that was backed up by the
>computer battery.  All the infected diskette can be reformatted and can
>be purified, but this one lives there until human disconnects the
>battery from the unit and restart the machine.  The story seems quite
>plausible and that's why I decided to hear from experts' opinion on
>the net.  Since today's AT usually uses CMOS memory, this looks a
>serious problem.

Nonsense! There are only 64 bytes there and only the half of them are
not used (these at offsets 11h, 13h, 1Bh-2Dh, 34h-3Fh). And even if
someone is smart enough to write such a small virus (which I claim to
be also impossible on 80x86 based computer), these bytes are not
directly addressable. This means that you cannot *execute* the code
which resides in them. You have prior to extract it (using some IN and
OUT instructions). But the code, which will be able to do this *ought*
to reside somewhere else.

Yes, it is possible to design a virus, which will be able to use the
CMOS RAM as a storage for, say, some flags, but not for its entire
code!

>The story went further:  once the scan program is loaded, the virus
>in there can recognize his eternal enemy (well I might be
>exaggerating, or making a fairly tale..) and destroy it.

Nonsense! By the way, which scan program? There are hundreds of them
and they are all different.


  Michael Greve writes:
>  I want to thank all the people who sent me messages on using the
>CLEAN program.  Unfortunately the program did not work.  It removed
>the virus and shrank the .exe file from 260,000+ bytes to 84,000.
>Needless to say this file didn't run.  Does anybody have any other
>ways of getting rid of this virus.  Is the Jerusalem virus a
>particularly difficult virus to get rid of???

and Y. Radai (vol. 3, issue 42) responds:

>  Ordinarily, the Jerusalem virus is easy to get rid of using any of
>the common anti-virus programs (CLEANUP, UNVIRUS, F-FCHK, VB, etc.).

Maybe Michael Greve is trying to disinfect files infected with
Jerusalem B with a program designed for files infected with Jerusalem
A? This is just a suggestion, I do not know neither Jerusalem B, not
the packages, mentioned by Y. Radai.

------------------------------

Date:    15 Feb 90 00:00:00 +0000
From:    "David.M..Chess" <[e-mail]>
Subject: Virus posted to VALERT-L (PC)

Looks like a new one to me!  Very preliminary (possibly wrong)
description:

  - Infects both EXE and COM files.
  - Once the virus is in memory (after the first infected file
    is executed), any vulnerable COM or EXE file that
    is executed via INT 21h function 4Bh will become infected.
    (Vulnerable COM files are uninfected files larger than 999
    bytes and smaller than roughly 62500 bytes; vulnerable
    EXE files are uninfected and larger than about 1500 bytes).
  - If the current month is September, October, November, or
    December, all writes done via INT 21h function 40h will be
    interfered with (the write-buffer register will have 0Ah
    added to it before the write).

This is all from disassembly, not from testing!

The virus is quite unreliable; it loads its resident part into address
9800:0000, without first checking to see if that memory is in use, or
even exists.  The virus will therefore not work on a machine with less
than 640K of memory, and it will cause malfunctions on any 640K
machine that is *using* 9800:0000 for something.  It also does some
rather cutesy things to try to defeat people trying to execute it from
within a debugger, and to take over INT 21 without anyone noticing.
The things add to the unreliability of the virus, but don't make it
significantly harder to detect or analyze.

Here's one possible scan-id (good term!):
22032E8B1E9B00B440CD218B

This may be of use to anyone who "accidentally" downloaded and tried
out the code from VALERT-L!  (Personal opinion: this virus is
incompetent enough that it will always be rare, if it doesn't
immediately go extinct.)

DC

[Ed. Many thanks for the analysis, Dave!  John McAfee has a new SCAN,
version 58 that scans for this virus, dubbed (by John) as the 1559
virus.  I've sent SCAN version 58 to Jim Wright for posting to the
VIRUS-L/comp.virus archive sites.  Thanks to everyone who responded so
quickly to this problem!]

------------------------------

Date:    Thu, 15 Feb 00 14:37:29 +0000
From:    Stuart Milligan <[e-mail]>
Subject: Copyright in viral code

> M.J. Crepin-LeBlond suggests that all you have to do to make having
> virus code once something has been released in some form
> (uncopyrighted) to the general public, it could then never be
> copyrighted.

                     Steven C Woronick

> Well, if it's written in the United States, it's copyrighted automatically as
> soon as it's written to disk.  Anything 'recorded in a fixed medium of ex-
> pression' is automatically copyrighted, with the rights going to the author,
> unless she gives them up voluntarily...At any rate, I'm certain that, if Sam
> Sociopath locks himself up in a Las Vegas hotel room and writes a virus, the
> copyright belongs to him. (Unless he makes it public domain, transfers the
> rights, or is being paid by another to write the virus.)

                     Greg Broiles

Under the United States 1909 revision of the Copyright Act, it was
indeed true that if a copyright owner failed to meet the formal
requirements of a copyright notice cast in the correct format, the
work was automatically forever thrust into the public domain.
However, with the advent of the 1976 revision of the law, notice
standards were somewhat loosened.  If an author failed to publish the
notice as prescribed by sections 401-403, the copyrights would not
always be forever lost or injected into the public domain, provided
that "the notice has been omitted from no more than a relatively small
number of copies...dis- tributed to the public" [the courts will have
a heyday with the term 'relatively small'] or that "registration for
the work has been made before or is made within five years after the
publication without notice, and a reasonable effort is made to add
notice to all copies...that are distributed to the public in the
United States after the omission has been discovered" [the phrase
'reasonable effort' is another one of those rubbery concepts] (see
section 405, subsection (a), clauses (1) and (2)).

It should also be noted that anyone who innocently infringes a
copyright where the copyright notice has been omitted, "incurs no
liability for actual or statutory damages...if such person proves that
he or she was misled by the omission of notice". (see subsection (b)
of section 405)

So, no longer is a copyright truly invalidated forever due to lack of
copyright notice.  This would imply that the author of a viral code
could legally retain rights of authorship in a work not registered for
copyright and for which the work has been released publicly without
proper copyright notice.

However, other sections of the Copyright Act (and other tort laws)
would likely govern the issue of whether or not viral code is proper
"copyrightable subject matter" in the first place.  It is not very
probable that the Register of Copyrights would allow the registration
of viral code.  On the other hand, they seem determine that "in
accordance with the provisions of this title [Title 17 - Copyrights],
the material deposited does not constitute copyrightable subject
matter or that the claim is invalid for any other reason," and could
thereby refuse registration. (see section 410, subsection (b))

Just a few thoughts to further muddy the waters.

QUESTIONS:

1.  Why on earth would law-breakers expose themselves to the arms of
    justice by attempting to enforce viral code copyrights?

2.  If viral code is really able to be legally sanctioned by Title 17,
    can anti-viral authors freely write programs without infringing
    the "derivative work" right of the viral code copyright owner?
    (see Copyright Act definition of derivative work and section 106,
    subsection (2))

Stuart Milligan
Drake Memorial Library
SUNY at Brockport
Brockport, NY  14420

[phone]

------------------------------

Date:    15 Feb 90 00:00:00 +0000
From:    "David.M..Chess" <[e-mail]>
Subject: re: Universal Virus Detector

> VDOS pseudo-executes the program, checking for
> every possible outcome and attempts to write to disk.

Unlikely to be practical, I'm afraid?  For instance, if the program
waits for user input, or looks at the time or date, or reads from a
file (I can't think of -any- program offhand that doesn't sometimes do
at least one of these), the pseudo-executor would have to
pseudo-execute a separate instance of the program for every possible
input/time/data-item.  Not likely to finish within the life-expectancy
of the user!

DC

------------------------------

Date:    15 Feb 90 00:00:00 +0000
From:    "David.M..Chess" <[e-mail]>
Subject: re: AIDS program (PC)

The PC Cyborg AIDS diskette did include a sizeable program (AIDS.EXE)
containing lots of code and data for administering a questionaire and
giving AIDS-related advice.  I can't speak for the *quality* of that
advice, but the program was definitely non-trivial.  The only negative
thing I know for sure about it was that it refused to run unless the
nefarious INSTALL.EXE had been run first.  (Of course, there may once
have been some non-nefarious INSTALL program that also set whatever
flag AIDS.EXE looks for.)

DC

------------------------------

Date:    15 Feb 90 20:46:13 +0000
From:    [e-mail] (Lambert Meertens)
Subject: Re: The AIDS "Trojan" is a Copy Protection System

[e-mail] writes:
)
)  1) The AIDS disk did not have copy protection at all.  [...]
)  2) The disks were unsolicited.  [...]
)  3) The market to which the disks were targeted was especially sensitive.
)     [...]

In addition, it may be pointed out that a user who wrote out a check and
mailed it to Cyborg, and only then used the program, was equally at risk.
I do not understand how anyone can seriously doubt that this was a scheme
for obtaining money in an unethical way.

- --Lambert Meertens, CWI, Amsterdam; [e-mail]

------------------------------

Date:    Thu, 15 Feb 90 18:49:15 -0500
From:    Mike Kapfer TSG <[e-mail]>
Subject: Pakastani Virus (PC)

  One of our student labs seems to have been infected by the Pakastani
virus (aka. BRAIN).  Many of the student's disks sampled, have also
been infected.  We are currently assessing the scope of this infection
on our campus.  We do not believe that our NOVELL networks can be
infected since this virus is a boot sector infection.  I would
appreciate any information about this virus.  Please mail to me
directly.  Thank you.

Michael Kapfer: Old Dominion University: Norfolk, VA: USA: [phone]

------------------------------

Date:    Wed, 14 Feb 90 17:23:26 +0000
From:    [e-mail] (Spenser Aden)
Subject: Re: The ethics of virus eradication

[e-mail] writes:
>My questions are these - what should I have done? Kept the infection
>secret? Are computer viruses a Social Disease? Are we physicians who
>are supposed to swear some form of Computerized Hippocratic Oath of
>confidentiality? Or, do we paint a Scarlet-V on the heads(or
>terminals) of those unfortunate ( careless enough) to become infected?

Your action seems completely reasonable.  Why in the world would
anyone without something to hide want to have it not be known that a
virus was loose?  While this person may have been embarrased by the
fact that people could figure out that he was the one who introduced a
virus, it's certainly more important to stop the spreading than simply
preserve his own reputation.  And after all, he didn't deliberately do
it (I presume), so why not try to stop it?

I don't think that painting the Scarlet-V on his character is proper,
but then I don't think that is what you intended with your e-mail.
Whether the e-mail did or not, though, is up to personal opinion
(IMHO).  But if you tried as best you felt you could to preserve his
anonymity, then I feel this was a correct and reasonable response to
the infection.

- -Spenser

- --
S. Spenser Aden                  | This may have been a test of the emergency
Ferranti International Controls  | flame-throwing system.  Had this been an
[e-mail]              | actual flame, you would have been instructed
Only my opinions, not Ferranti's.| where to follow-up.  This was only a test.

------------------------------

Date:    15 Feb 90 10:30:27 +0000
From:    [e-mail] (Mikel Lechner)
Subject: Re: AIDS Trojan - self protection

woodb!scsmo1![e-mail] writes:

 >> 1.   That all of the users who were adversely affected by this
 >>      supposed trojan either (a) did not read the license
 >>      agreement for the program which they were installing, or (b)
 >>      they read it and ignored it.  Either way, they must accept
 >>      the consequences.  The installation instructions first step
 >>      tells you to read the agreement on the reverse of the sheet.

Or perhaps they read it and did not understand its implications.

 >  I agree, this is the most common practice.  You get this great
 >software and you want to see it RIGHT NOW!  Well, one DOES need to
 >read those agreements and take them at face value.

In any case a license is a contract and contracts are governed by
contract law.  Just because something is stated in a contract does not
make it legally binding.  The contract must abide by contract law.
For example a copyright must meet certain qualifications to valid.  It
must use the word "copyright," it must appear in an obvious place
(where it cannot be overlooked), and it must state what rights are, or
are not, granted.  If if fails these requirements it is not a valid
copyright.

For example, let's say I include a copyright in a program I write in
some obscure place in the program.  Someone then copys and uses my
program in a way forbidden by my "copyright" notice.  Since my
"copyright" was not obvious (to a reasonable person) it would be
invalid.  The same logic applies to license agreements.

To state in a license agreement that using a product without paying
for it will cause intentional damage most certainly violates the law.
Therefore such a license agreement is not valid period!  To say the
program will not function without payment is not illegal, and
therefore is valid in a license agreement.  A self-destructing program
is simply making itselft non-functional.  The AIDS trojan willfully
destroys another person's property.  These seem like quite different
situations to me.

- --
                                If you explain so clearly that nobody
                                can misunderstand, somebody will.
Mikel Lechner
Teradyne EDA, Inc.              UUCP:  [e-mail]

------------------------------

Date:    16 Feb 90 06:12:51 +0000
From:    [e-mail] (Bernard Littau)
Subject: Re: Undetectable Virus (Mac)


[e-mail] (Betty Harvey) writes:
>       I have seen two Macintoshes that have a virus that I can't seem
>to recognize.  I have run Disinfectant 1.6 because I thought it was the
>WDEF virus that I have been reading about but disinfectant didn't find
>anything abnormal.  I have also ran several other virus eradicaters and
>they didn't recognize anything out of the ordinary.
>
>                       Symptoms:
>
>       The system file increases in size and the date changes
>       each time the system is rebooted.  One system file was
>       2 meg long before all application program ceased to work.
>
>       Applications unexpectedly stop.
>
>       The system hoses up occasionally when going to the printer.
>
>Is anyone aware of any new viruses or what I might be dealing with.
>We had a massive outbreak of Scores and nVir about 1 year ago, but
>have had fairly healthy machines since then.

I have experienced similar behavior on some of my Macs.  I usually
found a system resource was trashed.  Rezdet, part of MPW, would
pinpoint the offending resource.

I now leave the system locked.  This prevents the problem
I was having, but also prevents other things, like changing the
desktop pattern.

I attributed the problem to programs crashing under MultiFinder.

To the best of my reccollection, the vers resource was the one usually
trashed.  Sometimes deleting the bad vers would remove the problem and
the system's growth.  At other times, the system would need to be
restored from backup.

I now lock system as a matter of course.  Can anyone come up with a
reason why this would be a bad idea?


Bernard Littau    VM Radiological Sciences        Telephone: [phone]
                  School of Veterinary Medicine   Internet:  [e-mail]
                  University of California        BITNET:    vmrad@ucdavis
                  Davis, CA 95616                 UUCP: ucbvax!ucdavis!vmrad

------------------------------

Date:    14 Feb 90 12:25:56 +0000
From:    [e-mail] (JM Ivler)
Subject: Re: The AIDS "Trojan" is a Copy Protection Systemy

munnari!mqccsunc.mqcc.mq.oz.au![e-mail] (Ian Farquhar) writes:
> "Read this license agreement carefully.  If you do not agree with the
> terms and conditions stated below, do not use the software, and do not
> break the seal (if any) on the software diskette..."
>
> ...
>
> End quote.
>
> This is not a trojan: it is a COPY PROTECTION SYSTEM.

If that is the case, the proper thing for his attorney to do is:

1) don't fight extradition
2) file an immediate lawsit for specific damages in the courts

The suit shaould name anyone who printed anything in anyway that
explained on how to "clean" the system of the protections. The damages
are (# of disks distributed)* US$378 . This is based on the fact that
there is no idea on how many people read the articles that told how to
"break through the copy protections" but that all owners of the disks
have the capability to do so.

Then there is the damage to the "good name" of PC Cyborg... I would
hate to be one of the publishers of a magazine that told people how to
"get rid of the AIDS trojan."

This has been a very expensive lesson.

jmi   [e-mail]

------------------------------

Date:    Fri, 16 Feb 90 05:08:29 +0000
From:    [e-mail] (Alan D Danziger)
Subject: Re: Virus Buster (PC)

Well, I got an emergency call from a friend of the family this
evening, and I was wondering if anyone has heard anything about the
problem she had...
  She's working on a Mac SE, 20 meg Apple drive, system 6.0.4/finder
6.1 (I think, its the 107K version that comes w/ 6.0.4), and after
about 2 months of using it, calls me with this problem:

    The Mac's trash can icon has disappeared, and there's a message at
the bottom of the screen, 'based on a program by Encore Systems' or
something close to that...  Also, the menus are messed up: File has
'New folder' and 'Close', edit, view, and the apple menu are fine,
Special had no entries originally, and there were 3 extra menus: one I
can't remember, a 'style' menu, and a 'attrib' menu.

    I had her replace the finder and the system files separately in
the system folder, checking for invisible files with Disktools II (but
I didn't recognize any), and it still didn't work.  FInally I had her
remove system and finder into separate folders, and rename the system
folder to 'old sys' and copy the system folder from a locked System
Tools floppy, and when she rebooted the problem remained.

        If you have any ideas as to what this might be from, PLEASE
respond ASAP via Email (and posting here if you want) because she is
slightly frantic, and I can't drive 250 miles just for that...  She
will be calling me Sunday night or Monday morning for an answer, so...

        Thanks in advance,
                -=Alan
                [e-mail]
                [e-mail]

------------------------------

Date:    16 Feb 90 06:06:39 +0000
From:    khijol![e-mail] (Ed Carp, aka Mr. Ed the talking horse...)
Subject: Re: The ethics of virus eradication

[e-mail] writes:

>Well, that didn't work. The faculty member was extremely angry about
>the E-mail message. I did mention the type of program that was the

What's the guy's problem?  So he got bit?  So what?  People get bit by
the virus all the time; it's not a big deal from the social
standpoint.  What's he think -- someone's going to point at him in the
hall and giggle?  Sounds like the guy has an extreme personal problem
to me.

I think you took a prudent necessary step to protect the users of the
computer system.  The faculty member that complained is looking at
things from his own personal (read: ego) standpoint.
- --
Ed Carp                 N7EKG/5 (28.3-28.5)     uunet!cs.utexas.edu!khijol!erc
Austin, Texas           [phone]          "Good tea.  Nice house." - Worf
Opinions expressed are mine. Copyright 1990 Edwin R. Carp. All Rights Reserved.

------------------------------

Date:    Fri, 16 Feb 90 10:19:48 -0500
From:    Mike Kapfer TSG <[e-mail]>
Subject: Ohio Virus: Old Dominion U (PC)

  As part of the procedure to erradicate the BRAIN virus from the
academic community at Old Dominon, we are requiring that all students
have their diskettes scanned before using our labes.  During one of
these scans - the OHIO virus was discovered on a student's disk.  I am
presuming that the OHIO virus is similar to the BRAIN virus but ...
any information on the OHIO virus would be appreciated.  Thanks

Michael Kapfer: Old Dominion University:  Norfolk, VA: USA: [phone]

------------------------------

End of VIRUS-L Digest
*********************
Downloaded From P-80 International Information Systems 304-744-2253