The Unsorted BBS Collection

home *** CD-ROM | disk | FTP | other *** search

/ The Unsorted BBS Collection / thegreatunsorted.tar / thegreatunsorted / misc / snr0195.txt < prev next >

Wrap

Text File | 1994-12-29 | 68KB | 1,445 lines

The Scanner - The Anti-Virus Newsletter of Today January 1995 Volume 1 Issue 1 The Scanner is a newsletter compiled by Howard Wood with the help of many people in the Anti-Virus community and Anti-Virus researchers as well as users. The information contained within the newsletter is public domain. Any article or part of an article is free to copy as long as the proper credits go to the author of such article. The Scanner is in no way liable for the accuracy of any or all information it is passing along. The sole responsibility for the data contained in the articles remain with the original author. While accuracy and facts are the paramount goal of The Scanner, it is humanly impossible to verify all information and guarantee its accuracy 100%. The goal of The Scanner is to disseminate as much information to as wide spread a group as possible. Researchers, developers and users alike need various levels of information to deal with the viruses, Trojans and hacks that are encountered daily. The Scanner will *attempt* to pass along viable information for all groups. Any and all constructive criticism and suggestions are welcomed and encouraged. Send all responses to the addresses below. My PGP public key available upon request. You can send any files you suspect of viral infection or know to have viral infections, hacks or suspect files to the same addresses. Please include the name of the program the file was discovered in and your name and address so the alert notices can be a little more accurate than "there is a virus out there!!". Most of all, The Scanner is *your* newsletter. If you have encountered any viruses, Trojans, or hacked programs let us know. We need to all work together to combat the problems out there. Since the last issue there have been some address changes. Any correspondence with either The Scanner staff or Howard Wood can be sent to the following addresses: The Scanner SCNR@aol.com Howard Wood HRRWood@aol.com ============================================================================ CONTENTS Article Author ----------------------------------------------------------------- The New Year .............................. Howard Wood Polymorphic Generators .................... Mikko Hypponen Tech Reports .............................. Bill Lambdin, Bill Hoover Trojan Alert ! ............................ Howard Wood The Bookshelf ............................. Robert Slade Reviews on: "The Internet Business Book" - By Jill H. Ellsworth "Your Internet Consultant" - By Kevin M. Savatz Gold-Bug Companions ....................... Howard Wood In The News ............................... Howard Wood Hacks, Viruses and Trojans ................ Howard Wood Stoned.Empire.Monkey.A Removal ............ Howard Wood Performance of: F-PROT vs Monkey ...................... Mikko Hypponen Integrity Master vs Monkey ............ Wolfgang Stiller The Monkey is on my back !! ............... Howard Wood From Woody's Desk ......................... Howard Wood ============================================================================ The New Year Well, 1995 has started. It is customary in many circles to reflect on the year past and look ahead to the new year present. We can't look back too far but we can certainly look ahead. As I have been reading the Virus-L digest I see the ever increasing problem of the viruses, hacks and Trojans. Basic precautions are needed but seem to be neglected. Promise yourself that the new year will start new habits. Backup your files. Set yourself up with a tool box to help you prevent being in the position where that report that is due tomorrow isn't lost because you can't get to it, or even worse, has been destroyed. Take the few minutes it takes to set up an Integrity program, and a scanner that meets your requirements. LEARN them and talk with others that use the same ones and find out what works for them so you can establish a system of your own. Backup your files Get yourself into a virus conference on one of the many conferences offered out there. Keep you eyes open for warnings of virus infected programs, hacks or Trojans. Backup your files Keep those files you just downloaded in a separate directory where you can uncompress them and scan them before you run them. As sure as I am writing this article, the first time you say " I'm sure this is safe" is when you will get hit. And finally, BACKUP YOUR FILES !!! "The best defense is a good offense" I hope 1995 is a good year for all. Remember, keep those scanners going!! :-) Woody ============================================================================ Polymorphic Generators EDITOR NOTE: Mr. Mikko Hypponen, of Datafellows LTD, was kind enough to allow The Scanner to use articles from his FP-Bulletins in this issue and others to follow. We thank him for his generosity and help in making The Scanner a more professional newsletter. Polymorphic viruses ------------------- The rise of polymorphic viruses can be seen as virus writers' response to the increasing expertise of virus scanners. Since properly built scanners can recognize viruses by their characteristic code, the obvious way to try to beat scanners was to design viruses that change their code, thus rendering recognition with search strings impossible. Polymorphic viruses employ code alteration and encryption to hide themselves from scanners. Their usual tactic is to encrypt the main part of their code with a variable key and leave only the decryption executor unencrypted. The decryption code is altered during every infection to prevent detection with a search string. However, it takes considerable skill to design a polymorphic virus. This kept the number of true polymorphic viruses quite small for a relatively long time. Of course, this couldn't last forever: At some stage, the heavyweights of the virus trade took notice and came to rescue their less skilled brethren by writing and distributing polymorphic generators. Polymorphic generators ---------------------- Polymorphic generators are routines which can be linked to existing viruses. The generators are not viruses per se; their purpose is to hide actual viruses under the cloak of polymorphism. The first all-purpose polymorphic generator was the Mutation Engine, or MtE. Published in 1991, capable of billions of different permutations, linkable to any virus, it heralded the age of instant polymorphism. Today, there are 33 different viruses which are known to use the MtE. Other polymorphic generators followed in MtE's wake. The next two appeared late in the year 1992. They were the TridenT Polymorphic Engine (TPE) and NuKE Encryption Device (NED). TPE was written in the Netherlands. In principle it is capable of producing smaller number of different permutations than the MtE. However, it created detection problems for antivirus products because the decryptors it creates are more generic than those produced by MtE. NuKE's generator wasn't quite as advanced, but unlike most other polymorphic generators, it was distributed as readable source code instead of an object module. Other known polymorphic generators are Dark Angel's Multiple Encryptor (DAME), Darwinian Genetic Mutation Engine (DGME), Dark Slayer Mutation Engine (DSME), MutaGen, Guns'n'Roses Polymorphic Engine (GPE) and Dark Slayer Confusion Engine (DSCE). These generators are typically distributed via underground networks, virus exchange BBSs and private areas in the internet. Operating Principles -------------------- Polymorphic generators are code modules which a programmer can incorporate into a program. After this, the program can use the functions the code module contains. This process is called linking. Once a generator is linked to a virus, it becomes an intrinsic part of the said virus. The virus will thereafter carry the engine along while spreading itself. It should be noted that the generator itself does not care in which kind of a program it is linked to. The known polymorphic generators are clearly written to be linked to viruses, but in principle they could be used in other kinds of programs as well. When a virus that employs a polymorphic generator is infecting a program file (or some other object), it requests the generator to create an encrypted copy of the virus code and the generator itself. Besides performing the encryption, the generators also create a decryptor - a routine which is able to undo the encryption applied to the actual virus code. The generators often use relatively simple encryption techniques. However, they do change the encryption key during every execution. This alone makes the detection of such a virus difficult, but encrypted viruses retain one Achilles heel: the decryption routine, which must remain unencrypted if it is to be executable. Thus, the true effectiveness of a polymorphic generator is measured by its ability to mutate the decryption routine. All polymorphic generators need some kind of a randomization routine in order to create different algorithms each time. Some of the generators allow the virus programmer to substitute his own randomization routines instead of the original one. Polymorphic generators are able to create completely different encryption methods and a wide variety of different decryption routines for them. They modify their decryption routines by such means as shifting the commands inside the routine around, adding ineffectual commands in random places and using different processor registers and opcodes. The basic idea is to make the binary image of the decryption routine totally different between different infections. All this makes it impossible to search for the decryption routine with fixed search strings - there is no search string that could always be found in infections made by a polymorphic virus. <Polymorphic-infection.GIF> How does a virus using a polymorphic generator infect a file? 1. A clean file before the infection. We'll call this the victim file. 2. The virus starts the infection process by modifying the victim file's first commands. It replaces them with a command to jump to the end of the file. The original first bytes of the file are stored in the virus's body. 3. Next, the virus calls the polymorphic generator to create an encrypted copy of the virus code and the generator itself. The generator also creates a decryption routine, which is added to the end of the victim file. 4. The encrypted code is added to the end of the victim file. This encrypted section contains three parts: a copy of the actual virus code, the original first bytes of the victim file, and the code of the polymorphic generator. Limitations ----------- When the first polymorphic generators were found, it was feared that there would be a huge rise in the number of polymorphic viruses. However, these generators have not proved as popular as was originally thought - only about one hundred viruses are known to use a generator. One of the reasons for this is that a generator must be linked to the program to be encrypted, and since the operation requires changes to the program itself, some programming experience is necessary. This alone places the generators out of the reach of the run-of-the-mill virus enthusiasts. Unfortunately, the generators usually come with detailed instructions on their use, so that virus aficionados with even limited experience of assembly programming can easily use them. Another limitation is the generators' size. Although the generators are quite small in themselves, they do increase the size of viruses by some amount. This makes it difficult to link them to boot sector viruses, which have limited code space. No generator-masked boot sector viruses have been found. With the exception of V-Sign (a mildly polymorphic boot sector virus), polymorphic capabilities seem to be the privilege of file viruses. Of course, the advantage that viruses get from polymorphic generators is somewhat questionable. If an anti-virus program is able to recognize the presence of a particular generator, it is usually able to detect all viruses masked by it. Detection --------- Despite the cunning nature of polymorphic generators, viruses masked by them can be detected by using proper tools. Antivirus programs often employ algorithmic means to recognize files infected by polymorphically hidden viruses. Another way to find such viruses is to use checksumming. It is also possible to try to solve the encryption and search for the virus underneath the encryption layer. Algorithmic methods ------------------- Algorithmic methods are based on the fact that however much a generator mutates the decryption routine, it must still contain certain programming structures which make the decryption possible. If a program file contains such structures, the antivirus program can say with sufficient certainty that the file is infected by a polymorphically cloaked virus. As polymorphic generators vary a lot, a different algorithm is needed for each generator - and in order to build such algorithm, the generator will have to be studied closely. However, the algorithmic methods have a certain weakness: they are prone to false positives. The program structures employed by polymorphic generators can be very random. This means that similar structures sometimes occur inside legitimate program code. False alarms may crop up especially if data files are also included in the search, because they typically contain data similar to the random 'garbage-code' which the generators produce. It is relatively easy to create an algorithm that will find all infections created with a polymorphic engine, but if the algorithm would also flag a large amount of clean programs as infected, it is useless. Checksumming ------------ Checksums are comparison values calculated from the executables in a system. These values are stored in a database. When a checksum search is made, the checksums are re-calculated and compared with the original values in the database. Since this method detects all changes to a system, the mutability of polymorphically hidden viruses does them no good; a change is a change, and thus detectable. Checksumming has its drawbacks, too: checksummers suspect all changes that happen inside a system, and occasionally give warnings of ordinary programs which alter their own code. Nowadays, checksummers are usually equipped with an exclude-list and a heuristic faculty to prevent this from happening. Although theoretically able to detect all changes to a system, checksummers are vulnerable to stealth viruses. If such a virus is active in a computer's memory, it is able to hide all the changes it has made. When stealth viruses are involved, checksummers base their calculations on false data, and will consequently find everything to be in order. It should be noted that polymorphic viruses which also stealth their presence are very rare, simply because they are technically difficult to create. Decryption-based detection -------------------------- The decryption-based detection of polymorphic viruses work by first reasoning whether the examined object is encrypted. If the object seems to warrant suspicion, generic decryption methods are applied to it, and a string-based search is done to the code found underneath the encryption. This method works against some polymorphic generators with great success, but is difficult to implement for others. What is the best solution? -------------------------- Checksumming is the strongest method against polymorphic viruses - as long as the machine is clean when the checksummer is installed, and the virus is not falsifying the information received by the checksummer. Checksummers will also detect those polymorphic (and normal) viruses that have not yet been analyzed. The algorithm-based detection mechanisms against polymorphic viruses tend to have problems with false alarms, but these can be overcome by designing the detection engine carefully. One advantage of algorithm- based detection is that, once a detection engine is able to detect a certain polymorphic generator, it will probably detect all viruses utilizing it. A decryption-based detection mechanism can only detect those polymorphic viruses that have been analyzed by the creator of the antivirus product, but it is very unlikely to produce false alarms. Furthermore, such a mechanism is also able to detect the exact variant of the virus in question - this is something that most algorithm-based detection methods are unable to do. Thus far found... ----------------- In the following are brief descriptions of the polymorphic generators that have been found to this date. The generators usually come with introductory notes which explain their use, and in which the authors seek to justify themselves, for example by prohibiting the use of their products in viruses, by trying to explain why polymorphic generators are beneficial, necessary and generally morally uplifting, or by giving the by now well-established lecture about free speech and freedom of expression. Since many of the generators' authors are members of well-known virus groups, these disclaimers can be seen as simple hypocrisy. MtE (Mutation Engine) --------------------- Mutation Engine was the first polymorphic generator, written by the Dark Avenger. MtE was put into circulation in 1991. It is the most widespread polymorphic generator, and has been incorporated to 33 different viruses. Though revolutionary in its time, Mutation Engine is currently somewhat outdated. Practically all anti-virus products can detect MtE-hidden viruses. Nevertheless, MtE continues to be a source of inspiration for people aspiring to write polymorphic generators - for example, almost all generators written after MtE mimic the documentation provided with MtE. MtE v0.91's size is 2048 bytes. TPE (TridenT Polymorphic Engine), DGME (Darwinian Genetic Mutation Engine) -------------------------------------------------------------------------- TPE was written in 1992 by Masud Khafir, a Dutch member of the TridenT virus group. Before and after TPE, Masud Khafir has created several advanced viruses. Among them are the first Windows virus, Win_Vir, the Cruncher virus series, and one of the most widespread viruses using MtE, the MtE.Pogue virus. TPE itself is based on the encryption routine of Masud Kafir's Coffeeshop 3 virus, currently known as TPE.1_0.Girafe.A. To date, four versions of TPE have come out. The author has implied that he considers the product finished, and will not write further versions. The later versions of TPE are highly complex, making it one the most advanced polymorphic generators in the world. TPE version 1.1 was technically advanced, but it contained bugs which made it incompatible with some processor types. Versions 1.2 and 1.3 corrected this problem. The last version, 1.4, introduced an improved, highly complex encryption method, which makes TPE-hidden viruses difficult to identify by using decryption-based detection methods. A separate, modified version of TPE has also appeared. It is known as the Darwinian Genetic Mutation Engine (DGME). DGME was published in Mark Ludwig's latest disputed book 'Computer Viruses, Artificial Life and Evolution'. TPE takes up about 1.6 KB. Presently, it is known to be linked to 10 different viruses. NED (NuKE Encryption Device) ---------------------------- NED, the first polymorphic generator from USA, appeared at approximately the same time as TPE. According to the generator's documentation, it was released in October, 1992. Nowhere Man is credited as being the author of this generator, but there have been suspicions that it is actually written by some other programmer. Nowhere Man is the author of NuKE's Virus Creation Laboratory, the VCL. Unlike most other polymorphic generators, NED was distributed as source code. This, of course, makes it easier for other virus creators to modify the generator, but so far only a single version of NED has been found. The generator's documentation expressly forbids its distribution outside NuKE itself, but it has obviously been in wide distribution. NED version 0.90B takes up 1355 bytes. It is known to have been linked to two different viruses. DAME (Dark Angel's Multiple Encryptor) -------------------------------------- Naturally enough, Phalcon/SKISM didn't want to be upstaged by NuKE. In 1993, this virus group, which originates from Canada, joined the fray with Dark Angel's Multiple Encryptor, DAME. The new generator's name may have been meant as a dig at some members of the anti-virus community, who had been using the name DAME for Dark Avenger's Mutation Engine, MtE. Dark Angel published his generator during the summer of 1993 in issue 11 of Phalcon/SKISM's magazine, 40Hex. Dark Angel has also written the two virus creation toolkits published by Phalcon/SKISM, the PS-MPC and G2. Like NED, DAME was distributed as commented source code. Along with the generator, Dark Angel published an article which dealt with polymorphism and the writing of polymorphic generators in general. Dark Angel was apparently not completely satisfied with his initial product, because he introduced an improved version of DAME in the next issue of 40Hex. The first version of DAME, 0.90, took up 1574 bytes. The improved 0.91 version had grown to 1960 bytes. Dame is known to have been linked to two different viruses. DSME (Dark Slayer Mutation Engine) ---------------------------------- DSME was the first polymorphic generator from Taiwan. It was written by a person calling himself Dark Slayer. DSME was published in the end of 1993. Interestingly, DSME contains documentation both in English and Chinese. The author sends greetings to Dark Avenger and Nowhere Man and thanks for the inspiration he received from earlier polymorphic generators. DSME is not as advanced as the generators produced before it. Dark Slayer admits this in his notes. The actual size of the generator is little over 2 kilobytes. At the moment, only one virus is known to use the DSME. MutaGen ------- In the beginning of 1994, a new author entered the stage. Calling himself MnemoniX, this American virus writer proudly presented a new generator called MutaGen. At the moment, there are four different versions of MutaGen in distribution. Each successive version is more complex than the previous ones. Their sizes range from 1032 bytes to 1385 bytes. In MutaGen's documentation, MnemoniX criticizes the other polymorphic generators for being too unreliable and easy to detect. MnemoniX himself has published two different viruses which utilize the MutaGen generator, but otherwise the response of the virus underground to this new generator is unknown. GPE (Guns'n'Roses Polymorphic Engine) ------------------------------------- The Guns'n'Roses Polymorphic Engine is a newcomer, written by a person calling himself Slash Wu. Like the Dark Slayer Mutation Engine, this generator originates from Taiwan - and it only comes with Chinese documentation. In the generator's documentation, the author prohibits the use of the generator in viruses and other malicious software. He claims to have developed GPE solely for the purpose of protecting data and programs from unauthorized use. These claims are lent some credence by the fact that the author has included his apparently real name and phone number in the introductory notes. Version 1.00 of the Guns'n'Roses Polymorphic Engine was released in March 1994. So far, the generator is not known to have been linked to any virus. It's size is about two kilobytes. DSCE (Dark Slayer Confusion Engine) ----------------------------------- There is at least one polymorphic generator which has so far eluded the antivirus researchers. The one that we know of is called DSCE, and it is written by the same author as DSME. A file that demonstrated DSCE's abilities was sent to F-PROT Professional Support during April 1994. Deductions based on this demo indicate that DSCE is a rewritten version of DSME, and capable of creating far more complicated samples. [Source: F-PROT version bulletin 2.14. Copyright (c) 1994 Data Fellows Ltd.] ============================================================================ Tech Sheets Mr. Bill Hoover of Virus Research and Statistics in Indianapolis, Indiana is a new member of The Scanner's contributing authors and researchers. We welcome him aboard and look forward to working with him more in the future. EDITOR'S NOTE: At publication time The Scanner learned that Bill has just recently been hired as a programmer/analyst for a client server based company called Support Net in Indianapolis, Indiana. CONGRATS Bill, and good luck. TRON and HIDER are two viruses Bill has researched. The following are his reports on the two viruses: TRON: ===== The Tron virus was submitted to Virus Research & Statistics on 12.03.94 from a local sysop who runs a board here in Indianapolis, Indiana USA. Seems a user uploaded the infected file compressed with PKLite and F-Prot 2.14 detected it. From taking a quick look at it and testing it on an isolated computer, it seems to be a resident *.COM infector including COMMAND.COM and the infected files increase by 754 bytes. Upon executing an infected program, the virus will go resident and hook interrupts 8 (system timer), 16 (keyboard), 21 (Dos Functions) and 22 (Dos Terminate address) and infect *.COMs when they are executed. Seems to also play around with the keyboard a bit, and adds 1 to the ANSI value of the 6th typed character. For example, 'xxxxxx' becomes 'xxxxxy' and 'aaaaaa' becomes 'aaaaab'. Although F-Prot 2.14 detects it, users can use the scan sig below to detect it since it is present in all infected files (at least the ones I tested) : 0E 1F BE 18 01 46 81 3C 54 52 75 F9 81 7C 02 4F 4E 75 F2 83 C6 04 In addition, (not sure about the trigger yet since I've only looked at it for a couple of secs) but a little graphic ball will appear at the top left of the screen and continue across the screen left to right until it hits the bottom right, erasing the screen contents. I have a feeling that this happens after a the virus has been resident for so long (reason for system timer being hooked) but not exactly sure. In addition, the text 'TRON' can be found within infected programs, and the infected program's name appears in the interrupt chain and as resident in memory. ******** HIDER: ===== Possible Virus Name : Hider / Anston Rant The 'Hider / Anston Rant' virus was submitted to Virus Research & Statistics on 10.08.94 via the Prodigy Service by a user of Prodigy. The virus is a non-resident direct action parasitic infector of *.COM / *.EXE files using a standard method of appending the viral code to the end of the infected program(s) and adding a JMP command to the beginning of the infected *.COM files. The virus seems to use a very effective traversal scheme which will search relentlessly until it infects 3 *.COM and 3 *.EXE files or until no more candidate files are found. Infected files will increase by 1782 bytes with the virus being appended to the end of the infected files and the original file's time and date stamps will not be changed from their original state. Infected files will contain the following message : Anston Rant is back for more! Whoa, looks like you be missing some files there, Bud! The user who submitted a sample of this virus stated that on the 13th day of any month, the virus would 'hide' all files and directories located within the root directory and the files could be safely recovered by using the ATTRIB -H *.* command. However, during my tests, no files or directories were 'hidden' and the virus merely continued to infect non-infected files and displayed the message listed above. Generation 1 samples of the this virus can easily be detected using the following scan sig : BF 03 02 06 1E 06 89 FE 81 EE 00 01 32 E4 B9 CB 06 BB 00 00 In addition, infected *.COM / *.EXE files can be detected by : 06 1E 06 89 FE 81 EE 00 01 32 E4 B9 CB 06 BB 00 00 2E 8A 04 In the current form, this virus does not contain an encryption scheme and will easily be detected by using the above scan sigs added to F-Prot or any other AV product that supports external user defined scan sigs. Tron and Hider / Anston Rant virus tech-specs provided by : Mr. William E. Hoover Virus Research & Statistics 1142 South Reisner Street Indianapolis, Indiana 46221 U.S.A. ******************************** Bill Lambdin is a member of The Scanner staff. The following is his preliminary report on the NYMPHO MITOSIS virus. NYMPHO MITOSIS 2.0 ================== Preliminary analysis of Nympho Mitosis virus by W.H. (Bill) Lambdin Name ] Nympho Mitosis 2.0 Size ] 787 bytes Infects ] .COM and .EXE files including COMMAND.COM. Scan string ] 33 FF 8C C0 48 8E D8 38 3D 75 44 88 1D 83 6D 03 In the wild ] Unknown ] A-V ] This virus has been forwarded to the following; Vesselin ] Bontchev, David M. Chess, Spencer Clark, Eugene V. ] Kaspersky, FRISK, Dr. Alan Solomon, Wolfgang Stiller, ] Frans Veldman, Tarkan Yetiser. Dmitry O. Gryaznov Armored ] no Detected ] Yes Encrypted ] No Interrupts ] Hooks interrupt 21h Load Address] 9FBDh Marker ] The virus places an 8 in the last column of the seconds ] field of the time stamp to mark infected files. When ] Nympho Mitosis disinfects a host file, 02 in placed in ] the seconds field of the time stamp. Polymorphic ] No Resident ] Yes Size in RAM ] 1088 bytes Stealthed ] Fully stealthed, but very unusual, the virus removes ] itself, when an infected file is opened, but does not re- ] infect when the host file is closed. Text ] [Nympho Mitosis] v2.0 Copyright (c) 1993 Memory Lapse ] Phalcon/Skism Canada Type ] Infects .COM & .EXE files, and the virus is appended to ] the end of the infected host files. Unusual ] Does not trap errors. So DOS reports a write protect error ] when trying to run a file from a write protected diskette. ============================================================================ Hacks, Viruses and Trojans A Trojan alert from THE SCANNER !!!! The following message was taken off of the WildNet Virus conference 19 December 1994: ------------------------------------------------------------------------ Date: 12-16-94 Msg # 98 To: ALL Conf: (125) Virus'-WN From: ROBERT KEMPER Stat: Public Subj: WARNING WARNING WARNING Read: Yes ------------------------------------------------------------------------ I discovered a Trojan on the Software Vault Gold Collection CD. Under the utilities section is a supposedly shareware virus scanner that will damage any disk you attempt to scan. The file name is SCCL100.zip DO NOT ATTEMPT TO RUN THIS PROGRAM ! I have notified American Databankers Corp and they have confirmed that this program is designed to damage disks and will be removed from future CD's. Copyright 1994 Robert L. Kemper Jr. --- ■ TNet 3.60 ≈ WILDNET: The Right Note! - MUSIC ORIENTED BBS - 502-452-1453 --------------------------------------------------------------------------- Thanks Robert, great catch!! The staff at The Scanner went into action and went looking. We found this program on 8 CDs total in our area and made the proper notifications to the sysops. Here they are the CDs and the areas the program was found in: CD Title Area ------------------------------------------------------------------------- Shareware Vault Gold Virus Detection and Prevention Shareware Studio #4 Virus Tech Arsenal Anti-Virus Utilities Cream of the Crop II Virus Prevention Hobbes OS/2 MAC File Viewers Best of Bizzness '94 Virus Utilities Best of Shareware '94 MAC File Viewers Night Owl #9 Virus Night Owl 10 Virus EDITOR'S NOTE: Thanks to Jerome Priest - SYSOP of THE Busy Body BBS, W. Branch, MI, we added Night Owl #10 to the list. Thanks Jerome ! The file is 709180 Bytes with a file date of 05-26-93. This program claims to be a *virus scanner*. The program will start out asking you what drive you want to scan. Upon entering a drive letter you are immediately taken to a screen where the alleged scanning is taking place. The unsuspecting victim will observe a Scanning box and a Status box on the screen. As the Scanning box fills ( Showing the percentage of the disk that is scanned ) the status box shows the message : "Scanning Memory ...." Once the Scanning box reaches 100%, the status box then reports "Memory appears to be clean ....". Now the program performs the alleged disk check. The Scanning box once again will display the percentage of the disk being scanned and the status box displays the following message: " Now performing check on disk.... Please Wait ...." Now the fun begins. The Scanning box will go the screens width several times and the then stop. The Status box displays the following message: " Uh Oh....Virus Detected...." Upon hitting the return button this message comes up: " Trying to gain control of vital areas...." After a few seconds the final message comes up as: " Cannot destroy virus !!!!" The system is waiting for a RETURN from the user. The light on the A: drive goes on and the damage is now in progress. After the drive stops, the system is locked up. The system needs to be rebooted again. After rebooting, the unsuspecting user then looks at the disk in the A: drive to see if the "virus" has been removed only to find the disk rendered useless. That, folks, is a TROJAN. A program that claims to do something, but in reality does something else unbeknownst to the user. *************** Editor's Follow-up: I have personally verified each program off of each CD. I am doing more follow-up because the file sizes are not all the same, yet, the same action occurs in each program. The EXE file is the same size in each program 5599 bytes. The SCCL100.DAT file is always 702383 bytes. Prior to doing a scan on a disk the following files are in the directory of the SCCL100 program: SCCL100.DAT 702383 05/26/93 18:57 SCCL100.DOC 1497 05/26/93 19:27 SCCL100.EXE 5599 05/26/93 18:58 After executing the program the following files are added: SCANNER.DAT 140392 <Date program was run> - Woody - ============================================================================ The Bookshelf Rob Slade is busy at work up in British Columbia, Canada, reading book after book after book. He is kind enough to share his views on these "parcels of knowledge" with The Scanner and we appreciate it. "The Internet Business Book", Ellsworth/Ellsworth, 1994, 0-471-05809-0, U$22.95 oakridge@world.std.com je@world.std.com %A Jill H. Ellsworth %A Matthew V. Ellsworth %C 605 Third Avenue, New York, NY 10158-0012 %D 1994 %G 0-471-05809-0 %I John Wiley & Sons, Inc. %O U$22.95 800-CALL-WILEY Fax: 212-850-6799 %O aponnamm@jwiley.com jdemarra@jwiley.com %P 376 %T "The Internet Business Book" This is a reasonable guide to what the Internet is, and how it works. It gives good advice on the best means to approach the net community. The list of resources is aimed at, and appropriate to, business and professional users. The specifics of how to conduct a business on the Internet could use some work. The Internet information provided is concise, and provides a good, if fairly standard, starting point. Those new to the Internet should plan to spend some time practicing the various applications, or might want to look for more detailed guides in areas of interest. The coverage is quite broadly based, though. The email chapter, for example, goes into some detail on the use of UUENCODE to send binary files, an often neglected topic. While the advice to avoid troublesome items such as unsolicited mail and mass advertising mailing is good, there could be much more in the way of specific business advice. The choice of Internet provider only asks whether they provide all the Internet services you require, without analyzing the need for an information provider to set up anonymous ftp, gopher or World Wide Web servers. The chapter on an Internet business plan really only looks at a standard planning tool, with a few line items added for Internet service costs. This work should provide an adequate starting point for those interested in launching a business with support from Internet tools. Those who do should, however, spend some time getting used to the net, before rushing in. copyright Robert M. Slade, 1994 BKINTBUS.RVW 940929 *************** "Your Internet Consultant", Savetz, 1994, 0-672-30520-8, U$25.00/C$34.95 savetz@rahul.net %A Kevin M. Savetz %C 201 West 103rd St., Indianapolis, IN 46290 %D 1994 %G 0-672-30520-8 %I SAMS Publishing %O U$25.00/C$34.95 317-581-3718 fax: 317-581-4669 %O 75141.2102@compuserve.com 75141.2104@compuserve.com %P 550 %T "Your Internet Consultant" The subtitle of this book, "The FAQs of Life Online", refers to a common form of online documentation and reference. A list of "Frequently Asked Questions" list basic and common questions that people have, along with (supposedly) expert answers. FAQs are generally undergoing constant maintenance and updating. They are periodically reposted to specific topical groups and discussion lists, and are often accessible by various other means. Savetz maintains a number of such lists, so it is natural that his Internet guide is written in this style. Question 1.2, in the introduction, in fact, asks whether the world needs another Internet book. He feels that his guide has a distinctive, and that the question and answer style makes a fundamental difference to the work. I'm not sure that the difference is fundamental, but I do think it was a valuable exercise, and produced a worthwhile book. The need to answer the questions keeps sidetracks and diversions to a minimum,. The "frequently" part also helps keep the book focussed on what most people want; the question, however, gives the book some added breadth. I note some questions which I am certainly asked often, and which many Internet guides fail to answer. The questions are all listed at the beginning of the book, forming a type of expanded table of contents. This is less helpful than one might suppose, since one needs to know the area that the question might appear in. Overall, a concise and informative starting guide, well worth consideration. copyright Robert M. Slade, 1994 BKYRINTC.RVW 940930 ============================================================================ DECUS Canada Communications, Desktop, Education and Security group newsletters Editor and/or reviewer ROBERTS@decus.ca, RSlade@sfu.ca, Rob Slade at 1:153/733 Author "Robert Slade's Guide to Computer Viruses" 0-387-94311-0/3-540-94311-0 ============================================================================ EDITORS NOTE: I have recently purchased a copy of Rob's book "Robert Slade's Guide to Computer Viruses" and highly recommend it to anyone wishing to take serious steps in learning the basics of computer viruses and procedures to arm themselves against them. It is well written and quite informative. Hopefully, I will have completed it by the next issue and look forward to giving you the "scoop" in detail. :-) ============================================================================ GOLD-BUG Companions In the last issue of The Scanner we featured the GOLD-BUG virus. In the "gouge" we included in the article, two companion viruses of GOLD-BUG were mentioned. The DA'BOYS virus and the XYZ virus both, accompany the GOLD-BUG virus. All three of these viruses are written by an individual named "Q" the misanthrope. Well, the "Q" library is growing. I guess if we have to have virus writers that turn their creations loose on the world we might as well have one that will at least send the code and the removal instructions as well ! :-) DA'BOYS VIRUS ------------- Virus Name: DA'BOYS Aliases: DALLAS COWBOYS V Status: New, Research Discovery: January, 1994 Symptoms: Possible diskette access problems; BSC; Infected disks fail to boot on 8088 or 8086 processors; No COM4. Origin: USA Eff Length: 251 Bytes Type Code: BORaX - Resident Overwriting Boot Sector and Master Boot Sector Infector Detection Method: None Removal Instructions: DOS SYS General Comments: The DA'BOYS virus will only work with DOS 5 or DOS 6+ with an 80186 or better processor. Unlike other boot sector infectors, the DA'BOYS virus overwrites or rewrites the DOS boot sector. It does not make a copy or move the boot sector to another sector. It will infect all American DOS 5 or DOS 6 boot sectors. It will infect disks in drive A: or B: It works with 360K, 720K, 1.2M, 1.44M or 2.88M disks. When a disk is booted with the DA'BOYS virus, it will load itself into a "hole" in lower DOS memory. CHKDSK will not show a decrease in available memory. INT 12 will not be moved. The DA'BOYS virus code is written in the "Non-System disk or disk error Replace and press any key when ready" string. But it will display the above message by using the code found on the hard disk DOS boot sector. It will then infect the DOS boot sector (not the partition table) of the hard disk and overwrite the "Non-System ... " text string with it's code. The DA'BOYS virus does not damage any data. It disables COM4. The text string "DA'BOYS" appears in the virus code but is not displayed. The DA'BOYS virus has a companion virus that it works with. The GOLD-BUG virus is also a boot sector infector. It is possible to have a diskette with two boot sector viruses. GOLD-BUG hides the presence of the DA'BOYS virus from the Windows 3.1 startup routine. GOLD-BUG removes the DA'BOYS virus from the INT 13 chain at the start of Windows and restores it when Windows ends. It can be removed from diskettes and hard disks with the DOS SYS command. ************* XYZ VIRUS --------- Virus Name: XYZ Aliases: X-AMINE YOUR ZIPPER V Status: New, Research Viron Discovery: September, 1993 Symptoms: None - Pure Stealth Origin: USA Eff Length: 440 Bytes Type Code: OReE - Extended HMA Memory Resident Overwriting .EXE Infector Detection Method: None Removal Instructions: See Below General Comments: The XYZ virus is a HMA memory resident overwriting direct action infector. The virus is a pure 100% stealth virus with no detectable symptoms. No file length increase; overwritten .EXE files execute properly; no interrupts are directly hooked; no change in file date or time; no change in file attributes; no change in available memory; INT 12 is not moved; no cross linked files from CHKDSK; when resident the virus cleans programs on the fly; works with all 80?86 processors; VSAFE.COM does not detect any changes; Thunder Byte's Heuristic virus detection does not detect the virus; Windows 3.1's built in warning about a possible virus does not detect XYZ. The XYZ virus will only load if DOS=HIGH in the CONFIG.SYS file. The first time an infected .EXE file is executed, the virus goes memory resident in the HMA (High Memory Area). The hooking of INT 13 is accomplished using a tunnelling technique, so memory mapping utilities will not map it to the virus in memory. It then reloads the infected .EXE file, cleans it on the fly, then executes it. After the program has been executed, XYZ will attempt to infect 15 .EXE files in the current directory. If the XYZ virus is unable to install in the HMA or clean the infected .EXE on the fly, the virus will reopen the infected .EXE file, remove itself, and then write the cleaned code back to the .EXE file. It then reloads the clean .EXE file and executes it. The virus can not clean itself on the fly if the disk is compressed with DBLSPACE or STACKER, so it will clean the infected .EXE file and write it back. It will also clean itself on an 8086 or 8088 processor. It will infect an .EXE if it is executed, opened for any reason or even copied. When an uninfected .EXE is copied, both the source and destination .EXE file are infected. The XYZ virus overwrites the .EXE header if it meets certain criteria. The .EXE file must be less than 62K. The file does not have an extended .EXE header. The file is not SETVER.EXE. The .EXE header must be all zeros from offset 72 to offset 512; this is where the XYZ virus writes its code. The XYZ virus then changes the .EXE header to a .COM file. Files that are READONLY can also be infected. The text string "XYZ" and "ZYX" appear in the virus code but are not displayed. The XYZ virus has a companion virus that it works with. The GOLD-BUG virus also goes memory resident in the HMA and reserves space for the XYZ virus. To remove the virus from your system, change DOS=HIGH to DOS=LOW in your CONFIG.SYS file. Reboot the system. Then run each .EXE file less than 62k. The virus will remove itself from each .EXE program when it is executed. Or, leave DOS=HIGH in you CONFIG.SYS; execute an infected .EXE file, then use a tape backup unit to copy all your files. The files on the tape have had the virus removed from them. Change DOS=HIGH to DOS=LOW in your CONFIG.SYS file. Reboot the system. Restore from tape all the files back to your system. ============================================================================ In The News If you find any interesting or humorous articles related to computers, hackers, Trojans or even viruses, let us know. China seems to be a topic of interest so far as hackers and hacks go. Death Penalty for a Computer Felony ----------------------------------- Death penalty has been carried out in China on a person who hacked his way into a bank's computer system. In 1991, Shi Bao embezzled 192.000 dollars from the Agricultural Bank of China by using a computer. Shi Bao was executed as a warning to would-be computer criminals. [Source: F-PROT version bulletin 2.09. Copyright (c) 1993 Data Fellows Ltd.] ---------------------------------------------------------------------------- Date: Mon, 05 Dec 94 04:15:39 -0500 From: ANTHONY APPLEYARD <A.APPLEYARD@fs1.mt.umist.ac.uk> Subject: New virus reported in China: `Li Peng' (PC) In 5 Dec 1994 issue of the Daily Telegraph (UK newspaper), p23:- A new virus doing the rounds in China is perplexing the party faithful. When it strikes, a question appears on the screen: "Do you think Li Peng is a good prime minister?". If the operator answers "no", then the message disappears and the system is left untouched. On the answer "yes", however, the virus wipes the entire hard disk. [ Source: Virus-L Digest Volume 7 Issue 100 ] ============================================================================ Hacks, Viruses and Trojans LEGEND: H = Hacked P = Pirated T = Trojan V = Virus Infected X = Hoax * = Previous listing ============================================================================ * File: PKZ305.EXE Problem: H Reported By: Fido Virus_Info Conference. A hacked version of PKzip, and reportedly infected with the Proto-T virus. Fridrik Skulason, Bill Lambdin, Wolfgang Stiller and Tarkan Yetiser analyzed the file and found no virus. This was just a hacked program. - --------------------------------- * File: DOOM2CHE.ZIP Problem: V Reported By: Mike Karina of Biloxi, Ms. The Mississippi Gulf Coast was hit with the Gold-Bug virus mid October. It was uploaded to a local BBS under the name DOOM2CHE.ZIP. The file had 2 files in it. GOLD-BUG.ASM and GOLD-BUG.COM. The .ASM file was the actual source code for the Gold-Bug virus. The .COM file was the virus file itself. - ------------------- * File: SF2_UP.ZIP Problem: V Reported By: Fido WARNING Conference. This is a renewal of the original report in 1992. It appears there are folks out there that didn't get the proper notification from the companies involved. This file can be found on the Night Owl 10.0 CD. It is infected with the Lapse_366 virus. The staff of "The Scanner" found this file and verified the virus is still present. Fridrik Skulason verifies the virus on this file in the FP virus information files. - --------------------------------- * File: SPORT21C.ZIP Problem: V Reported By: Fido WARNING Conference. This is a renewal of the original report in 1992. It appears there are folks out there that didn't get the proper notification from the companies involved. This file can be found on the Night Owl 10.0 CD. It is infected with the Crusader variant of Butterfly. The staff of "The Scanner" found this file and verified the virus is still present. Fridrik Skulason verifies the virus on this file in the FP virus information files. ----------------------------------- File: SCCL100.ZIP Problem: T See Trojan Alert ! above. ============================================================================ STONED.EMPIRE.MONKEY.A Removal This seems to be one of the most active viruses at this time. I am constantly seeing questions about it in the Virus-L Digest and on the various virus conferences. Rather than me trying to explain it, I felt it best the "experts" pass along their summations and techniques in its removal. Mr. Mikko Hypponen of Datafellows LTD, Finland on Stoned Monkey Empire A virus and F-Prot: ( Latest version 2.15) STONED.EMPIRE.MONKEY.A ---------------------- The Monkey virus was first discovered in Edmonton, Canada, in 1991. The virus quickly spread to USA, Australia and UK. Monkey is one of the most common boot sector viruses. As the name indicates, Monkey is a distant relative of Stoned. Its technical properties make it quite a remarkable virus, however. Like Stoned, the virus infects Master Boot Records on hard disks and DOS boot records on diskettes. Monkey spreads only through diskettes. The original Stoned leaves the partition table in its proper place in the hard disk's zero track, but Monkey does not . Instead, it copies the whole Master Boot Record to the hard disk's third sector to make room for its own code. The hard disk is inaccessible if the computer is booted from a diskette, since the operating system cannot find valid partition data in the boot sector - attempts to use the hard disk result in the DOS error message "Invalid drive specification". When the computer is booted from the hard disk, the hard disk can be used normally because the virus is executed first. The virus can, therefore, escape notice, unless the computer is booted from a diskette. As Monkey not only moves but also encrypts the Master Boot Record, it is difficult to remove. The changes to Master Boot Record cannot be detected while the virus is active, since it reroutes the BIOS-level disk calls through its own code. Upon inspection, the hard disk seems to be in its original shape. There are two often-used procedures, either of which can disinfect most boot sector viruses. One of these is the MS-DOS command FDISK /MBR, which rewrites the code in the Master Boot Record, and the other is using a disk editor to restore the Master Boot Record back on the zero track. In this case, the relocation and encryption of the partition table render these methods unusable. Although both procedures destroy the actual virus code, the computer cannot be booted from the hard disk afterwards. There are five viable ways to remove the Monkey virus: o The original Master Boot Record and partition table can be restored from a backup taken before the infection. Such a backup can be made with the MIRROR /PARTN command of MS-DOS 5, for example. o The hard disk can be repartitioned by using the FDISK program, after which the logical disks must be formatted. The procedure will also destroy all data on the hard disk, however. o The command FDISK/MBR can be used to overwrite the virus code, after which the partition table can be restored manually. In this case, the partition values of the hard disk must be calculated and inserted in the partition table by using a disk editor. The method requires expert knowledge on the disk structure. o It is possible to exploit Monkey's stealth capabilities by taking a copy of the zero track while the virus is active. Since the virus hides the changes it has made, this copy will actually contain the original Master Boot Record. This method is not recommendable, because the diskettes used in the copying may well get infected. o The original zero track can be located, decrypted and moved back to its proper place. As a result, the hard disk is restored to its exact original state. F-PROT uses this method to disinfect the Monkey virus. The Monkey virus is quite compatible with different kinds of diskettes. It has a built-in table containing structural data for the most common diskette types. Using this table, the virus is able to move a diskette's original boot record and a part of its own code to a safe area on the diskette. If Monkey does not recognize a diskette, it moves the boot record to the diskette's third physical sector. This is what happens also to, for instance, 2.88 megabyte ED diskettes, with the consequence that Monkey partly overwrites their File Allocation Tables. The virus is difficult to spot, since it does not activate in any way. A one-kilobyte reduction in DOS memory is the only obvious sign of its presence. The memory can be checked with, for instance, DOS's CHKDSK or MEM programs. However, even if MEM reports that the computer has 639 kilobytes of available memory instead of the more common 640, that does not necessarily mean that the computer is infected. In many computers, BIOS allocates one kilobyte of DOS memory for its own use. F-PROT recognizes and removes all known variants of the Stoned.Empire.Monkey virus. ************ Mr. Wolfgang Stiller of Stiller Research, and the Author of Integrity Master, on the Stoned.Empire.Monkey.A virus and Integrity Master: (Latest version 2.31c) Monkey: (Description quoted from Integrity Master User's Guide) Synopsis: Resident, stealth infector of floppy boot sectors and partition sectors Symptoms: Inaccessible hard disk after floppy boot, 1K less available memory Details: Monkey is unusual in that it completely replaces the partition sector with its own code. If you boot from a floppy the hard disk will be inaccessible since there is no valid partition table in the partition sector. If the virus is resident in memory, it will use stealth techniques to return the original unmodified partition sector. Once Integrity Master (AKA IM) is installed, removing Monkey is trivial. It will detect the virus in memory and ask you to boot from a diskette. (The hard disk will of course seem inaccessible at this point but Integrity Master can access it anyway.) After you boot, you just use the "ReLoad" menu to restore the "missing partition sector" (AKA Master Boot Record or MBR). Other products call this the master boot record but we prefer to call it the "partition sector" since it contains the hard disk's partitioning information and to more clearly differentiate from the operating system boot sector (usually a DOS boot sector). What if you get the Monkey virus but you don't have Integrity Master installed already? You could remove Monkey, with an "FDISK /MBR" but then you would lose access to your hard disk. Not a good idea! Removal with Integrity Master is easy. Running IM on your infected PC, you use the Initialize menu to capture your partition sector. IM writes this to part.srl. What IM manages to do at this point is to get you a copy of the uninfected (clean) partition sector (Master Boot Record). You copy this to a diskette (realizing that this diskette is now infected). You now boot from a clean write-protected DOS diskette and run IM from floppy. You can now use the "ReLoad" menu to reload the missing partition sector as before. (You will need to insert the diskette with Part.srl in any one of the floppy drives at the point you do the reload.) Don't forget to disinfect all your diskettes. The best way to do this is to scan your diskettes (use the scan Multiple diskettes menu option in IM for this or the command IMSCAM a: where "a" is your drive letter.) If the diskette is infected, copy all data to another diskette and trash or reformat the diskette. It's not safe to just remove the infected boot sector since Monkey will damage the file structure on the diskette causing possible data loss, if the diskette is not reformatted. -Wolfgang ============================================================================ The Monkey is on my back !! After reading Wolfgang and Mikko's articles I went and infected Albert ( my working platform :-) ) I started out with an infected floppy. I put it in the drive and turned the system off then back on. I got the typical " Non-Systems disk or disk error Replace and press any key when ready" message. I removed it from the system and continued with the boot-up. Once the system was up I did a CHKDSK. The system reported a total of 654336 total bytes free instead of the usual 655360. MONKEY-A was there. That is how easy it is to infect the system. No whistles, whiz bangs or gala,just Non-system disk.... I ran F-Prot first. Clean boot the system ( turn the system off and put the disk in the drive then turn it on again. DO NOT USE ALT-CTL-DEL, some viruses can trap this and the infected memory will still be in control). F-Prot will start to come up then all of a sudden this appears in the upper right hand corner of your screen: Invalid drive in search path Bad command or file name Don't panic, wait a few seconds and F-Prot continues. Go to the Scan screen run Scan in the Report/Only mode.You will observe the following on your screen: Scanning MBR of hard disk 1 Master Boot Sector infection: Stoned.Empire.Monkey.A ERROR: No hard disk found Again, don't panic ! Go back to the Scan screen and go to the Action: block. You can enter either Disinfect/Query or Automatic Disinfection or Automatic Delete. Whatever you choose, enter it. Run Scan again with this and you will get rid of the problem in a flash. That's it. The system is ready to go. No pain, no strain. Next, I ran Integrity Master ( version 2.31b ). ( NOTE: Read the instructions * very carefully *. Here is how to set up.) The setup of Integrity Master is crucial to its proper use. I speak from experience. :-) I had some problems at first because I did not set it up properly. Thanks to Wolfgang Stiller and Bill Lambdin assisting me I now have the proper set up. So, let me go over the set up first with you so those of you running Integrity Master have a proper set up. 1. Format a floppy disk and use the FORMAT/S ( or SYS A: to transfer the system files to it. Substitute the proper drive label if A: is not your boot floppy). Make a directory called IM_HOME. Put it aside for the moment. 2. Install Integrity Master on your hard drive. Do the entire system setup within Integrity Master. Now, put that new floppy you just formatted and made bootable into the drive. Copy IM*.* to that drive. Go into the IM_HOME directory on the HD and copy all .SRL files to A:\IM_HOME. Now you are ready for any situation that arises. Be sure to copy any new additions you make to the hard drive to the "emergency disk" I booted the system up with an infected disk containing Stoned.Empire.Monkey.B this time. I ran IM from the hard drive first. The system stopped and informed me that the virus was there and that I should perform a clean boot. Again, turn the system off and put the bootable, write protected disk with IM in the drive and turn the system on. Run IM. At this point you will get a screen asking you if you want to initialize the system. You can hit any key at this point and it will get you into the menu. Go to ReLoad. Curser down to the Missing partition ( NOT the Partition sector !!). Hit enter at this point. You will see two screens come up. The one on the left explains everything on the screen on the right. Go to the Physical hard disk number (0 to 9). Hit enter. Go to the Physical Drive option and hit 0. ( Viruses only infect Drive zero, so no matter how many you have hit zero ) At this point you will be warned that you are about to over write your partition sector with the version saved in file: A:\IM_HOME\PART.SRL. This is what we want to do. Enter Yes. You will get an error report saying there is an error on C:\IM_HOME. This is alright. Remember, the virus tried to tell you there was no Hard drive, but IM got through it and fixed the missing partition. ( NOTE: If you turn off the Report FIle you wont even see this error ) Turn the system off and then back on and you should be ready to go. Do a chkdsk, if you come up with 655360 then that is confirmation you are ready to go about your business. Both of these products will remove both Monkey-A and Monkey-B in the manner described above. My thanks to Bill Lamdin and Wolfgang for coming to my rescue, thanks guys. :-) Woody ============================================================================= From Woody's Desk Well, that's the second issue. What do you think? *Please* let me know. You will notice the Hacks, Viruses and Trojan section is rather scant. I could use some help from folks out there helping me pass the word along. Drop me a line and let me know what you want to see. Next issue, I plan on running a treatise of Mikko Hypponen's on Retroviruses. A brilliant paper on the viruses of today and their aggressive behavior. You won't want to miss it !! My heartfelt thanks to the folks that help make this issue: - Mr. Rob Slade of British Columbia, Canada for his book reviews and his council in matters of the internet and reviewing The Scanner prior to publication. - Mr. Mikko Hypponen of Datafellows LTD, Finland for his contributions of the FP-Bulletins as well as his words of wisdom on the Monkey virus and taking the time to help a guy out. - Mr. Wolfgang Stiller of Stiller Research, Tallahassee, Florida for his contribution in the Monkey virus article and helping when ever asked for some advise and answers. - Mr. Bill Hoover of Virus Research and Statistics, Indianapolis, Indiana, for his contributions and willingness to take the time to research some code and for joining the "gang". - Mr Bill Lambdin, for his council, time and efforts which have been a big part of The Scanner since its conception. Most of all thank you, the readers, for taking the time to read The Scanner and sending me your views and suggestions. Keep them coming we have only just begun. Best to you all from Biloxi, Mississippi Woody