2,000 Greater & Lesser Mysteries

home *** CD-ROM | disk | FTP | other *** search

/ 2,000 Greater & Lesser Mysteries / 2,000 Greater and Lesser Mysteries.iso / computer / virus / mys00479.txt < prev next >

Wrap

Text File | 1994-06-10 | 183.3 KB | 5,239 lines

Msg#: 2473 *Virus Info* 08-19-90 09:46:00 (Read 11 Times) From: PATRICIA HOFFMAN To: KEN DORSHIMER Subj: RE: CRC CHECKING <KD>the deal is that the invading program would have to know how the CRC <KD>your <KD>program uses works. otherwise it would have a (bytes changed!/bytes in <KD>file!) <KD>chance of succeeding, or somewhere in that neighborhood... <KD> Except in the case of Stealth Viruses....CRC checking doesn't work with them. Patti --- msged 1.99S ZTC * Origin: Sir Dep's Dungeon 714-740-1130 Adult Links Network (1:103/158) Msg#: 2474 *Virus Info* 08-19-90 09:50:00 (Read 9 Times) From: PATRICIA HOFFMAN To: SHEA TISDALE Subj: FILE ECHO? <ST>Hey, what happened to connecting my system to the file echo? <ST> <ST>I have sent numerous netmail messages to you since you sent the info <ST>on setting it up and have not had a reply yet. Recheck your netmail, I sent a reply after receiving the message "What is Tick?" indicating that you need to be running Tick in order to be able to participate in the file echo since that is how the files are processed and extra files go with the .zip files that carry the description. Tick is available from most SDS nodes. Patti --- msged 1.99S ZTC * Origin: Sir Dep's Dungeon 714-740-1130 Adult Links Network (1:103/158) Msg#: 2475 *Virus Info* 08-16-90 11:56:00 (Read 8 Times) From: MIKE DURKIN To: WARREN ANDERSON Subj: RE: INTERNET WORM > I am interested in obtaining the list of passwords used by the > Internet worm in the US. I am the administrator of several The list is in the McAfee/Haynes book ("computer viruses, worms...threats to your system") (pgs 89-91)... I'll type it in for you if you can't find the book locally... Mike --- RBBSMail 17.3A * Origin: The TeleSoft RBBS (RBBS 1:143/204) Msg#: 2476 *Virus Info* 08-19-90 14:51:00 (Read 9 Times) From: MIKE DURKIN To: JAMES DICK Subj: REPLY TO MSG# 2473 (RE: CRC CHECKING) > You might want to take a look at McAfee's FSHLD*.ZIP. This is a new > anti-virus program from the creator of SCAN that is designed > specifically for developers. It will build a 'shield' into an > application such that the application _cannot_ be infected and if it > does become infected, will remove that infection after execution but > prior to running. You will find it in the virus scanners area of many Jim... this is a little mis-leading... all programs will become infected but FSHLD will remove it for most viruses.. for viruses like 4096, FSHLD won't remove or even know/announce that the file is infected... When FSHLD can remove a virus, 'after execution but before running' really makes no difference since a resident virus will still go TSR and a direct action virus will still do it's infecting of other programs... But all things considered... I definately agree that FSHLD is a must have... Mike --- RBBSMail 17.3A * Origin: The TeleSoft RBBS (RBBS 1:143/204) Msg#: 2477 *Virus Info* 08-20-90 04:44:00 (Read 8 Times) From: KEN DORSHIMER To: PATRICIA HOFFMAN Subj: RE: SCANV66B RELEASED On 19-Aug-90 with bulging eyes and flailing arms Patricia Hoffman said: <KD>>does this mean i should erase the old scanv66 that i just d/l'd from <KD>>SDN? <KD>>:-( <KD>> PH> Yep, ScanV66 has a bug or two in it involving the validate codes it PH> can add to the end of files. The validate codes were not being PH> calculated correctly in PH> swell. think i'll wait for the next release. ps, you have net-mail waiting. :-) BTW why on earth would anyone take time off from a disneyland vacation to call a bbs? <grin> ...Your attorney is in the mail... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 2478 *Virus Info* 08-20-90 04:46:00 (Read 9 Times) From: KEN DORSHIMER To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 2476 (RE: CRC CHECKING) On 19-Aug-90 with bulging eyes and flailing arms Patricia Hoffman said: <KD>>the deal is that the invading program would have to know how the CRC <KD>>your <KD>>program uses works. otherwise it would have a (bytes changed!/bytes in <KD>>file!) <KD>>chance of succeeding, or somewhere in that neighborhood... <KD>> PH> Except in the case of Stealth Viruses....CRC checking doesn't work PH> with them. PH> i'd have to see that for myself. i think a complex enough algorithm would keep them at bay. the probability factor is just too low for such a stealth scheme to work. ...Your attorney is in the mail... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 2479 *Virus Info* 08-20-90 04:50:00 (Read 9 Times) From: KEN DORSHIMER To: MIKE DURKIN Subj: REPLY TO MSG# 2478 (RE: CRC CHECKING) On 19-Aug-90 with bulging eyes and flailing arms Mike Durkin said: >> You might want to take a look at McAfee's FSHLD*.ZIP. This is a new >> anti-virus program from the creator of SCAN that is designed >> specifically for developers. It will build a 'shield' into an >> application such that the application _cannot_ be infected and if it >> does become infected, will remove that infection after execution but >> prior to running. You will find it in the virus scanners area of many MD> Jim... this is a little mis-leading... all programs will become MD> infected but FSHLD will remove it for most viruses.. for viruses like MD> 4096, FSHLD won't remove or even know/announce that the file is MD> infected... When FSHLD can remove a virus, 'after execution but before i have some misgivings about this particular protection scheme myself. i don't like embedding someone else's stuff into my executables, partly for licensing reasons. not to knock what is probably a good idea... ...Your attorney is in the mail... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 2653 *Virus Info* 08-20-90 17:09:00 (Read 10 Times) From: TALLEY RAGAN To: MIKE MCCUNE Subj: RE: REMOVING JOSHI In a message to Philip Laird <08-16-90 14:09> Mike Mccune wrote: MM>> Just be sure to boot off a clean diskette to remove the MM>>virus from memory, otherwise the virus will not be removed. MM>> If RMJOSHI is used on an unifected hard drive, it will MM>>destroy the partition table. This next program, RETURN.COM MM>>will restore the partition table. MM>> I will post this program in my next listing...<MM>. Does this mean that RMJOSHI.COM, if run on an uninfected hard drive by it self is a virus? Talley --- ZAFFER v1.01 --- QuickBBS 2.64 [Reg] Qecho ver 2.62 * Origin: Southern Systems *HST DS* Tampa Fl (813)977-7065 (1:377/9) Msg#: 2654 *Virus Info* 08-21-90 09:32:00 (Read 10 Times) From: PATRICK TOULME To: MIKE MCCUNE Subj: RE: HAVE ANYONE TRIED SECURE ? MM> I have tried Secure and have found it to be the only interrupt moniter MM> that will stop all the known viruses. Mike perhaps you should add a caveat to that statement. Secure neither detects, nor does it stop, Virus-101. --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2655 *Virus Info* 08-21-90 12:11:00 (Read 8 Times) From: PAUL FERGUSON To: HERB BROWN Subj: KEYBOARD REMAPPING (AGAIN)... Herb, I stand corrected on that last bit of dialogue....You are correct, indeed.....But, you know what I mean along those lines of getting what you don't expect, whether damaging or not, NO ONE wants the unexpected on thier system.....Touche! -Paul ^@@^........ --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2656 *Virus Info* 08-21-90 22:29:00 (Read 10 Times) From: PATRICIA HOFFMAN To: YASHA KIDA Subj: AKA AND BBS HANDLES YK> What is the rule in this message echo concerning BBS HANDLES? YK> Would like some clarification, I have users expressing interest in YK> using bbs handles in this echo, since they are seeing them used . YK> As you can see I have not allowed this, feeling this echo to be YK> professial in nature. YK> YK> I understand the use of AKA names in this echo maybe needed. YK> YK> Example : YK> After my SITE Manager saw my interest in viruses, I was called in to YK> his office. After explaining my reseach, was to protect not to infect, YK> he relaxed. YK> [Note: the above quote is muchly editted....] Yasha, Aliases are ok in this echo, as long as the Sysop of the system where the messages originate knows who the user is and can contact him if the need arrises. I fully understand the sitation that you describe about your Site Manager...which is a fully valid reason to use an alias here. I used to use the alias of "Merry Hughes" for exactly that reason! Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2657 *Virus Info* 08-21-90 22:32:00 (Read 9 Times) From: PATRICIA HOFFMAN To: KEN DORSHIMER Subj: REPLY TO MSG# 2477 (RE: SCANV66B RELEASED) KD> swell. think i'll wait for the next release. KD> ps, you have net-mail waiting. :-) BTW why on earth would anyone take KD> time KD> off from a disneyland vacation to call a bbs? <grin> <laughing> I was eating dinner or lunch while entering those messages, then we went back to Dizzyland and Knott's. Besides, I had to see what you guys were up to while I was gone.....Mom instinct....what can I say? Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2658 *Virus Info* 08-22-90 18:21:00 (Read 8 Times) From: HERB BROWN To: PAUL FERGUSON Subj: REPLY TO MSG# 2655 (KEYBOARD REMAPPING (AGAIN)...) With a sharp eye <Aug 21 12:11>, Paul Ferguson (1:204/869) noted: PF>Herb, PF> I stand corrected on that last bit of dialogue....You are PF>correct, indeed.....But, you know what I mean along those lines of PF>getting what you don't expect, whether damaging or not, NO ONE wants PF>the unexpected on thier system.....Touche! PF>-Paul ^@@^........ I knew what you meant. Glad to know you do too. :-) ( No flame intended ) --- QM v1.00 * Origin: Delta Point (1:396/5.11) Msg#: 2659 *Virus Info* 08-22-90 05:37:00 (Read 8 Times) From: KEN DORSHIMER To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 2657 (RE: SCANV66B RELEASED) On 21-Aug-90 with bulging eyes and flailing arms Patricia Hoffman said: KD>> swell. think i'll wait for the next release. KD>> ps, you have net-mail waiting. :-) BTW why on earth would anyone take KD>> time KD>> off from a disneyland vacation to call a bbs? <grin> PH> <laughing> I was eating dinner or lunch while entering those PH> messages, then we went back to Dizzyland and Knott's. Besides, I had PH> to see what you guys were up to while I was gone.....Mom PH> instinct....what can I say? PH> did you go on the roller coaster at Knotts that looks like a corkscrew? my personal favorite after a big dinner. <erp!> in other news there was a report <<unconfirmed>> that there is a hack of lharc floating around called lharc190. might want to keep an eyeball open for it. what am i doing up at this hour? just got thru writting the docs for a program <yawn>. as usual, the program looks better than the docs. have fun, see ya. ...All of my dreams are in COBOL... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 2660 *Virus Info* 08-20-90 15:40:00 (Read 9 Times) From: RON LAUZON To: PAUL FERGUSON Subj: RE: KEYBOARD REMAPPING.... yes, it is possible to re-map the keyboard from a remote system. However, most people are protected by this because the term program rather than ANSI.SYS is handling the ANSI escape sequences. If you are using a "dumb" terminal that has no terminal emulation and allowing ANSI.SYS to handle your screen formatting, you may be in trouble. --- Telegard v2.5i Standard * Origin: The Flight of the Raven (313)-232-7815 (1:2200/107.0) Msg#: 2661 *Virus Info* 08-21-90 20:29:00 (Read 8 Times) From: MARTIN NICHOL To: MICHAEL TUNN Subj: WHAT'S THE SOLUTION? mt said => It seems to me our Virus checking programs will just mt said => get bigger and bigger as more viruses and strains of mt said => the same viruses are discovered. If so (and if their mt said => development is excelerating) then we may find in the mt said => near future that it has become impossiable to deal mt said => with the outbreaks! mt said => Do we do develop new Operating Systems which are far mt said => more secure! Develope different virus scanning programs. Make them more generic where virus signatures/characteristics can be kept in a seperate file and the virus scanner just reads the file and interprets it accordingly. --- * Origin: JoJac BBS - (416) 841-3701. HST Kettleby, ON (1:250/910) Msg#: 2683 *Virus Info* 08-22-90 22:55:00 (Read 8 Times) From: FRED ENNIS To: ALL Subj: VIRUS-486COMP.* FORWARDED BY James Dick of 1:163/118 QUOTE ON I've been informed by "reliable sources" that there's a file floating around called 486COMP.* (select your favourite packing method) which claims to "show you the difference between your machine and a 486". . When run, the program flashes a "too big for memory" message, and aborts. . Then, the next time you boot, you're informed that you have the "Leprosy 1.00" virus which then hangs the machine. . After you manage to boot from a floppy, you find that COMMAND.COM has been altered, although the date, time, and size appear not to have been changed. Just thought you'd like to know. Cheers! Fred --- msged 1.99S ZTC * Origin: Page Six, POINT of order Mr. Speaker (1:163/115.5) Msg#: 2684 *Virus Info* 08-22-90 11:07:00 (Read 8 Times) From: SHEA TISDALE To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 2474 (FILE ECHO?) Thanks Patricia... I am all ready to go now. Just poll your board? --- * Origin: >- c y n o s u r e -< 919-929-5153 <XRS> <HST> (1:151/501) Msg#: 2685 *Virus Info* 08-20-90 21:50:00 (Read 9 Times) From: TOM PREECE To: PAUL FERGUSON Subj: RE: KEYBOARD REMAPPING VIA COMMUNICA I can't help but wonder if Herb was experiencing something that suggested that kind of remapping. Lately I have been experiencing keyboard problems that seem to act like that. When I use my down or left arrow the \ and | symbols toggle. I can correct this when it happens by hitting the left hand shift key - but not the right. And tonight it seems as if I am occaissionaly transposing caps on and off. If either of you hears a virus like this I'd like to know. Q&A tested my memory and keyboard fine. Scanv66 detected nothing. --- TBBS v2.1/NM * Origin: G.A.D.M. Multi-User TBBS Hayward,CA.(415) 581-3019 (1:161/208) Msg#: 2738 *Virus Info* 08-23-90 23:49:00 (Read 7 Times) From: PHILLIP LAIRD To: PATRICIA HOFFMAN Subj: ONTARIO VIRUS Patty, have you heard of such a Virus? I was in the TAG Support Echo and saw a message about a TAG Sysop who contracted that virus. Any Info? Supposedly the Virus is scanned in version SCANV66.ZIP. ???? --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 2739 *Virus Info* 08-22-90 12:55:00 (Read 7 Times) From: PAUL FERGUSON To: EVERYONE Subj: MOM! Patti- Mom, huh?...What can you say?..It seems it has already been said! -Paul <wide grin on this one> --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2740 *Virus Info* 08-23-90 12:06:00 (Read 8 Times) From: PAUL FERGUSON To: TOM PREECE Subj: REMAPPING... Hello, Tom... . More than likely there was nothing like that at all. Keyboard remapping is an extremely complicated process and would take more than forethought on the part of the programmer. What you have seen us talking about here is figurative at best and personally, I would have to see it to believe it. (you know the old saying: "Believe none of what you hear and only half of of what you see."?) Although I do believe that is quite possible under the proper circumstances, it would indeed be a rare occurance. Sometimes when receiving odd characters during telecommunications or not getting the exact same keys that you typed could be attributed to disparity (parity differences), differing data bits, stop bits, or even simply ANSI interpretation problems between Comm Programs. I've seen the smallest, simplest things like that have people pulling their hair out by the roots! . .....Clarke's Third Law Any sufficiently advanced technology is indistinguishable from magic. . . -Paul ^@@^........ --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2741 *Virus Info* 08-17-90 01:51:00 (Read 8 Times) From: YEN-ZON CHAI To: DOUG BAGGETT Subj: ANTI VIRUS VIRUSES DB> well..here is a question..where exactly did viruses originate DB> anyway..was it in this country or others? Probably where hacker exists, virus exists. --- outGATE v2.10 # Origin: SIGnet International GateHost (8:7501/103) * Origin: Network Echogate (1:129/34) Msg#: 2742 *Virus Info* 08-22-90 17:49:00 (Read 8 Times) From: KEVIN HIGGINS To: MIKE MCCUNE Subj: REPLY TO MSG# 2654 (RE: HAVE ANYONE TRIED SECURE ?) I took a look at it, but to be realistic, when you run a BBS, or are continuously updating your files as new releases come out, you could easily get to the point where you spend more time reconfiguring the anti-virus program than you would getting any work done. I find it much more efficient to scan every file for viruses as soon as I get it on my system, then rezip it, if I'm not going to use it... a simple .bat file can be used such that if you want to check multiple files, you can just feed the file names on the command line and let the .bat file take care of unzipping, scanning and rezipping the file. Be best if someone would write a program that would do this, but I haven't found one yet. Kevin --- TAGMAIL v2.40.02 Beta * Origin: The Hornet's Nest BBS (1:128/74) Msg#: 2743 *Virus Info* 08-22-90 21:52:00 (Read 8 Times) From: CY WELCH To: PAUL FERGUSON Subj: REPLY TO MSG# 2660 (KEYBOARD REMAPPING....) In a message to Everyone <16 Aug 90 6:32:00> Paul Ferguson wrote: PF> Isn't it possible to remap some (or any) keyboard functions via PF> communications with some funky ANSI control characters?....I seem to PF> remember mention of this somewhere.....I really can't remember if was PF> in the form of a question, though, or an answer.....It also made PF> mention of PKWares' Safe-ANSI program...Somebody help us out here... I think most of the "FAST" ansi replacements do not have the keyboard remapping so that danger is removed in those cases. --- XRS! 3.40+ * Origin: Former QuickBBS Beta Team Member (99:9402/1.1) (Quick 1:125/122.1) Msg#: 2744 *Virus Info* 08-24-90 15:14:00 (Read 8 Times) From: PATRICIA HOFFMAN To: ALL Subj: VIRUS RESCUE & F-PROT RELEASES The latest version of Fridrik Skulason's F-PROT anti-viral program is now available for download from my system as FPROT112.ZIP. The program can also be file requested as F-PROT, which will always return the latest copy I have available. This program is actually a "suite" of programs for use in preventing and detecting viruses and trojans. The program originates in Iceland, and so updates to it reaching my system for distribution have been rather sporatic. The other new anti-viral program available on my system is Virus Rescue. Virus Rescue is from Tacoma Software, and is a shell for invoking ViruScan, CleanUp, and VCopy from McAfee Associates. Unlike other shell programs I've seen, this one should not require updates every time a new release of Scan comes out. It picks up its virus information from the VIRLIST.TXT file which is packaged with Scan and CleanUp. It will be handy for those who have trouble with the Scan and CleanUp command line switches, or who want the VIRLIST.TXT information converted to english sentences. This is a first public release, so I expect we may see some changes in this product in the future. Virus Rescue can be downloaded from my system as RESQ01.ZIP. Both programs are also file requestable by other systems. File requests should ask for magic file names as follows: F-PROT for the latest copy of F-PROT (currently FPROT112.ZIP) RESCUE for the latest version of Virus Rescue Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2745 *Virus Info* 08-24-90 23:37:00 (Read 9 Times) From: KEN DORSHIMER To: KEVIN HIGGINS Subj: REPLY TO MSG# 2742 (RE: HAVE ANYONE TRIED SECURE ?) On 22-Aug-90 with bulging eyes and flailing arms Kevin Higgins said: KH> I took a look at it, but to be realistic, when you run a BBS, or are KH> continuously updating your files as new releases come out, you could KH> easily get to the point where you spend more time reconfiguring the KH> anti-virus program than you would getting any work done. I find it KH> much more efficient to scan every file for viruses as soon as I get it KH> on my system, then rezip it, if I'm not going to use it... a simple KH> .bat file can be used such that if KH> KH> you want to check multiple files, you can just feed the file names on KH> the command line and let the .bat file take care of unzipping, KH> scanning and rezipping the file. Be best if someone would write a KH> program that would do this, but I haven't found one yet. Kevin KH> sounds like a plan to me. it would actually be fairly simple to write a program to look at all the files in your upload directory, unpack them based on the extension, scan them, then re-compress them (if needed). of course you'd still have to manually put the now scanned files into the proper catagory directories yourself. when do you need it and what's it worth? :-) ...All of my dreams are in COBOL... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 2746 *Virus Info* 08-23-90 15:23:00 (Read 8 Times) From: MIKE MCCUNE To: TALLEY RAGAN Subj: REPLY TO MSG# 2653 (RE: REMOVING JOSHI) No, it just modifies the partition record to remove the virus. If the virus isn't there, it still modifies the partition record. Return.com just reverses the modifications done to the partition table. I will post an improved version of RMJOSHI that scans the partition record for the virus before modifying it...<MM>. --- KramMail v3.15 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0) Msg#: 2747 *Virus Info* 08-23-90 15:26:00 (Read 8 Times) From: MIKE MCCUNE To: PATRICK TOULME Subj: REPLY TO MSG# 2745 (RE: HAVE ANYONE TRIED SECURE ?) Maybe I should say all virus that are in the "public domain". Virus 101 is a research virus that only a few people have (and you wrote). Nothing is fool proof but Secure is better than any other interrupt moniter. --- KramMail v3.15 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0) Msg#: 2748 *Virus Info* 08-23-90 07:01:00 (Read 8 Times) From: YASHA KIDA To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 2656 (AKA AND BBS HANDLES) In a message of <21 Aug 90 22:29:34>, Patricia Hoffman (1:204/869) writes: PH> PH> Yasha, Aliases are ok in this echo, as long as the Sysop of the system PH> where the messages originate knows who the user is and can contact him PH> if the need arrises. I fully understand the sitation that you PH> describe about your Site Manager...which is a fully valid reason to PH> use an alias here. I used to use the alias of "Merry Hughes" for PH> exactly that reason! PH> PH> Patti I understand AKA names like "MERRY", but I speak of HACKER HANDLES. like "LINE RUNNER", "DATA BYTE" etc... I must have misunderstood FIDO ECHO POLICY either way I will drop the subject. Yasha Kida --- msged 1.99S ZTC * Origin: Bragg IDBS, (FT. Bragg, NC - we're gonna kick some booty) (1:151/305) Msg#: 2749 *Virus Info* 08-08-90 23:23:00 (Read 7 Times) From: ALAN DAWSON To: DAVID SMART Subj: RE: VIRUS SCANNERS.... DS> You can't win on this! I've been downloading for quite a while DS> - always running a virus checker on the information. So, where DS> did our virus come from? Off a shrink-wrapped anti-virus DS> diskette one of our guys picked up in the US! Nothing new about this, as people learn all the time. One MAJOR company (really big, really well known) has shipped shrink-wrapped viruses twice -- once on purpose! Shrink wrap doesn't keep the bugs out. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 2750 *Virus Info* 08-08-90 23:31:00 (Read 7 Times) From: ALAN DAWSON To: PATRICIA HOFFMAN Subj: SCAN WEIRDNESS (All answers gratefully received despite the TO: line) Anybody heard of this? I've got a floppy with some viruses on it, among them a SCAN-known Dark Avenger. I SCAN this floppy from the C drive, and the "hey, nothing to worry about there" report comes back. Strange. I SCAN it again. This time 'round, SCAN barfs after 64K of the memory check, telling me Dark Avenger is in memory, power down, load the .45, get the cyanide tablet ready and so on. But DA of course is NOT in memory or active in any way. It is, however, on the floppy, unrun. The above occurred with SCANV64. Out of curiosity, I cranked up SCAN-54 and -- EXACTLY the same result. AST Bravo 286, no TSRs, nothing else loaded, clean (normal) boot just performed. I have a bunch of viruses that I don't expect SCAN to find -- ever. But this kind of thing has never happened to me before. Can anyone match this story, or event? --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 2751 *Virus Info* 08-26-90 00:59:00 (Read 7 Times) From: STEVEN TREIBLE To: KEN DORSHIMER Subj: VOICE NUMBER Ken, I haven't mailed the disk yet as you can see. I'd like to have your voice # so I can talk to instead of sending Net Mail. Thanks, Steve. --- ZMailQ 1.12 (QuickBBS) * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0) Msg#: 2752 *Virus Info* 08-25-90 06:10:00 (Read 8 Times) From: SANDY LOCKE To: HERB BROWN Subj: RE: COMMUNICATION VIRALS PH> However, unless one of the above is occurring, just connecting via PH> telecom to a system won't directly transmit a virus.... PH> HB> Well, that is not exactly what I meant. Sorry for the miscommunicatio HB> should have used an example. I'll have to dig for some old documentat HB> about z-modem when it first came out. I seem to remember it stating t HB> locked the directory that a file was able to go to when being download HB> has something to do with the structure of a .EXE file, or something. HB> to also remember that it was possible to have the .exe "go were it wan HB> as defined by this structure. Thus, having some of the file go to a c HB> part of a drive or memory. It seems wild, but without the docs I read HB> can't give any details. Thought maybe you could shed some light on th Well considering that I am hosting chuck forsberg today ... hes down here for the sco developer forum I will put the question to him directly... but as one of the suggestors for feature addition to the protocol in another personna... ZMODEM will INDEED allow one to transmit a FULL path name... however this is mitigated by the ability on the receiving end to override the transmitted pathname spec... I dont really see a problem here... and when I put the question to chuck I dont see where he will see one either... btw READ the DSZ DOCS and register the product... that will turn on ALL the neat zmodem features... sandy --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2753 *Virus Info* 08-25-90 06:18:00 (Read 15 Times) From: SANDY LOCKE To: SKY RAIDER (Rcvd) Subj: RE: VIRUS ORIGINALS SR> Doug, SR> It is my belief that viruses originated in the early days of computing SR> effort to see what kind of stuff could be done with them, a group of SR> programmers (financed by the US government as I recall) institued a se SR> programs that would attempt to 'beat' others in taking over a computer SR> system. These programs led to a gaming system known as the CORE WARS. SR> today there is an International Core Wars Society. SR> I think it can be easily seen how a program to destroy/circumvent a st SR> operating system can develope into a virus. SR> I tried to double check this information for accuracy, names, dates, e SR> but it seems I have deleted this file. I will try to get further info SR> you, but beleive this info is shrouded in secrecy, and may be hard to SR> relocate. SR> So, the original viruses did come from the US (and even possibly with SR> government help). SR> Ivan Baird SR> * Origin: Northern Connection, Fredericton, N.B. Canada <HST 14.4K> SR> (1:255/3) WHAT a LOAD of UNADULTERATED CRAP... redcode is simply a GAME created by bored programmers... ORIGINAL CORE WARS games were created as far back as 1969 back on the OLD IBM 360 architectures under both OS/MFT and OSMVT OS's... neither had anything to do with so-called secret financing by the US government...BTW I was AROUND and A Systems Programmer during that period... we created our own versions when we heard of the rumours... it was an old system programmers game designed to give Egotistal programmers some lighthearted fun... at this point ALL code ran in real Address space and redcode hadnt even been though of... the MUCH later article by Scientific American in 1979 gave this fun with out harm via the redcode interpreter implemented on early 6502 and 8080 systems... really... I am going to have to move to canada... sounds like there are some really potent and fun drugs in circulation up there... jeese... what a simp... sandy --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2754 *Virus Info* 08-25-90 06:19:00 (Read 14 Times) From: SANDY LOCKE To: STEVE HOKE Subj: REPLY TO MSG# 2752 (RE: COMMUNICATION VIRALS) SH> In a message to Herb Brown <15 Aug 90 17:44:00> Patricia Hoffman wrote PH> The only way a virus could be directly transmitted via a PH> telecommunications link ... PH> is if the particular "service" has a feature where they upgrade PH> their software on your system when you connect. SH> Is there any commercial system that does this? I don't know of one, bu SH> like to know what types of systems to be wary of. SH> Steve just one word for you... PRODIGY avoid it like the plague... sandy --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2755 *Virus Info* 08-25-90 06:25:00 (Read 9 Times) From: SANDY LOCKE To: MIKE MCCUNE Subj: REPLY TO MSG# 2747 (RE: HAVE ANYONE TRIED SECURE ?) MM> I have tried Secure and have found it to be the only interrupt moniter MM> that will stop all the known viruses. It won't stop the boot viruses, MM> obviously (because a boot virus loades before Secure does), but it wil MM> detect them as soon as Secure is loaded. Secure is hard to configure, MM> but once it is configured, it will give few false alarms. With string MM> scanners becoming increasingly easy to defeat, Secure may be the way t MM> go for virus protection...<MM>. well kiddies... a certain couple of anti-viral types on HOMEBASE BBS managed to sting SECURE with modified version of JER-B... one of them continues to find holes with the same tool... SECURE is simply NOT SECURE... sandy --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2756 *Virus Info* 08-25-90 06:31:00 (Read 9 Times) From: SANDY LOCKE To: KEN DORSHIMER Subj: REPLY TO MSG# 2479 (RE: CRC CHECKING) KD> On 19-Aug-90 with bulging eyes and flailing arms Patricia Hoffman sai KD> <KD>>the deal is that the invading program would have to know how the KD> <KD>>your KD> <KD>>program uses works. otherwise it would have a (bytes changed!/by KD> <KD>>file!) KD> <KD>>chance of succeeding, or somewhere in that neighborhood... KD> <KD>> PH> Except in the case of Stealth Viruses....CRC checking doesn't work PH> with them. PH> KD> i'd have to see that for myself. i think a complex enough algorithm wo KD> keep them at bay. the probability factor is just too low for such a st KD> scheme to work. KD> ...Your attorney is in the mail... check out Gilmore Data Systems in LA authors of the OLD FICHECK and XFICHECK... the techniques is called CRC padding after the addition of the viral code the file is padded with a given number of bytes to make the CRC Polynomial come out with the same result... the FCB is then Patched to the original file length leaving nothing for standrad CRC checkers to detect... Childs play really... sandyp.s. in the case of most stealth viruses... the file read code is simply altered to disinfect the file as the CRC checking program reads it... agains simply childs play... --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2757 *Virus Info* 08-25-90 06:32:00 (Read 10 Times) From: SANDY LOCKE To: PATRICK TOULME Subj: REPLY TO MSG# 2755 (RE: HAVE ANYONE TRIED SECURE ?) MM> I have tried Secure and have found it to be the only interrupt moniter MM> that will stop all the known viruses. PT> Mike perhaps you should add a caveat to that statement. Secure PT> neither detects, nor does it stop, Virus-101. Right on Patrick... sandy p.s. Damn nice design on the code complex as HELL.... --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2758 *Virus Info* 08-25-90 06:36:00 (Read 9 Times) From: SANDY LOCKE To: PAUL FERGUSON Subj: REPLY TO MSG# 2740 (RE: REMAPPING...) PF> Hello, Tom... PF> . PF> More than likely there was nothing like that at all. Keyboard PF> remapping is an extremely complicated process and would take more than PF> forethought on the part of the programmer. What you have seen us PF> talking about here is figurative at best and personally, I would have PF> to see it to believe it. (you know the old saying: "Believe none of PF> what you hear and only half of of what you see."?) Although I do PF> believe that is quite possible under the proper circumstances, it woul PF> indeed be a rare occurance. Sometimes when receiving odd characters PF> during telecommunications or not getting the exact same keys that you PF> typed could be attributed to disparity (parity differences), differing PF> data bits, stop bits, or even simply ANSI interpretation problems PF> between Comm Programs. I've seen the smallest, simplest things like PF> that have people pulling their hair out by the roots! PF> . PF> .....Clarke's Third Law PF> Any sufficiently advanced technology is indistinguishable from PF> magic. PF> . PF> . PF> -Paul ^@@^........ well paul normally on hombase you are quite lucid... but as a long time programmer I can testify the keyboard mapping is really quite simple... no real problem and the business of using terminal control code is quite as simple... sandy --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2759 *Virus Info* 08-25-90 06:39:00 (Read 9 Times) From: SANDY LOCKE To: CY WELCH Subj: REPLY TO MSG# 2743 (RE: KEYBOARD REMAPPING....) CW> In a message to Everyone <16 Aug 90 6:32:00> Paul Ferguson wrote: PF> Isn't it possible to remap some (or any) keyboard functions via PF> communications with some funky ANSI control characters?....I seem to PF> remember mention of this somewhere.....I really can't remember if was PF> in the form of a question, though, or an answer.....It also made PF> mention of PKWares' Safe-ANSI program...Somebody help us out here... CW> I think most of the "FAST" ansi replacements do not have the keyboard CW> remapping so that danger is removed in those cases. Well if you are referring to FANSI.SYS by hershey Microsystems it too is vunerable to remap effects... and since it implemnt FULL ANSI 3.64 terminal control codes plus some extensions it is even more vunerable to a whole class of tricks that go way beyond noremally keyboard remapping... but to there credit they ahve include a way to turn this "FEATURE" OFF... just most users get it off a BBS and never order or look at the 50.00 set of docs that come when you pay for the products... sandy --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2760 *Virus Info* 08-25-90 08:49:00 (Read 9 Times) From: PATRICIA HOFFMAN To: PHILLIP LAIRD Subj: REPLY TO MSG# 2738 (ONTARIO VIRUS) PL> Patty, have you heard of such a Virus? I was in the TAG Support Echo PL> and saw PL> a message about a TAG Sysop who contracted that virus. Any Info? PL> Supposedly the Virus is scanned in version SCANV66.ZIP. Yep, I've heard of this one....I was the one that named it after it was submitted by Mike Shields (Sysop of 1:244/114). Ontario is a memory resident generic infector of .COM and .EXE files, including COMMAND.COM. Infected .COM files will increase in length by 512 bytes. Infected .EXE files will increase in length between 512 bytes and 1023 bytes on disk drives with standard 512 byte sectors. When files are infected, the virus adds itself to the end of the program, and then places a jump at the beginning so that the virus's code will always execute before the program that was infected. Ontario is not a low-system memory TSR, it goes memory resident installing itself at the top of free memory, but below the 640K line. Available free memory will decrease by 2,048 bytes. Once the virus has installed itself in memory, any program which is executed will then become infected. It was reported with the sample I received from Mike that infected systems may experience hard disk errors, but I was unable to duplicate that here. This may only happen in severe infections, I try not to let them get that severe when I'm working with a virus :-). Scan V66 and above can detect the Ontario Virus on both .COM and .EXE files. Unfortunately, Ontario is one of the viruses that uses a "double-encryption" technique to prevent scanners from being able to use a search string to detect it, so there isn't a simple way to find it with a hex string and a utility such as Norton Utilities. As of right now, there aren't any disinfectors available for the Ontario virus, so if you happen to be infected with it you need to remove the infected programs and replace them with clean copies from your uninfected backups or original write-protected distribution diskettes. A more complete description of the Ontario virus is in VSUM9008, which was released on August 10. The above is just off of the top of my head, which happens to hurt right now. Hope it is understandable..... Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2761 *Virus Info* 08-25-90 09:02:00 (Read 10 Times) From: PATRICIA HOFFMAN To: YEN-ZON CHAI Subj: REPLY TO MSG# 2741 (ANTI VIRUS VIRUSES) YC> DB> well..here is a question..where exactly did viruses originate YC> DB> anyway..was it in this country or others? YC> YC> Probably where hacker exists, virus exists. YC> Well, the two oldest known viruses for MS-DOS are the Pakistani Brain and VirDem. The Brain is from Pakistan, VirDem from West Germany. Both of these originated in 1986. Both have known authors. The viruses from 1987 include Jerusalem and the Suriv series from Israel, Alameda/Yale from the United States, and 405 from Austria or Germany. Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2762 *Virus Info* 08-25-90 09:07:00 (Read 10 Times) From: PATRICIA HOFFMAN To: KEVIN HIGGINS Subj: REPLY TO MSG# 2757 (RE: HAVE ANYONE TRIED SECURE ?) KH> I took a look at it, but to be realistic, when you run a BBS, or KH> are continuously updating your files as new releases come out, you KH> could easily get to the point where you spend more time reconfiguring KH> the anti-virus program than you would getting any work done. I find it KH> much more efficient to scan every file for viruses as soon as I get it KH> on my system, then rezip it, if I'm not going to use it... a simple KH> .bat file can be used such that if you want to check multiple files, KH> you can just feed the file names on the command line and let the .bat KH> file take care of unzipping, scanning and rezipping the file. KH> Be best if someone would write a program that would do this, but I KH> haven't found one yet. You might want to take a look at CheckOut and Shez. CheckOut uses ViruScan to check .ARC, .PAK, .ZIP, .LZH, and other archive formats for viruses by automatically creating a temporary directory and unarchiving the file to it. It then invokes Scan to check the executable files. One of its nice features is that it will never invoke a program in that temporary directory, as well as you can have it either delete an infected file or move it to a badfiles directory. It will also find archives which are damaged for you. It can be invoked easily from a .BAT file, such as if you want to run it at midnight against all new uploads. Shez is another program which can be used to scan inside archives. It is interactive, so you need to manually invoke it. After you have selected the archive and listed the contents, hitting ctrl-Z will result in Scan checking the contents. There are other scanning shells which handle archived files, though these are the two that I've used regularly and are the most familiar with. I was also involved in the beta testing of CheckOut with some known to be infected files, and it does function properly in that instance. I've also tested Shez with infected files, and it works well.... Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2763 *Virus Info* 08-24-90 16:53:00 (Read 8 Times) From: PRAKASH JANAKIRAMAN To: ALL Subj: LEPROSY Exactly what is the Leprosy virus supposed to do? I was informed that it had been included in McAfee's latest version of Scan, but, having never used Scan before in my life, and never having encountered a virus, are there "symptoms", shall we say, caused by the Leprosy virus, or for any virus? If there is a textfile explaining what each virus is capable of doing, and how it can be detected, I'd like to get a copy of it, if any of you know where I can get something of that sort. Also, does anyone have the number to McAfee's BBS? I'd like to become a user over there as well. (I remember it being in the 408 area code, but I can't recall the actual number). Anyways, thanks a bunch, all... Prakash --- TBBS v2.1/NM * Origin: G.A.D.M. Multi-User TBBS Hayward,CA.(415) 581-3019 (1:161/208) Msg#: 2896 *Virus Info* 08-26-90 20:55:00 (Read 9 Times) From: HERB BROWN To: SANDY LOCKE Subj: REPLY TO MSG# 2754 (RE: COMMUNICATION VIRALS) With a sharp eye <Aug 25 06:10>, Sandy Locke (1:204/869) noted: SL> Well considering that I am hosting chuck forsberg today ... hes down SL>here for the sco developer forum I will put the question to him SL>directly... but as one of the suggestors for feature addition to the SL>protocol in another personna... ZMODEM will INDEED allow one to SL>transmit a FULL path name... however this is mitigated by the ability I have the understanding that other protocols would do this, not by choice. Without the security on the recieving end, this could be disasterous, to say the least.. I would be happy to hear what you find.. Speaking of registering zmodem, is it still free to sysops? You can asnwer that in net-mail.. :-) --- QM v1.00 * Origin: Delta Point (1:396/5.11) Msg#: 2897 *Virus Info* 08-24-90 13:39:00 (Read 7 Times) From: MIKE MCCUNE To: VESSELIN BONTCHEV Subj: REPLY TO MSG# 2746 (REMOVING JOSHI) In your recent letter to me you wrote to me you suggested that I check for the virus before trying to remove it. Now that I've got a working copy of the Joshi (and don't have to let someone else test RMJOSHI), I rewrote the program to check for the virus first. mov dx,80h mov cx,1h mov bx,200h mov ax,201h int 13h or ah,ah jnz read_error es: cmp w[bx],1feb jnz no_virus mov cx,000ah mov ax,301h int 13h or ah,ah jnz write_error mov cx,9h mov ax,201h int 13h or ah,ah jnz read_error mov cx,1h mov ax,301h int 13h or ah,ah jnz write_error mov ah,9h lea dx,remove_message int 21h int 20h remove_message: db 'Joshi Removed$' no_virus: mov ah,9h lea dx,virus_message int 21h int 20h virus_message: db 'Joshi not found$' read_error: mov ah,9h lea dx,read_message int 21h int 20h read_message: db 'Read Error$' write_error: mov ah,9h lea dx,write_message int 21h int 20h write_message: db 'Write Error$' I wrote it for the shareware A86, but it should assemble under MASM, TASM or WASM with minor modifications. Next I will scan the memory for the virus because the remover won't work while the virus is active in memory....<MM>. --- Opus-CBCS 1.13 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0) Msg#: 2898 *Virus Info* 08-25-90 23:46:00 (Read 6 Times) From: TALLEY RAGAN To: MIKE MCCUNE Subj: REPLY TO MSG# 2897 (RE: REMOVING JOSHI) In a message to Talley Ragan <08-23-90 15:23> Mike Mccune wrote: MM>>No, it just modifies the partition record to remove the virus. MM>>If the virus isn't there, it still modifies the partition MM>>record. Thanks for the information. That clears up the question just fine. Talley --- ZAFFER v1.01 --- QuickBBS 2.64 [Reg] Qecho ver 2.62 * Origin: Southern Systems *HST DS* Tampa Fl (813)977-7065 (1:377/9) Msg#: 2899 *Virus Info* 08-23-90 17:31:00 (Read 6 Times) From: DAVID BURGESS To: MARTIN NICHOL Subj: REPLY TO MSG# 2661 (WHAT'S THE SOLUTION?) In a message to michael tunn <21 Aug 90 20:29:00> Martin Nichol wrote: MN> mt said => It seems to me our Virus checking programs will just MN> mt said => get bigger and bigger as more viruses and strains of MN> mt said => the same viruses are discovered. If so (and if their MN> mt said => development is excelerating) then we may find in the MN> mt said => near future that it has become impossiable to deal MN> mt said => with the outbreaks! MN> mt said => Do we do develop new Operating Systems which are far MN> mt said => more secure! MN> Develope different virus scanning programs. Make them more generic MN> where virus signatures/characteristics can be kept in a seperate MN> file and the virus scanner just reads the MN> file and interprets it accordingly. That opens the door to having the virus scanner or part of the virus scanner to become contaminated. --- [Q] XRS 3.40 * Origin: Eurkea! I've found the secret elephant playground (RAX 1:124/3106.6) Msg#: 2900 *Virus Info* 08-17-90 21:06:00 (Read 6 Times) From: CHRIS BARRETT To: PATRICIA HOFFMAN Subj: RE: VIRUCIDE V1.2 Thanks for the info.. If ya remeber the name could ya tell us it.. I think i'll stick with the ScanV?? and CleanP?? for now then.. Chris.. --- TBBS v2.1/NM * Origin: 1990 MultiLine Perth Western Australia - 09-370-3333 - (690/654) Msg#: 2901 *Virus Info* 08-17-90 06:26:00 (Read 6 Times) From: ZEBEE JOHNSTONE To: ALL Subj: MAC VIRUS Anyone know anything about a mac virus which: Sets the delete flag on any folder with a name which starts with the letter "o" or higher (eg system...) IT doesn't actually delete the folder, the machine will still boot, but the folder is missing from the desktop and the delete flag is set. Weird one hmm? --- * Origin: Lighten up! What man can make, man can break! (3:680/813) Msg#: 2902 *Virus Info* 08-19-90 22:31:00 (Read 6 Times) From: BRENDON THOMPSON To: PATRICIA HOFFMAN Subj: "STONED 2" Patti, I sent you a message the other day about a new variant of "Stoned" that I found in Christchurch, New Zealand. It had reference to some "S & S program for testing anti-virus software" and the phone number 0494 791900 in it. I have since had the time to pull it to bits, and it is only the original "Stoned" virus. The code at the start of the sector is still the same, but some clown has modified the message after location 65H. I'm still pleased to send you a specimen by airmail if you like, but it ain't "Stoned 2". Regards.. ... Doon. --- Via Silver Xpress V2.26 * Origin: TONY'S BBS - Gateway to New Zealand. (3:770/101) Msg#: 2903 *Virus Info* 08-19-90 09:25:00 (Read 6 Times) From: DONALD ANDERSON To: FRIAR NESTOR Subj: RE: LOOKIN' FOR FUN? I always looking for fun --- KramMail v3.15 * Origin: get real (3:621/221.0) Msg#: 2904 *Virus Info* 08-26-90 23:36:00 (Read 7 Times) From: GLENN JORDAN To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 2761 (ANTI VIRUS VIRUSES) PH> The Vacsina Viruses were written in Bulgaria to seek out and destroy PH> certain other viruses, or at least that was their original purpose. In examples of the VACSINA virus I have investigated, I have found the following odd behavior, which I wonder if you have also noted : .COM files of over a certain size are infected at first bite, but .EXE files are different. It takes two Exposures to infect an .EXE file, each of which adds a bit to the file length, but only at the second exposure do you get a live virus, signaled by a short beep. A tiny .EXE will take the first exposure, but never complete on a subsequent exposure to become a live virus. I wonder if in some way this behavior, which I have not seen in any other viruses so far, is in some way related to the original "anti-virus" nature of this beast ? --- XRS 3.30-DV (286) * Origin: Jordan Computer Consulting (RAX 1:151/223.3) Msg#: 2905 *Virus Info* 08-26-90 07:54:00 (Read 6 Times) From: KEN DORSHIMER To: SANDY LOCKE Subj: REPLY TO MSG# 2756 (RE: CRC CHECKING) On 25-Aug-90 with bulging eyes and flailing arms Sandy Locke said: SL> check out Gilmore Data Systems in LA authors of the OLD FICHECK and SL> XFICHECK... the techniques is called CRC padding after the addition of SL> the viral code the file is padded with a given number of bytes to make SL> the CRC Polynomial come out with the same result... the FCB is then SL> Patched to the original file length leaving nothing for standrad CRC SL> checkers to detect... Childs play really... sandyp.s. in the case of SL> most stealth viruses... the file read code is simply altered to SL> disinfect the file as the CRC checking program reads it... agains SL> simply childs play... SL> could you send me this article? i still believe that the virus would have to know your crc algorithm in order to perform this magic. additionally if the file is padded, it's size would increase and would be detected that way. correct? sooo, the person writting the virus would require a copy of your file to disassemble, see how you performed your checks, then create a means to circumvent it. sounds like a lot of trouble to me for very little gain. catch ya on the rebound. ...All of my dreams are in COBOL... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 2906 *Virus Info* 08-26-90 23:58:00 (Read 6 Times) From: KEN DORSHIMER To: STEVEN TREIBLE Subj: REPLY TO MSG# 2751 (RE: VOICE NUMBER) On 26-Aug-90 with bulging eyes and flailing arms Steven Treible said: ST> Ken, I haven't mailed the disk yet as you can see. I'd like to have ST> your voice # so I can talk to instead of sending Net Mail. Thanks, ST> Steve. you got it look for it in a net-mail-o-gram. i'd rather not leave it in the public msg area as everyone would try to call and shoot the breeze. :-) ...All of my dreams are in COBOL... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 2907 *Virus Info* 08-26-90 13:09:00 (Read 6 Times) From: PAUL BENDER To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 2744 (VIRUS RESCUE & F-PROT RELEASES) * Replying to a message originally to All PH> Both programs are also file requestable by other systems. PH> File requests should ask for magic file names as follows: PH> PH> F-PROT for the latest copy of F-PROT (currently PH> FPROT112.ZIP) PH> RESCUE for the latest version of Virus Rescue PH> Would it be possible for you to hatch these out into SDS or arrange for the authors to do so? Paul --- RemoteAccess 0.04a via QEcho 2. * Origin: -=* Rassi's Retreat *=- 10pm to 8am Only! (615) 831-1338 (1:116/37) Msg#: 2908 *Virus Info* 08-26-90 12:44:00 (Read 7 Times) From: PATRICIA HOFFMAN To: ALL Subj: VIRUS_INFO INTRODUCTION & RULES Welcome to the VIRUS_INFO echo. The purpose of this echo is to allow BBS users and sysops to ask questions about computer viruses and to be able to get back up-to-date information. Discussion topics may include, but is not necessarily limited to: - what are viruses - how to prevent getting infected - how to determine if your system is infected - how to clean up an infected system and salvage as much information as possible - reviews and announcements of new anti-viral products and product releases. There was a lot of hysteria in the press over the Columbus Day/ DataCrime/October 12 virus, for example, but little mentioned of how rare the virus is or how to determine if a system is infected with it and how to remove it. This type of information is an example of what this echo is intended to carry. Some messages appearing in this conference may be cross-postings from the Dirty_Dozen echo which is sysop only. Cross-postings may only be done by the originator of the message. For example, several of my messages posted in the Dirty_Dozen echo will be cross-posted here. Messages from the HomeBase/CVIA BBS run by Mr. John McAfee in Santa Clara, CA and/or CVIA bulletins may be posted here by Patricia Hoffman, these are being done with Mr. McAfee's permission. Replies to these messages, as well as netmail received at 1:204/869 for Mr. McAfee, is manually transferred to his system as it is received. Conference rules are very simple..... 1. Discussions of how to write a virus, specific technical discussions of how a virus works, or anything of an illegal nature, are not allowed. This rule is *not* open to debate. 2. Messages with a sexually suggestive nature are not allowed, please keep in mind that minors as well as adults participate in this conference. 3. Discussions of a ethical or retorical nature that lead into a debate are considered off-topic in that they will not ever be resolved and do not help anyone. An example in this category would be a discussion in the area of "Should live viruses or virus disassemblies be made available to the public?". These questions and topics will be allowed until such a point that they start to severely disrupt the echo, or start a flame war. At that point, the moderator will request that the discussion be discontinued. 4. Be courteous to your fellow echo participants, and remember there is no such thing as a dumb question, except for the question that some- one is afraid to ask. Everyone needs to help everyone else understand viruses and why they are a problem. 5. This conference is not to be distributed thru Group-mail or any other mail processor which will obscure the ability to track a message back to an originating system. All messages must have seen-bys and path statements if the BBSs participatings software can generate them. 6. If you have a question or problem of an extremely sensitive nature, consider sending it NetMail to 1:204/869 or 99:9403/2 instead of posting it here. If you are netmailing a file that you think is infected, be sure to send a message in NetMail with it so I know what it is, I'll be sure it gets to someone to get analysed for you. Do not under any circumstances host route a file that you think is infected. Suspect files may also be sent on diskette via US Mail to the following address: Patricia Hoffman 1556 Halford Avenue #127 Santa Clara, CA 95051 7. This conference is available to FidoNet and EggNet systems. The conference echomail tag in FidoNet is VIRUS_INFO, in EggNet the conference is available as E_VIRUS_INFO. 8. This conference is available on the FidoNet Backbone. While you are welcome to freely pass this echo along to other systems, out of region links must be approved by moderator of the echo. Gating the echo into another network or Zone must be approved by the conference moderator. 9. Opinions are welcome in the conference, however the ethics of the behavior of people that write viruses, or name calling, is frowned upon. Likewise, accusations of virus writing are strictly forbidden. Please keep opinions down to a single message, and do not repeatedly post them, as these messages tend to water down the purpose of the conference and degrade the level of information that is being presented. 10. Handling of off-topic messages or messages that violate the conference rules will be done by the moderator. First and second warnings on these messages will be in private Netmail. Please do not respond to the off-topic messages so that the conference doesn't get further off-track. Let the moderator do the moderating. 11. Handles are allowed in this conference, however sysops of boards carrying the conference are expected to be able to determine which of their users entered a message if a problem arises. This in effect means, for example, that Opus systems must not set this echo up to allow anonymous messages. 12. If a matter arises where the moderator needs to contact a participant in the echo, the moderator will contact the system where the message was entered and request that the sysop allow the user netmail access, or call the participant with a request for them to logon to the moderator's system or provide a phone number with the participant's permission. Sysops are not expected to provide their users' phone numbers to the moderator without the user's express permission, their privacy is important. There are times, however, when a phone call or chat can resolve a problem much faster than any other route. This is the only reason for this rule. 12. This echo is not a programming echo for answering questions on how to code programs in assembler. If you want to exchange assembler (or any other program language) techniques, please locate an appropriate programming echo or start your own echo. Patricia M. Hoffman is the moderator of the VIRUS_INFO echo conference. She has previously used the name "Merry Hughes" in moderating this conference, and is the originator of the conference and the original moderator. Patricia Hoffman is also the author of the Virus Information Summary List, and is an independent anti-viral researcher. Please contact the moderator, Patricia Hoffman, at 1:204/869 or 99:9403/2 if you need assistance on setting up an echofeed for this echo to your system. thanks... Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2909 *Virus Info* 08-26-90 15:13:00 (Read 7 Times) From: PATRICIA HOFFMAN To: PRAKASH JANAKIRAMAN Subj: REPLY TO MSG# 2763 (LEPROSY) PJ> Exactly what is the Leprosy virus supposed to do? I was informed that PJ> it had been included in McAfee's latest version of Scan, but, having PJ> never used Scan before in my life, and never having encountered a PJ> virus, are there "symptoms", shall we say, caused by the Leprosy virus, PJ> or for any virus? If there is a textfile explaining what each virus is PJ> capable of doing, and how it can be detected, I'd like to get a copy of PJ> it, if any of you know where I can get something of that sort. The Leprosy virus is a non-resident overwriting virus. It infects .COM and .EXE files, overwriting the first 666 bytes of the file. Symptoms of it include that infected files will not execute properly...instead of what they are supposed to do, they will upon execution, infect other files then display a message and end. A complete description of this virus and all (with the exception of V2P2, V2P6, V2P6 and Stoned II) known MS-DOS viruses as of August 10, 1990 is available in the Virus Information Summary List. Its current version is VSUM9008.ZIP. It is available on my system at 408-244-0813, as well as many other systems, including McAfee's BBS. Check around your area before you make the long distance call, it could save you the phone call cost. PJ> PJ> Also, does anyone have the number to McAfee's BBS? I'd like to become a PJ> user over there as well. (I remember it being in the 408 area code, but PJ> I can't recall the actual number). Anyways, thanks a bunch, all... The number of the HomeBase BBS is 408-988-4004. The 9600 HST number is 408-988-5138. Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 2910 *Virus Info* 08-24-90 23:05:00 (Read 7 Times) From: CY WELCH To: TALLEY RAGAN Subj: REPLY TO MSG# 2898 (REMOVING JOSHI) In a message to Mike Mccune <20 Aug 90 17:09:00> Talley Ragan wrote: >MM>> Just be sure to boot off a clean diskette to remove the >MM>>virus from memory, otherwise the virus will not be removed. >MM>> If RMJOSHI is used on an unifected hard drive, it will >MM>>destroy the partition table. This next program, RETURN.COM >MM>>will restore the partition table. >MM>> I will post this program in my next listing...<MM>. TR> Does this mean that RMJOSHI.COM, if run on an uninfected hard TR> drive by it self is a virus? Actually I think it would fit the description of trojan rather than virus as it doesn't replicate. --- XRS! 3.40+ * Origin: Former QuickBBS Beta Team Member (99:9402/122.1) (Quick 1:125/122.1) Msg#: 2911 *Virus Info* 08-26-90 21:13:00 (Read 6 Times) From: TOM PREECE To: SANDY LOCKE Subj: REPLY TO MSG# 2758 (RE: REMAPPING...) As you may see by looking at my other entry's, I have been loading a cache program that is clearly implementing software to remap my keys to s certain extent. If this is possible as a glitch, its is obviously possible as an attack. Let's hope it never comes to that. --- TBBS v2.1/NM * Origin: G.A.D.M. Multi-User TBBS Hayward,CA.(415) 581-3019 (1:161/208) Msg#: 2993 *Virus Info* 08-27-90 07:54:00 (Read 7 Times) From: JAMES DICK To: KEN DORSHIMER Subj: REPLY TO MSG# 2762 (RE: HAVE ANYONE TRIED SECURE ?) On Fri, 24 Aug, 1990 at the ungodly hour of 23:37, while ducking Broccoli Jello and drinking jolt, Ken Dorshimer wrote to Kevin Higgins, TO WIT... KD > sounds like a plan to me. it would actually be fairly simple to write KD > a KD > program to look at all the files in your upload directory, unpack them KD > based KD > on the extension, scan them, then re-compress them (if needed). of Sounds like CHECKOUT....available here, homebase excaliber! and others as CKOT11.* -={ Jim }=- --- QM v1.00 * Origin: The Clipperist - Home to happy Clippheads in Ottawa, Canada (1:163/118.0) Msg#: 2994 *Virus Info* 08-27-90 19:34:00 (Read 6 Times) From: PHILLIP LAIRD To: ALAN DAWSON Subj: REPLY TO MSG# 2750 (RE: SCAN WEIRDNESS) ** Quoting Alan Dawson to Patricia Hoffman ** >among them a SCAN-known Dark Avenger. I SCAN this floppy from >the C >drive, and the "hey, nothing to worry about there" report comes >back. >Strange. I SCAN it again. This time 'round, SCAN barfs after > >--- Opus-CBCS 1.13 > * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand >(3:608/9.0) ** End of Quote ** Allan, I NEVER SCAN from the C Drive or any hard disk. I always scan from a write protected Floppy Diskette in Drive A. I also have a third system (Yep that's right a third system to do all my scanning from. However, I have never had happen to me what happened to you. I did one time find Scan.EXE infected at my place of employment when I didn't write protect the floppy and scanned the b drive, PLEASE write protect the floppy or SCAN.EXE on the hard drive... --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 2995 *Virus Info* 08-27-90 19:50:00 (Read 10 Times) From: PHILLIP LAIRD To: SANDY LOCKE Subj: REPLY TO MSG# 2753 (RE: VIRUS ORIGINALS) Sandy, maybe this might help. I have read an excellent book on the Subject of Origins of Viruses, but let me quote you guys first... ** Quoting Sandy Locke to Sky Raider ** >SR> effort to see what kind of stuff could be done with them, >a group of >SR> programmers (financed by the US government as I recall) >institued a se >SR> programs that would attempt to 'beat' others in taking >over a computer >SR> system. These programs led to a gaming system known as >the CORE WARS. >SR> today there is an International Core Wars Society. > >SR> I think it can be easily seen how a program to destroy/circumvent >a st >SR> operating system can develope into a virus. > >SR> I tried to double check this information for accuracy, >names, dates, e >SR> but it seems I have deleted this file. I will try to get >further info >SR> you, but beleive this info is shrouded in secrecy, and >may be hard to >SR> relocate. > >SR> So, the original viruses did come from the US (and even >possibly with >SR> government help). > >SR> Ivan Baird >SR> * Origin: Northern Connection, Fredericton, N.B. Canada ><HST 14.4K> >SR> (1:255/3) >WHAT a LOAD of UNADULTERATED CRAP... redcode is simply a GAME >created by >bored programmers... ORIGINAL CORE WARS games were created >as far back >as 1969 back on the OLD IBM 360 architectures under both OS/MFT >and >OSMVT OS's... neither had anything to do with so-called secret >financing by the US government...BTW I was AROUND and A Systems >Programmer during that period... we created our own versions >when we >heard of the rumours... it was an old system programmers game >designed >to give Egotistal programmers some lighthearted fun... at this >point >ALL code ran in real Address space and redcode hadnt even been >though >of... the MUCH later article by Scientific American in 1979 >gave this >fun with out harm via the redcode interpreter implemented on >early 6502 >and 8080 systems... really... I am going to have to move to >canada... >sounds like there are some really potent and fun drugs in circulation >up there... jeese... what a simp... > sandy > > >--- QM v1.00 > * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 >(1:204/869.0) ** End of Quote ** O.K. The above message is what I am quoting to you.... If you get a chance, you can pick this book up at Wladen Software at the following locations in California and maybe other bookstores near you can order the book, too: Viruses, A High Tech Disease By Ralph Burger Published by Abacus ISBN 1557550433 Retails at 18.95 US Can be picked up at the following Walden Software Stores: Doly City, Ca (415) 756-2430 San Leandro, Ca (415) 481-8884 It starts from way back when... Phillip Laird --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 2996 *Virus Info* 08-27-90 19:58:00 (Read 7 Times) From: PHILLIP LAIRD To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 2760 (RE: ONTARIO VIRUS) ** Quoting Patricia Hoffman to Phillip Laird ** >after it was submitted by Mike Shields (Sysop of 1:244/114). > Ontario is a memory resident generic infector of .COM and >.EXE files, including COMMAND.COM. Infected .COM files will >increase in length by 512 bytes. Infected .EXE files will >A more complete description of the Ontario virus is in VSUM9008, >which was released on August 10. The above is just off of >the top of my head, which happens to hurt right now. Hope >it is understandable..... > >Patti > > >--- QM v1.00 > * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 >(1:204/869.0) ** End of Quote ** Yea, I think Mike was the one the message came from I read about. He Was instrumental in helping us with another problem he found, too. I am sure that he is on the up and up about the hard disk problems. Nope, I don't have the Ontario Virus that I know of! I read about the Virus after I had posted to you, Thanx for the info. Nice to know where it loads in Mem, that would make a util easier to write once I had a fix on what you have already told me. I will see if I can locate that message from Mike about the Virus originally and let you read it... --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 3029 *Virus Info* 08-26-90 14:01:00 (Read 7 Times) From: RICK WILSON To: SANDY LOCKE Subj: RE: CORE WARS yep core wars was something that a bunch of people that had access to systems messed with after hours, there was a artical in DDJ a few years ago about a bunch of em out a Berkely of Stanford or something. really weired how these folks that have recently ( within the last 8 to 10 years ) become such experts on micros and mainframes and their history. later... Rick --- Telegard v2.5 Standard * Origin: Telegard BBS (000-000-0000) (1:161/88.0) Msg#: 3030 *Virus Info* 08-26-90 16:45:00 (Read 7 Times) From: JOE MORLAN To: CY WELCH Subj: KEYBOARD REMAPPING. In addition to PKWares's Safe-ANSI, ZANSI does not support keyboard remapping. However, NANSI.SYS does have keyboard remapping. --- Telegard v2.5 Standard * Origin: Telegard BBS (000-000-0000) (1:161/88.0) Msg#: 3070 *Virus Info* 08-30-90 23:11:45 (Read 9 Times) From: SKY RAIDER To: SANDY LOCKE Subj: REPLY TO MSG# 2753 (Re: VIRUS ORIGINALS) Firstly, I did not wish to anger you (although I seem to have done just this), but only sought to answer your question to the best of my abilities (which you seem to doubt). Secondly, I stand by my original assertions that viruses were developed through the original Core Wars gaming system. This has been corroborated by various 'virus gurus' here at the local university. In fact, without prompting, one mentioned Bell Labs. Since, as you state, you are a Systems Programmer - it should be obvious to yourself that a RedCode program could be easily adapted to the microcomputer world. It should also be equally as obvious that these RedCode experiments have laid the groundwork for many of the various virus types infecting micros today (ie. trojans, worms, etc.). Thirdly, I did not state, nor did I mean to imply (as you seem to believe), that these RedCode 'fighter programs' are in fact the viruses we see today - merely that they (RedCode fighters) provided the techniques for the micro viruses. Furthermore, since the RedCode experiments were "old system programmers games designed to give Egoistical programmers some lighthearted fun", and since it is generally accepted that virus writers are in this for the same reasons (the egotistical, not the fun), I find it hard to beleive that you cannot equate the two. If you will note in the extract below, I am not the only person who who beleives the RedCode experiments were the forerunners of the modern viruses (in fact, it may be noted they refer to these as viruses - which, of course, they were); From the Sept./89 issue of Popular Science; Despite all the recent publicity, viruses aren't new. In the 1950's researchers studied programs the called "self-altering automata," says Mike Holm... In the 1960s computer scientists at Bell Laboratories had viruses battling each other in a game called Core Wars. The object was to create a virus small enough to destroy other viruses without being caught.... Also, just for the record, allow me to mention that this is an American publication (apparently there are strange drugs down there too). Again, for the record, allow me to mention that it is fact that Robert Morris, Sr. was a participant in the Core Wars games. Is it a coincidence that his son wrote the Internet Virus, or did his father give him the building blocks to build upon? (With my apologies to the Morris family, but I felt this example might carry some weight with Know-it-all System Programmers). To answer your original question, in a form that you may deem acceptable (ie. no RedCode, no mainframe systems, the US is not the origin - all those naive things), the original micro virus was (at least in the IBM world, I can not be sure this applies to early Apple ][ systems, or even the Pets from Commodore) the "Pakistani Brain", released in Jan. '86. But it must be noted (although I feel you will reject this also (ie. mainframe, US, etc)), in Nov. '83, Fred Cohen, in 8 hours wrote a virus which attached itself to users programs, and proceeded to use this program to gain access to all system rights (in an average time of 30 mins). Also, although I don't have a date (the computer name itself may give some indication of age) - on a UNIVAC 1108, with a secure operating system using the Bell-Lapadula model for OS security, a virus was created that: infected the system in 26 hours, used only legitimate activity with the Bell-Lapadula rules, and the infection took only 250 (approx.) of code (From "Computer Security: Are Viruses the AIDS of the Computing Industry?", by Prof. Wayne Patterson, Chairman, Dept. of Computer Science, University of New Orleans.). I am not interested in a war of words, so I will suggest some reading before you go off half cocked to this reply - "Computer Security; A Global Challenge," J.W. Finch & E.G. Douglas, eds., Elsevier Science Publishers, North-Holland - especially the chapters by Fred Cohen. I have not read this, but will try to when it becomes available to me. Also see the message posted by Phillip Laird. --- TBBS v2.1/NM * Origin: Northern Connection, Fredericton, N.B. Canada <HST 14.4K> (1:255/3) Msg#: 3154 *Virus Info* 08-28-90 06:33:00 (Read 7 Times) From: PATRICIA HOFFMAN To: ALAN DAWSON Subj: REPLY TO MSG# 2994 (SCAN WEIRDNESS) AD> Anybody heard of this? I've got a floppy with some viruses on it, AD> among them a SCAN-known Dark Avenger. I SCAN this floppy from the C AD> drive, and the "hey, nothing to worry about there" report comes back. AD> Strange. I SCAN it again. This time 'round, SCAN barfs after 64K of AD> the memory check, telling me Dark Avenger is in memory, power down, AD> load the .45, get the cyanide tablet ready and so on. AD> But DA of course is NOT in memory or active in any way. It is, AD> however, on the floppy, unrun. AD> The above occurred with SCANV64. Out of curiosity, I cranked up AD> SCAN-54 and -- EXACTLY the same result. AD> AST Bravo 286, no TSRs, nothing else loaded, clean (normal) boot AD> just performed. AD> I have a bunch of viruses that I don't expect SCAN to find -- AD> ever. But this kind of thing has never happened to me before. Can AD> anyone match this story, or event? There are a couple of possibilities here. First, if the virus is on a non-executable file, such as one with a .VOM or .VXE extension, Scan won't find it since it is not one of the file extensions it checks for Dark Avenger. In this case, a subsequent run of Scan may find it in memory anyways since the DOS buffers in memory are not cleaned out between program executions. If this is the case, running Scan with the /A option will find it on any file, regardless of extension. Likewise, if your copy of Dark Avenger has ever had a disinfector run against it, it may have some "dead" Dark Avenger code after the end of file mark, but within the last sector of the program as allocated on disk. In this case, Scan won't find it on disk, but may later find it in memory since the code after the end of file mark was read in with the rest of the last sector of the program to memory. This is what is sometimes referred to as a "ghost virus", it isn't really the virus, just dead remnant code remaining in the slack space in the sector. It can't be executed. Running a disk optimization utility such as Speed Disk from Norton Utilities will get rid of the "ghost virus". They are caused by the way DOS fills out the end of the buffer before it writes it out to disk, doesn't always occur when disinfecting programs, but it sometimes will occur. The other case is if your copy of Dark Avenger does not occur at the correct place in the file. Dark Avenger always adds its code to the End Of Programs. If your copy happens to have it at the beginning of the program, or perhaps imbedded in the middle where it shouldn't be, it may not get found. In this case, your copy doesn't match either of the Dark Avenger's that McAfee has. Hope that helps....those are the only three cases that I've heard of a similar problem to yours. Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3155 *Virus Info* 08-28-90 15:16:00 (Read 5 Times) From: KEN DORSHIMER To: JAMES DICK Subj: REPLY TO MSG# 2993 (RE: HAVE ANYONE TRIED SECURE ?) On 27-Aug-90 with bulging eyes and flailing arms James Dick said: JD> On Fri, 24 Aug, 1990 at the ungodly hour of 23:37, while ducking JD> Broccoli Jello and drinking jolt, Ken Dorshimer wrote to Kevin JD> Higgins, TO WIT... KD >> sounds like a plan to me. it would actually be fairly simple to write KD >> a KD >> program to look at all the files in your upload directory, unpack them KD >> based KD >> on the extension, scan them, then re-compress them (if needed). of JD> Sounds like CHECKOUT....available here, homebase excaliber! and JD> others as CKOT11.* JD> thanks but you might want to tell kevin higgins about that. :-) as for me, hell i'll write the bloody thing myself. just wouldn't be a day without some programming in it. ...All of my dreams are in COBOL... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 3156 *Virus Info* 08-27-90 14:14:00 (Read 5 Times) From: MICHAEL CHOY To: ALL Subj: IN THE MAC WORLD Disinfectant 2.0 was released in July...it has the Disinfectant INIT, which is like SAM only it removes viruses as well as detecting them..it catches the Frankie virusa whoch in an old virus that ran on mac emulators for Atari..I guess nobody has to worry about that...it also has much more info on protecting yourself from virus and such.. --- Telegard v2.5 Standard * Origin: Telegard BBS (000-000-0000) (1:161/88.0) Msg#: 3157 *Virus Info* 08-27-90 20:25:00 (Read 5 Times) From: JOE MORLAN To: ALL Subj: LHARC114? I had heard that and infected version of LHARC was released last year under the name LHARC114. I also heard that because of that, the next release of LHARC was expected to be LHARC200 to avoid confustion with the virus. This week a file appeared on a local board called LHARC114. I left a message to the sysop to check it out and he says it's clean. The docs say that this is version 114b, the latest version. Does anybody know what the deal is or was here? Is LHARC114 safe to use? Is there a virus associated with this program? Thanks. --- Telegard v2.5 Standard * Origin: Telegard BBS (000-000-0000) (1:161/88.0) Msg#: 3158 *Virus Info* 08-28-90 15:01:00 (Read 6 Times) From: KEVIN HIGGINS To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 3155 (RE: HAVE ANYONE TRIED SECURE ?) Thanks for the info on CheckOut. I'd seen the file description usage included in a .bat for for TAG, but never implemented it, or d/l'd the checkout file because on my XT it sometimes takes awhile to dearc. a large .zip file--a real pain for L/D types... Probably be wise to start using something like that, though, since the BBS can do all the checking automatically following uploads.... Guess most users won't mind waiting a minute or so, if it makes their d/l's almost certifiably safe. Kevin --- TAGMAIL v2.40.02 Beta * Origin: The Hornet's Nest BBS (1:128/74) Msg#: 3177 *Virus Info* 08-28-90 18:10:00 (Read 6 Times) From: RICK PERCIVAL To: KEVIN HIGGINS Subj: REPLY TO MSG# 3158 (RE: HAVE ANYONE TRIED SECURE ?) > command line and let the .bat file take care of unzipping, scanning > and rezipping the file. Be best if someone would write a program > that would do this, but I haven't found one yet. > Kevin Hi there, you guys must be behind the times or something but there is a very good program which does exactly what you are looking for. Its called CHECKOUT. The version we are using over here is called CKOT11.ZIP and it is a little pearler!! What it does is, unzips a file, scans it and rezips it, menu driven or command line driven. Try it, you'll love it. --- FD 1.99c * Origin: The Cyclops BBS Auckland NEW ZEALAND (3:772/170) Msg#: 3178 *Virus Info* 08-14-90 09:39:00 (Read 7 Times) From: DAN BRIDGES To: KEN DORSHIMER Subj: RE: CRC? I've been reading, with interest, the messages about a program that provides a demo of circumventing a single CRC generating program. I thought that its name would be common knowledge, but apparently it isn't. You were told the name of the file was MCRCx. May I suggest that you look for it as FICHECKx. The one I got is v5 and has program called PROVECRC which demonstrates the problem. ********************** * FICHECK Ver 5.0 * * MFICHECK Ver 5.0 * ********************** (C)Copyright 1988,1989 Gilmore Systems P.O. Box 3831, Beverly Hills, CA 90212-0831 U.S.A. Voice: (213) 275-8006 Data: (213) 276-5263 Cheers, Dan (no connection with the above firm). --- Maximus-CBCS v1.02 * Origin: Marwick's MadHouse (3:640/820) Msg#: 3179 *Virus Info* 08-18-90 14:19:00 (Read 7 Times) From: YVETTE LIAN To: FRED GOLDFARB Subj: RE: VIRUS GROUPS.... FG> writing viruses". The idea I got was that there are actual FG> "virus groups" similar to the game cracking groups you hear FG> of occasionally, who's sole purposes are to write viruses, FG> not for research's sake, but to infect people. Has anyone FG> else heard of this before? Are there really such groups? FG> Imagine, when a new virus comes out three or four groups FG> claiming to be the writers.. Kinda like terrorist bombings FG> only different. Come to think of it, I remember reading a That'd be right... you would think that if these people were intelligent enough to program something such as a virus they'd probably be better off not wasting their time with it... --- QuickBBS 2.64 (Eval) * Origin: Virus Info .. how to do it and not get it ! (3:640/886) Msg#: 3180 *Virus Info* 08-18-90 14:42:00 (Read 7 Times) From: ROD FEWSTER To: KERRY ROBINSON Subj: RE: VIRUS CHECKERS > In a message of <12 Jun 90 7:31:31>, Patrick Curry (1:133/425) writes: > > Rarely does a MAC get a virus It is an IBM phonomonum ^^^^^^^^^^^^^^^^^^^^^^^ Tell it to an Amiga user !! B-) --- FD 1.99c * Origin: The Edge of Reality .. THE NIGHTMARE BEGINS ! (3:640/886) Msg#: 3181 *Virus Info* 08-30-90 13:01:00 (Read 7 Times) From: BRIAN WENDT To: ALL Subj: NEWSPAPER CLIPPING The following item appeared in a newspaper in Brisbane, Austsralia yesterday. Anyone care to comment? VIRUS ATTACKS STATE'S PERSONAL COMPUTERS A sophisticated computer virus is feared to have infected Queensland Government and home computers. The COMPUTER VIRUS INFORMATION GROUP at the QUEENSLAND UNIVERSITY OF TECHNOLOGY has issued it first major warning to personal computer users about the virus. The virus, initially detected by the Israeli defence force, freezes computers on September 22, the birthday of a character in Tolkien's book, 'Lord of the Rings'. A computer virus is a program designed to attach copies of itself to software and disable a computer system, or destroy files. Acting technologist, MR EMLYN CREEVY said the warning was issued after a State Government public servant gave the virus to the group for investigation. Mr Creevy said somputers infected with the virus - known as FRODO, 4096, or CENTURY - would freeze on September 22 or until the end of the year unless it was removed. He said the group expected to know if the virus had infected computers in Queensland next week after users report the results of searches they were requested to conduct. The group warned all personal computer operators that there was a bug in the FRODO virus which prevented it from displaying a message 'FRODO LIVES' on September 22 and instead caused the computer to 'hang' or freeze. "It is from the FRODO name that the significance of the 22nd September can be identified," they said. "This is the birthday of Frodo Baggins in Tolkien's story. Users are advised to theck for the virus as soon as possible. Mr Creevy said the virus had the ability to avoid detection and spread but was not 'seriously destructive'. He said it could become damaging if an expert could disassemble the virus and change the instructions to wipe the computer's disk. "I'd say there's people working on it somewhere although probably not in Australia," Mr Creevy said. An expert would have created the Frodo virus because it had only one bug while most viruses had more. Mr Creevy said more than 100 viruses were believed to exist worldwide. ENDS Brian Wendt Sysop SUNMAP BBS --- Maximus-CBCS v1.02 * Origin: Sunmap BBS Node 5 (HST/DS) - Brisbane - Australia (3:640/206) Msg#: 3182 *Virus Info* 08-28-90 19:33:00 (Read 7 Times) From: SANDY LOCKE To: PATRICK TOULME Subj: REPLY TO MSG# 3177 (RE: HAVE ANYONE TRIED SECURE ?) MM> Maybe I should say all virus that are in the "public domain". MM> Virus 101 is a research virus that only a few people have (and MM> you wrote). Nothing is fool proof but Secure is better than any MM> other interrupt moniter. PT> PT> I agree with you, Mike. and I have to concur with patrick, out of all the TSR type monitor programs out there , SECURE is indeed the best of the group... BUT PLEASE do NOT depend upon this as your ONLY protection... as on part of a multilayered protection scheme it would be fine... I guess my real problems with it stem from the NAME the Mark wasburn has chosen...it can mislead the neophyte too easily...into thinking that it really is the be-all and end-all of protection...I wouldnt hestitate to recommend it over the socalled commercial products in this class... BUT again NOT as a SOLE protection against viruses... sorry for any confusion my comments may have caused... cheers sandy --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3183 *Virus Info* 08-28-90 19:35:00 (Read 6 Times) From: SANDY LOCKE To: ALAN DAWSON Subj: REPLY TO MSG# 2749 (RE: VIRUS SCANNERS....) DS> You can't win on this! I've been downloading for quite a while DS> - always running a virus checker on the information. So, where DS> did our virus come from? Off a shrink-wrapped anti-virus DS> diskette one of our guys picked up in the US! AD> Nothing new about this, as people learn all the time. One MAJOR AD> company (really big, really well known) has shipped shrink-wrapped AD> viruses twice -- once on purpose! Shrink wrap doesn't keep the bugs AD> out. UH ALAN... you mind sending the NAME of this vendor via private e-mail... accidentally I can understand BUT ON PURPOSE??? what end would this kind of action serve??? cheers sandy --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3184 *Virus Info* 08-28-90 19:44:00 (Read 6 Times) From: SANDY LOCKE To: KEN DORSHIMER Subj: REPLY TO MSG# 2905 (RE: CRC CHECKING) well close... without discussing HOW its done... the file length is altered back to the original length... its not that hard and does point out one of the MAJOR problesm with crc scanners...that is that the critical information that tells the operating system how long the file is can be altered at will... as far as the comments of a virus author disassembling the CRC package its commonly done during product testing to find out ahead of time what algorithms are in use by the product... it really depends on the level of security one wants for ones PC... I really wouldnt put it past a good virus author to specifically target anti-viral programs in this fashion... as far as disassemblies being hard... well I do an average of 5-6 per day with files ranging in size from 2k to 90k(although I will admit that some of the trickier ones do cause head scratching occasionally...) note that i said programs and not specifically viruses... cheers sandy --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3185 *Virus Info* 08-28-90 19:53:00 (Read 6 Times) From: SANDY LOCKE To: TOM PREECE Subj: REPLY TO MSG# 2911 (RE: REMAPPING...) TP> As you may see by looking at my other entry's, I have been loading a c TP> program that is clearly implementing software to remap my keys to s ce TP> extent. If this is possible as a glitch, its is obviously possible as TP> attack. Let's hope it never comes to that. Tom, without adding too much fuel to any fire... certain non-communication programs are susceptible to the ANSI programmable attack... on my end I run no program that implements ANSI3.64 terminal control language without having a way to turn thoses "FEATURES " off... certain programs without mentioning brand names do allow this. if the echo moderator allows I will post a list of good and bad programs in this regard... so that you can all protect yourselves better...(n.b. after being chewed out by the moderator I am constraining my comments carefully...) cheers sandyp.s. these attacks have been common since programmable terminals came into being during the middle 1970's the problem is that when these features were implemented in comm programs the possibility arose that it was possible for malicious individuals to finally do some real damage...the way to protect yourself is to STOP using programs that implement such features and switch to others that are more secure in their usage of such features... --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3186 *Virus Info* 08-29-90 05:44:00 (Read 6 Times) From: PATRICIA HOFFMAN To: SANDY LOCKE Subj: REPLY TO MSG# 3185 (RE: REMAPPING...) SL> attack... on my end I run no program that implements ANSI3.64 SL> terminal control language without having a way to turn thoses "FEATURES SL> " off... certain programs without mentioning brand names do allow SL> this. if the echo moderator allows I will post a list of good and bad SL> programs in this regard... so that you can all protect yourselves SL> better...(n.b. after being chewed out by the moderator I am SL> constraining my comments carefully...) Please feel free to go ahead and post the list. Was just trying to keep you out of trouble, you do sometimes get over excited in messages...didn't mean for it to be "chewing out". Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3187 *Virus Info* 08-29-90 06:27:00 (Read 7 Times) From: PATRICIA HOFFMAN To: PHILLIP LAIRD Subj: REPLY TO MSG# 2996 (RE: ONTARIO VIRUS) PL> Nope, I don't have the Ontario Virus that I know of! I read about the PL> Virus after I had posted to you, Thanx for the info. Nice to know PL> where it loads in Mem, that would make a util easier to write once I PL> had a fix on what you have already told me. PL> Ontario loads into the top of free memory, right below the 640K boundary. It takes up 2,048 bytes. If you run chkdsk after it is in memory, both total system memory and free available memory will have decreased by 2,048 bytes. Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3326 *Virus Info* 08-30-90 15:05:00 (Read 6 Times) From: KEN DORSHIMER To: SANDY LOCKE Subj: REPLY TO MSG# 3184 (RE: CRC CHECKING) ...at a time when Western civilization was declining too rapidly for comfort, yet too slowly to be very exciting Sandy Locke was saying: SL> well close... without discussing HOW its done... the file length is SL> altered back to the original length... its not that hard and does SL> point out one of the MAJOR problesm with crc scanners...that is that interesting why don't you drop me some net-mail on this (see origin line) SL> the critical information that tells the operating system how long the SL> file is can be altered at will... as far as the comments of a virus SL> author disassembling the CRC package its commonly done during product SL> testing to find out ahead of time what algorithms are in use by the i think that's one of the things i mentioned; that they would have to have pre-existing knowledge of the crc scheme in order to make that work. SL> product... it really depends on the level of security one wants for SL> ones PC... I really wouldnt put it past a good virus author to SL> specifically target anti-viral programs in this fashion... as far as one of the reasons i am interesting in developing my own anti-viral utils for my software business. i figure if they stay primarily in house, the chance that some bozo will screw around with them and try to break them is reduced. SL> disassemblies being hard... well I do an average of 5-6 per day with SL> files ranging in size from 2k to 90k(although I will admit that some SL> of the trickier ones do cause head scratching occasionally...) note SL> that i said programs and not specifically viruses... cheers sandy heh, yup source to assembled is always easier than the reverse process, of course there's head scratching that goes on at that end too. :-) the client said he wanted it to do what?! ...just part of the food chain... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 3327 *Virus Info* 08-29-90 11:37:00 (Read 6 Times) From: PAUL FERGUSON To: EVERYONE Subj: FLOPPY MBR BACKUP I had originally posted this question to the moderator, but after a little thought decided that I would be sure to receive a myriad of answers from the ECHO participants if asking the question here, also..... It is simply this: Does anyone have any decent (and simple) suggestions for extraction of the floppy MBR???.....There are several very good utilities in the public domain for strictly Hard Drive Boot Sector (ie. ST0) and other utilities contained within, say for instance, PCTools, that can back-up the HARD Drive Partition Table (I forgot to mention several PD programs to back-up the FAT).....But, almost all of these that I have seen pertain to the HDU! I realize that there are ways to write it to a file using certain SPY-type programs, but what I am really interested in is a simplified program that is easy to use at the lowest end of the USER pyramid -Thanks in advance for your suggestions and assistance..... -Paul ^@@^......... --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3328 *Virus Info* 08-29-90 18:46:00 (Read 6 Times) From: PAUL FERGUSON To: EVERYONE Subj: STEALTH FAMILY I have read with great interest the July editions of VIRUS-L digest (along with about the first week or so of August) and cannot, for the life of me, figure the almighty hype with The (noticed that I capitolized that!) Stealth Family of Virus....Only a Trojan should deserve such attentention.....If one takes appropriate precautionary measures, then the virus will (theoretically) be caught in memory.. ...that is, it will make (and reside) a noticeable difference in vectoring.....I truly believe WAY too much hype (Ok, maybe that is a little strong!) has been given to this.....Yes, it can be a true menace if one does not expect such a rogue, but come on.......I downloaded some code today....Yes, I must say it IS quite ingenius, but at the same time, I must also say, I enjoy the work I do, etc.... PS.....Patrick Toulme, Check your E-Mail.... ........"The Delicate Sound of Thunder"....... --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3329 *Virus Info* 08-29-90 22:07:00 (Read 6 Times) From: PAUL FERGUSON To: EVERYONE Subj: LATENITE Ok, so we're up again in the pale moonlite (unquote)... Next question (in paticular, to you, Sandy) is: What diverse opinions do you have concerning those that, also, fight the battle on the front lines (I'm noy alluding to who has any more experience, to wit)...I feel that many of us (Tech Support/Slash/Gov't Contractors)(No, We're not scum, nor unknowledgable) have done much to benefit the Anti-Viral Research Community.....I would like a little input on this topic..... .......We're not all BAD guys!........ --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3330 *Virus Info* 08-31-90 13:05:00 (Read 6 Times) From: HERB BROWN To: ALL Subj: PKZ120.ZIP I was informed that there is a bad version of PKZIP floating around by the name of PKZ120.ZIP.. I am not sure if it is viral or not, but delete it if you find it.. --- QM v1.00 * Origin: Delta Point (1:396/5.11) Msg#: 3331 *Virus Info* 09-01-90 11:34:00 (Read 7 Times) From: DEREK BILLINGSLEY To: ALL Subj: POSSIBLE VIRUS? This just hit me today - I am not sure if it is some kind of system error or a potential virus. Last night (September first) and before gave me no indication of any virus being present on my system. It is now september 1st and now, whenever a file is written to disk (I noticed the text files first, but a downloaded zip'd file was also garbled...) it took out about 10 bytes from the beginning of each line... When I realized this may be set to occur on this date, I set my DATE back a night and everything worked fine... I made a sample text file with a known pattern of characters -- any date past september 1st 1990 leaves the file altered as mentioned above. Any date previous is written unharmed... SCANV56 reports only that the SCAN program is damaged - no disk presence of the source is evident. Has anyone heard of something like this happening? Derek Billingsley --- SLMAIL v1.36M (#0198) * Origin: Atlantic Access SJ/NB 1-506-635-1964 HST You can Run With Us ! (1:255/1) Msg#: 3354 *Virus Info* 08-29-90 09:02:00 (Read 6 Times) From: CY WELCH To: SANDY LOCKE Subj: REPLY TO MSG# 2759 (KEYBOARD REMAPPING....) In a message to Cy Welch <25 Aug 90 6:39:00> Sandy Locke wrote: >CW> In a message to Everyone <16 Aug 90 6:32:00> Paul Ferguson wrote: > PF> Isn't it possible to remap some (or any) keyboard functions via > PF> communications with some funky ANSI control characters?....I seem to > PF> remember mention of this somewhere.....I really can't remember if was > PF> in the form of a question, though, or an answer.....It also made > PF> mention of PKWares' Safe-ANSI program...Somebody help us out here... >CW> I think most of the "FAST" ansi replacements do not have the keyboard >CW> remapping so that danger is removed in those cases. SL> Well if you are referring to FANSI.SYS by hershey Microsystems it too SL> is vunerable to remap effects... and since it implemnt FULL ANSI 3.64 SL> terminal control codes plus some extensions it is even more vunerable SL> to a whole class of tricks that go way beyond noremally keyboard SL> remapping... but to there credit they ahve include a way to turn this SL> "FEATURE" OFF... just most users get it off a BBS and never order or SL> look at the 50.00 set of docs that come when you pay for the SL> products... Actually I was refering to zansi.sys which is a high speed replacement which part of what they did to do it was to remove the keyboard remapping functions. --- XRS! 3.40+ * Origin: Former QuickBBS Beta Team Member (99:9402/122.1) (Quick 1:125/122.1) Msg#: 3355 *Virus Info* 08-26-90 15:45:00 (Read 6 Times) From: MIKE MCCUNE To: SANDY LOCKE Subj: SECURE Sandy, Thanks for the information. I suspected that Secure probably had some holes in its protection scheme and that someone knew about it. I am curious about how the modified Jerusalem-B got around it. I'm pretty sure how Virus 101 does it (the Air Force uses it) but I would like to know if there are any other hole in secure...<MM> --- Opus-CBCS 1.13 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0) Msg#: 3477 *Virus Info* 09-01-90 15:56:00 (Read 6 Times) From: KEN DORSHIMER To: HERB BROWN Subj: REPLY TO MSG# 3330 (RE: PKZ120.ZIP) > > I was informed that there is a bad version of PKZIP floating > around by the name of PKZ120.ZIP.. I am not sure if it > is viral or not, but delete it if you find it.. seem to remember seeing something about this a couple of months ago. mostly, i wanted to drop a line and say "hey". got your net-mail, hopefully if the routing is working right, you got a response. :-) how's new orleans this time of year? later. --- Opus-CBCS 1.12 & NoOrigin 3.7a --- QM v1.00 * Origin: Ion Induced Insomnia (1:203/42.753) Msg#: 3478 *Virus Info* 09-02-90 10:45:00 (Read 6 Times) From: JAMES KLASSEN To: PRAKASH JANAKIRAMAN Subj: REPLY TO MSG# 2909 (LEPROSY) I have a copy of the Leprosy virus along with its source and "documentation". What it does is copies itself to 4 exe or com files each time it is run and produces a memory error code so the user thinks there is a problem with memory and runs it again. After all the com and exe files have been infected, it displays a message that they have a virus and "Good luck!"... It increases file sizes by 666 but when I tested it on a floppy, the bytes didn't increase... --- W2Q v1.4 * Origin: The C.F.I BBS * Norfolk, Va. * (804)423-1338 * (1:275/328) Msg#: 3479 *Virus Info* 09-01-90 07:18:00 (Read 6 Times) From: YASHA KIDA To: PAUL FERGUSON Subj: REPLY TO MSG# 3329 (LATENITE) In a message of <29 Aug 90 22:07:29>, Paul Ferguson (1:204/869) writes: PF> EID:6368 151db0ee PF> Support/Slash/Gov't Contractors)(No, We're not scum, nor PF> unknowledgable) have done much to benefit the Anti-Viral Research PF> Community.....I would like a little input on this topic..... PF> I am a Private contractor for a Large Network installation an support company. I work for the good of the Customer and the population (users). I hear the phrase " SLIMY CONTRACTOR" " M.F.C." everyday. I also heard "Can this be done", "Would you look into this...", "What are your suggestions so I can put them in my report" when things get deep. We are the WHIPPING BOYS and EMERGENCY 911 all in one. I am sure there are Software contractors who have planted or released a virus at contract renewal time. To show how much they are needed. There are also those of us the that want to see their job sites safe from such problems. We are the ones who own our time (Non-Paid) Compile information on ways to safe guard our data from compermise or viral attacks. The Anti-Viral reseach done by Mrs. Hoffman (PAT) and John McAfees group is carefully read and evaluated on my end. I am sure it has saved many a rear from a bear trap. --- msged 1.99S ZTC * Origin: Bragg IDBS, (FT. Bragg, NC - we're gonna kick some booty) (1:151/305) Msg#: 3480 *Virus Info* 09-02-90 19:19:00 (Read 6 Times) From: HERB BROWN To: KEN DORSHIMER Subj: REPLY TO MSG# 3477 (RE: PKZ120.ZIP) With a sharp eye <Sep 01 15:56>, Ken Dorshimer (1:203/42.753) noted: > > I was informed that there is a bad version of PKZIP floating > around by the name of PKZ120.ZIP.. I am not sure if it > is viral or not, but delete it if you find it.. KD> KD>seem to remember seeing something about this a couple of months ago. KD>mostly, i wanted to drop a line and say "hey". got your net-mail, KD>hopefully if the routing is working right, you got a response. :-) KD>how's new orleans this time of year? later. KD> Hmmmm, first time I heard of this file. How long ago did it appear? Rained Sunday and had to BBQ inside. Made watching TV a little hard, but we managed. --- QM v1.00 * Origin: Delta Point (1:396/5.11) Msg#: 3630 *Virus Info* 09-01-90 20:49:00 (Read 6 Times) From: PAUL FERGUSON To: KEN DORSHIMER Subj: REPLY TO MSG# 3326 (RE: CRC CHECKING) Ken... I've GOT to agree with you on this one....only preconceived CRC defeaters are just that...preconceived....no such luck... --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 3813 *Virus Info* 09-01-90 13:11:00 (Read 6 Times) From: KEVIN HIGGINS To: JAMES DICK Subj: SECURING YOUR UPLOADS I've got checkout, and while its a pretty neat program, there are a few things I don't like about it, the main one being the initial memory scan. I also don't like the auto-pause that seems to be at the beginning of it. That means running gateway, which means the user may be able to get into DOS and party. (have heard of Key-fake, but never seen it around to play with it..). TAG calls a file named postul.bat after every upload (if the .bat file is present), so I hacked up this .bat file to auto-check for virii. But I'm not smart enough to know how to use the %%f in a batch file to have it run through for all the files in the active directory (for batch uploads)... Maybe there's a genius out there who can help. FYI the parameters passed to the .bat file are: [Baud] [ComPort] [User#] [U/L Dir] [Filename]. Here it is. Chuckle, then help make it better <grin>. echo off cd\bbs\uploads echo Verifying latest Pkzip version...... > com2 REM This program checks file integrity. ozf -v %5 > com2 echo : > com2 REM These are the directories I don't want checked. if %4 == D:\ZIPSTUFF\WRITERS\ goto end if %4 == D:\ZIPSTUFF\AMIGA goto end echo Testing file integrity, and checking for virii. > com2 echo Please wait..... (this is the scary part, eh?) > com2 echo : > com2 echo Moving the suspect file to a sterile cell for interogation.... > com2 REM This moves the file to an empty directory for the examination. move %4%5 d:\bbs\bads echo File is now undergoing interrogation... > com2 cd\bbs\bads pkunzip -x D:\bbs\bads\%5 *.exe *.com > com2 scan d:\bbs\bads\*.exe /NOMEM > com2 scan d:\bbs\bads\*.com /NOMEM > com2 if errorlevel 1 goto Oops echo Alright! (whew) File passed. > com2 del *.exe del *.com echo Almost finished. Releasing innocent file back into public. > com2 move %5 d:\bbs\uploads echo : > com2 echo Now adding (Nested) zip comment to file... > com2 cd\ REM This adds the Hornet's Nest comment to the .Zip file. call d:\commentr.bat cd\bbs echo Thanks for waiting!.. goto end :Oops echo Arrrrgghhhhh! File had a virus! File deleted! > com2 erase *.* echo Logging your name to Scumbag.lst! > com2 echo Hey, Kato! User number %3 tried to upload a virus infected file! >> d:\fd\scumbag.lst echo Maybe you need to leave a message to Kato, eh? > com2 cd\bbs :end (Note: the fourth line from the end is a continuation of the line above it.) Also, I have a program that will make a .com fil out of a .bat file, for faster processing. Any reason why this couldn't be done with the above .bat file? How about after the %%f is added? Kevin --- TAGMAIL v2.40.02 Beta * Origin: The Hornet's Nest BBS (1:128/74) Msg#: 3814 *Virus Info* 09-03-90 23:40:00 (Read 5 Times) From: RICK THOMA To: HERB BROWN Subj: REPLY TO MSG# 3480 (RE: PKZ120.ZIP) > Hmmmm, first time I heard of this file. How long ago did it > appear? I have a copy, and think it came out around March, or so. At the time, SCANV detected no virus, but I thought better of running it. Sorry, folks. Whatever it is, it isn't available for downloading, so please don't ask. I'm just waiting for the time to pick it apart, to see just what kind of hack it is. --- FD 2.00 * Origin: Village BBS, Mahopac, NY 914-621-2719 *HST* (1:272/1) Msg#: 3815 *Virus Info* 09-03-90 03:38:00 (Read 5 Times) From: KEN DORSHIMER To: PAUL FERGUSON Subj: REPLY TO MSG# 3630 (RE: CRC CHECKING) ...at a time when Western civilization was declining too rapidly for comfort, yet too slowly to be very exciting Paul Ferguson was saying: PF> Ken... I've GOT to agree with you on this one....only preconceived CRC PF> defeaters are just that...preconceived....no such luck... PF> that's what i figured. that is if you're responding to the msg i think you're responding to. what the hell does that mean? ...space is merely a device to keep everything from being in the same spot... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 3816 *Virus Info* 09-03-90 18:03:00 (Read 5 Times) From: KEN DORSHIMER To: HERB BROWN Subj: REPLY TO MSG# 3814 (RE: PKZ120.ZIP) ...at a time when Western civilization was declining too rapidly for comfort, yet too slowly to be very exciting Herb Brown was saying: HB> Hmmmm, first time I heard of this file. How long ago did it appear? HB> Rained Sunday and had to BBQ inside. Made watching TV a little hard, HB> but we managed. i think it was a couple of months ago. which means any mention of it has long since been renumbered off my system. yup BBQing indoors does have a certain mystique. i know dinner is ready when the smoke alarm goes off. ...space is merely a device to keep everything from being in the same spot... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 3817 *Virus Info* 09-03-90 18:08:00 (Read 7 Times) From: KEN DORSHIMER To: DEREK BILLINGSLEY Subj: REPLY TO MSG# 3331 (RE: POSSIBLE VIRUS?) ...at a time when Western civilization was declining too rapidly for comfort, yet too slowly to be very exciting DEREK BILLINGSLEY was saying: DB> This just hit me today - I am not sure if it is some kind of system DB> error or a potential virus. DB> DB> Last night (September first) and before gave me no indication of any DB> virus being present on my system. It is now september 1st and now, DB> whenever a file is written to disk (I noticed the text files first, DB> but a downloaded zip'd file was also garbled...) it took out about 10 DB> bytes from the beginning of each line... DB> could you send a copy of what you believe is infected to me? i'd like to analyse this myself, thanks. my address is: Dorshimer Software Systems P.O. Box 191126 Sacramento, Ca. 95819-1126 USA ...space is merely a device to keep everything from being in the same spot... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 3818 *Virus Info* 09-03-90 20:57:00 (Read 4 Times) From: JOHN HERRBACH To: ALL Subj: PUBLIC KEY ENCRYPTION Does anyone know the status or progress in regards to public key encryption? Thanks. John {|-) --- ME2 * Origin: The Lighthouse BBS/HST; Lansing, MI; 517-321-0788 (1:159/950) Msg#: 3819 *Virus Info* 09-01-90 20:26:00 (Read 5 Times) From: SEAN SOMERS To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 3186 (RE: REMAPPING...) Off topic here, anybody out there encounter the French Revoloution virus? I was the first out here to discover it. What it does is nuke your HD while displaying an anti Western/English speaking Canadians. --- outGATE v2.10 # Origin: SIGnet International GateHost (8:7501/103) * Origin: Network Echogate (1:129/34) Msg#: 3938 *Virus Info* 09-06-90 11:51:00 (Read 13 Times) From: YASHA KIDA To: SKY RAIDER (Rcvd) Subj: REPLY TO MSG# 2995 (RE: VIRUS ORIGINALS) GLAD TO SEE SOMEONE does their homework... Well written.. If you don't mind I wish to post it as a bulletin on my System (BBS).. Re written to as a document instead of a msg reply... ' Yasha sysop 151/305 "What do you do when all of your users are in the sand lands, without a phone." --- Maximus-CBCS v1.00 * Origin: Bragg IDBS, We hunt bugs for the 82nd Airborne (1:151/305) Msg#: 3974 *Virus Info* 09-08-90 13:42:35 (Read 5 Times) From: SKY RAIDER To: YASHA KIDA Subj: VIRUS POST ON BBS Yasha, You write: GLAD TO SEE SOMEONE does their homework... Well written.. If you don't mind I wish to post it as a bulletin on my System (BBS).. Re written to as a document instead of a msg reply... Sure, no problems in rewritting and posting on your system. I try not to enter into this type of a conversation without at least a bit of a footing in fact. I wish I could find the original document I had quoting these things (it had names, dates, etc.). How about giving me your system number so I can call and see the finished form (never been quoted in this manner before). A questor of knowledge, Sky Raider Ivan Baird, CET --- TBBS v2.1/NM * Origin: Northern Connection, Fredericton, N.B. Canada <HST 14.4K> (1:255/3) Msg#: 4025 *Virus Info* 09-06-90 13:32:00 (Read 6 Times) From: JONO MOORE To: JOE MORLAN Subj: REPLY TO MSG# 3157 (LHARC114?) JM >I had heard that and infected version of LHARC was released JM >last year under the name LHARC114. I also heard that JM >because of that, the next release of LHARC was expected to JM >be LHARC200 to avoid confustion with the virus. This week a JM >file appeared on a local board called LHARC114. I left a JM >message to the sysop to check it out and he says it's clean. JM >The docs say that this is version 114b, the latest version. LHARC v1.14b is a real release. The author brought it out after the controversy on the fake 1.14 release. --- outGATE v2.10 # Origin: SIGnet International GateHost (8:7501/103) * Origin: Network Echogate (1:129/34) Msg#: 4026 *Virus Info* 09-05-90 19:47:00 (Read 5 Times) From: PATRICIA HOFFMAN To: PAUL FERGUSON Subj: LET ME REPHRASE THAT..... PF> Actually, I really should have said "virtually preconceived". PF> From what I can gather on the topic (I don't yet have a copy of 4096), PF> they actually redirect CRC/Checksum interrogators to a "snapshot" of PF> the original file as it appeared before infection.(Someone, I'm sure, PF> will correct me if I'm wrong or at least add enlightenment.) You are correct.....What the CRC/Checksum interrogator sees, if 4096 is in memory, is the disinfected version of the program in memory, not what is actually out on disk. Fish 6 also does this, as do a couple of other viruses using Stealth techniques. PF> The infected file, in the case of 4096, has in reality grown by 4096 PF> bytes and would more than likely hang the system, therefore, which PF> would lead me to believe that running the CRC check without the virus PF> TSR would allow you to identify the actual infected files. Also, it PF> seems like the only way to catch it TSR is to trace the interrupt PF> vectors (although everyone seems to have a little bit of differing PF> ideas on this '->) Lots of 4096 infected files will run without hanging the system....the virus disinfects the program when it is read into memory so that anti-viral packages can't find the virus as easily. CRC checkers and scanners won't be able to find it in the infected file if the virus is in memory, in fact, these viruses usually infect on file open as well as execute. Run a CRC checker or Scanner that doesn't check memory for the virus with it present and you'll infect everything that is openned that meets its infection criteria. If the virus isn't in memory, the CRC checker technique will work to identify the infected files in 99% of the cases. I'm not going to say 100% because I believe some of the 512 virus variants can get around it due to the way it attaches to the files in some cases, but not all. Some CRC checkers don't actually CRC the entire file either....and as soon as I state it is a fool proof way of doing it, someone will write a virus that gets around it perfectly in all cases. Patti PF> Until I can get my hands on this little fellow, I guess that I'll PF> just follow the more logical explanations from the sources with PF> credibilty and make a judgement from that! Sounds credible. But, as I'v PF> said before- I sure would like to see it. PF> PF> I've been following several different message base threads on PF> this particular virus, with input from users at the basic levels to BBS PF> SysOps to the AntiViral research community.......I must say, it gets PF> overwhelming at times to keep objective. *:) PF> PF> -Paul PF> PF> PF> --- QM v1.00 PF> * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 PF> (1:204/869.0) PF> --- W2Q v1.4 * Origin: The C.F.I BBS * Norfolk, Va. * (804)423-1338 * (1:275/328) Msg#: 4027 *Virus Info* 09-07-90 12:48:00 (Read 4 Times) From: MICHAEL ADAMS To: RICHARD HUFFMAN Subj: RE: ARC.EXE Thank you for the warning .... Kill keep an eye out for it. --- Maximus-CBCS v1.00 * Origin: The Southern Star - SDS/SDN/PDN - 504-885-5928 - (1:396/1) Msg#: 4028 *Virus Info* 09-07-90 20:21:00 (Read 5 Times) From: HERB BROWN To: JONO MOORE Subj: REPLY TO MSG# 4025 (LHARC114?) JM >I had heard that and infected version of LHARC was released JM >last year under the name LHARC114. I also heard that JM >because of that, the next release of LHARC was expected to JM >be LHARC200 to avoid confustion with the virus. This week a JM >file appeared on a local board called LHARC114. I left a JM >message to the sysop to check it out and he says it's clean. JM >The docs say that this is version 114b, the latest version. JM>LHARC v1.14b is a real release. The author brought it out after the JM>controversy on the fake 1.14 release. JM> Now, how is someone going to know the difference? That is about as dumb as BBQ'ing indoors and forgetting to open the windows... Sheesh.. --- QM v1.00 * Origin: Delta Point (1:396/5.11) Msg#: 4029 *Virus Info* 09-07-90 20:25:00 (Read 4 Times) From: HERB BROWN To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 4026 (LET ME REPHRASE THAT.....) PH>can't find the virus as easily. CRC checkers and scanners won't be PH>able to PH>find it in the infected file if the virus is in memory, in fact, these PH>viruses PH>usually infect on file open as well as execute. Run a CRC checker or PH>Scanner PH>that doesn't check memory for the virus with it present and you'll PH>infect PH>everything that is openned that meets its infection criteria. I seem to be missing something here. As I understand it, to check for virii with a scanner, such as SCAN, or whatever, you boot from a uninfected floppy that has scan residing on it. Ok, now, how would a virus that works as a TSR, that probably is loaded from the boot sector from the hard disk be loaded, if you are booting from the floppy? Which, the floppy being write protected, of course, would not have this viral infection. I was under the assumption that the BIOS first checked drive A: at bootup for a disk, etc. It seems that it would be impossible to find a virii in memory with this type of scheme.. Please enlighten me.. --- QM v1.00 * Origin: Delta Point (1:396/5.11) Msg#: 4030 *Virus Info* 09-07-90 17:03:00 (Read 5 Times) From: TALLEY RAGAN To: MIKE MCCUNE Subj: REPLY TO MSG# 2910 (RE: REMOVING JOSHI) In a message to Talley Ragan <09-04-90 16:04> Mike Mccune wrote: MM>>I have posted a new version that checks for the virus MM>>before MM>>trying to remove it (now that I have a working copy of the MM>>virus). It will not damage the partition table on MM>>uninfected MM>>hard disks...<MM>. Thanks for the information. This was very educational, as I have had one case of a virus. I don't know how it workedbut the screen would show all garbage and then the computer would hang. I low level formatted the hard disk and restored from good backups. I sure would like to know how it got to me and where it came from!!... Thanks again. Talley --- ZAFFER v1.01 --- QuickBBS 2.64 [Reg] Qecho ver 2.62 * Origin: Southern Systems *HST DS* Tampa Fl (813)977-7065 (1:377/9) Msg#: 4031 *Virus Info* 09-05-90 21:23:00 (Read 5 Times) From: TOM PREECE To: HERB BROWN Subj: REPLY TO MSG# 3816 (RE: PKZ120.ZIP) I seem to remember running into this file several months ago. I don't remember concluding that it had a virus - just that it didn't work properly. The sysop on the sytem that had it apparently reached the same conclusion or something similar because it disappeared here (SF Bay Area.) --- TBBS v2.1/NM * Origin: G.A.D.M. Multi-User TBBS Hayward,CA.(415) 581-3019 (1:161/208) Msg#: 4032 *Virus Info* 09-06-90 19:15:00 (Read 5 Times) From: KEN DORSHIMER To: PAUL FERGUSON Subj: REPLY TO MSG# 4029 (RE: LET ME REPHRASE THAT.....) ...at a time when Western civilization was declining too rapidly for comfort, yet too slowly to be very exciting Paul Ferguson was saying: PF> Ken- This is a continuation of msg.# 156 (I dropped the just FYI the msg numbers don't have much bearing here. on my system is was #75 or something. :-) PF> don't yet have a copy of 4096), they actually redirect CRC/Checksum PF> interrogators to a "snapshot" of the original file as it appeared PF> before infection.(Someone, I'm sure, will correct me if I'm wrong or interesting. seems there would be some simple method of circumventing what the virus does. (i don't have a copy of that one yet either) PF> system, therefore, which would lead me to believe that running the CRC PF> check without the virus TSR would allow you to identify the actual PF> infected files. Also, it seems like the only way to catch it TSR is to PF> trace the interrupt vectors (although everyone seems to have a little i've always thought that by having your own tsr grab the interupts first might be a good way to stop unwanted tsr's from grabbing them. (i'm sure someone will argue the point tho) ...space is merely a device to keep everything from being in the same spot... --- ME2 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753) Msg#: 4278 *Virus Info* 09-08-90 13:51:00 (Read 5 Times) From: DUANE BROWN To: PHILLIP LAIRD Subj: REPLY TO MSG# 3813 (SECURING YOUR UPLOADS) PL>present. I have the Key fake program if it will help you! PL>That file will enter the "Y or N" Question when the batch PL>file comes to Are you sure? Y or N. Meaning you had the PL>batch file to delete all programs in the temp check That's easy to fix the problem about del *.* -- just do echo y | del *.* then the Y gets placed in there automatically...no keyfake, nothing! --- * Origin: End of the Line. Stafford, Va. (703)720-1624. (1:274/16) Msg#: 4279 *Virus Info* 09-07-90 12:45:00 (Read 5 Times) From: CHARLES HANNUM To: PHILLIP LAIRD Subj: REPLY TO MSG# 4031 (RE: PKZ120.ZIP) >Didn't someone say that because someone had already hacked an earlier >version of PKZIP that 120 would be the next scheduled release? >Anybody have any info? Yes. Phil Katz said it. --- ZMailQ 1.12 (QuickBBS) * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0) Msg#: 4280 *Virus Info* 09-08-90 10:49:00 (Read 4 Times) From: JAMES BARRETT To: ALL Subj: SEPTEMBER 18-20, 1990 I have heard somebody mention that there will be a major virus in the next couple of weeks. What's the scoop? I'm involved in a college campus computer lab and need to know what's coming and how to prepare for it. Will ScanV66 catch it???? Thanks in advance... --JCB --- XRS 3.40+ * Origin: >- c y n o s u r e -< 919-929-5153 <HST><XRS> (RAX 1:151/501.14) Msg#: 4281 *Virus Info* 09-08-90 17:39:00 (Read 4 Times) From: HERB BROWN To: KEN DORSHIMER Subj: REPLY TO MSG# 4032 (RE: LET ME REPHRASE THAT.....) With a sharp eye <Sep 06 19:15>, Ken Dorshimer (1:203/42.753) noted: KD>i've always thought that by having your own tsr grab the interupts KD>first KD>might be a good way to stop unwanted tsr's from grabbing them. (i'm KD>sure KD>someone will argue the point tho) Depends on who got there first, I would presume.. Also, multiple TSR's would be a nightmare, colliding and such. --- QM v1.00 * Origin: Delta Point (1:396/5.11) Msg#: 4535 *Virus Info* 09-07-90 08:04:00 (Read 4 Times) From: PAUL FERGUSON To: DOUG EMMETT Subj: SCAN FROM C: Hello, Doug.... Doug, I must tell you that it is not advisable to run ViruScan from your hard disc....It really should ALWAYS be run from a WRITE PROTECTED FLOPPY....Scan can become easily infected when ran in an infected environment on a HD. BTW....Software that "Write Protects" you r hard disc may work in some cases, but can be circunvented. Be safe..... -Paul --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 4536 *Virus Info* 09-07-90 08:06:00 (Read 4 Times) From: PAUL FERGUSON To: LONNIE DENNISON Subj: WELCOME... Glad to have you........ Welcome aboard.... -Paul ^@@^........ --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 4537 *Virus Info* 09-07-90 08:09:00 (Read 4 Times) From: PAUL FERGUSON To: RICHARD HUFFMAN Subj: REPLY TO MSG# 4027 (ARC.EXE) Richard, Please E- me out of the conference....I would like to discuss this a little further......Better yet, contact me at the NCSA BBS in DC (202) 364-1304 at 1200/2400, 8,N,1.....I can be reached in the VIRUS Conference.....Thanks, -Paul --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 4538 *Virus Info* 08-16-90 08:30:00 (Read 5 Times) From: ALAN DAWSON To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 3183 (RE: VIRUS SCANNERS....) PH> I just wish the people writing this viruses would find more PH> useful things to do with their talents....such as trying to PH> help people instead of harm their systems. Hear, hear! The frustrating, rug-chewing, desk-beating, monitor-smashing, stomp-down crying SHAME is that some of these viruses, on a technical level, are tremendously slick, wonderous programs. The people writing them are wonderful programmers. Just think what these people could be doing to help our PCs work better by writing a different kind of program -- and, potentially, how much money they might be able to make. They obviously have inventive minds, many of them. Such inventiveness could be put to such great use. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 4539 *Virus Info* 08-16-90 08:36:00 (Read 5 Times) From: ALAN DAWSON To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 4538 (RE: VIRUS SCANNERS....) PH> I'd agree with that. The anti-viral program should be able to PH> detect that it is infected and produce a warning, though it may PH> still execute. By the time the anti-viral program has PH> determined its been infected, you've already infected system PH> memory or spread the virus. Sure. Something ELSE has infected it. No reason not to let it run so long as it still works. One of our local youngsters wrote a wonderful remover of the Dark Avenger -- about 1400 bytes and worked like a charm. Only one teensy-weensy trouble -- the remover got infected and didn't warn you. That's not really one of the more useful programs to have around. Since it seems to be the constant topic of conversation here, SCANV's routine of warning of infection and continuing its duties is great. A common cause of re-infection is forgetting to remove the tools you used in the disinfection process -- stuff like LIST, just for example, that you might have used to examine the virus. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 4540 *Virus Info* 08-16-90 08:52:00 (Read 5 Times) From: ALAN DAWSON To: MICHAEL TUNN Subj: REPLY TO MSG# 2899 (RE: WHAT'S THE SOLUTION?) MT> It seems to me our Virus checking programs will just get bigger MT> and bigger as more viruses and strains of the same viruses are MT> discovered. If so (and if their development is excelerating) Right. Question of the Year (1991??): What can you call it after you've hit the SCANV999 wall? MT> Do we do develop new Operating Systems which are far more MT> secure! Well, at least a new DOS which allows 9-character names? Then we could do SCANV9999. [joke]. MT> Do we crawl in a hole and hope it wont happen to us? No, in a metaphor placed in 1970 terms, we get to the airport two hours before flight time for the security checks. And for the same reason, too -- the unwillingness of the many to take the resolve to remove the few. We have, most of us, helped the virus writers build up their existing sick belief that we are willing participants in some kind of game here. They win if they manage to steal our time, programs, disk space and data. They only do it because they had an unhappy childhood, right? One tangible result of allowing them to feed on this warped view is this echo, where we're all trying to get to the airport two hours early for the security check -- AND WE'RE ALL WASTING TWO HOURS because somebody we don't know might try to hurt us. We should have sympathy for Robert Morris, of course, because after all, he was just experimenting and not REALLY trying to hurt anyone, right? I have a one-word, two-syllable response to that but FidoNet policy frowns down upon me for thinking of using it. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 4541 *Virus Info* 08-16-90 09:25:00 (Read 4 Times) From: ALAN DAWSON To: KEN DORSHIMER Subj: RE: VIRUSES, WHAT ELSE... KD> not sure on that one, who knows what menagerie of thoughts KD> wander through clients minds.. :-) actually, i was unaware of KD> Corporate Vaccine (maybe I should get out more). I'm a little KD> concerned that the commercial programs may not be aware of some KD> of the newer viruses which crop up from time to time. This is just a thought, too. But why not take your clients into your confidence, and point out to them that it is virtually impossible for anyone to match the up-to-dateness of a BBS distribution system? You're a BBSer. You know, just for example, that without BBSes McAfee couldn't have a program-of-the-week. Distribution of what your clients think of as commercial software simply isn't up to this standard -- isn't meant to be; never was; probably never will be. Seems to me if your clients like the SCANV concept, you should explain to them why they should be using SCANV. Why reinvent the wheel? If it wasn't that commercial messages which mention something other than SCANV often seem to get flamed here, I'd tell you about my commercial, non-BBS, wholly generic virus detector that doesn't need upgrading, which is available in North America and which soon will be launched there. But I don't want to get flamed, so I won't. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 4542 *Virus Info* 08-29-90 12:26:00 (Read 5 Times) From: ALAN DAWSON To: KEN DORSHIMER Subj: REPLY TO MSG# 3815 (RE: CRC CHECKING) PH>> Except in the case of Stealth Viruses....CRC checking doesn't work PH>> with them. PH>> KD> i'd have to see that for myself. i think a complex enough KD> algorithm would keep them at bay. the probability factor is KD> just too low for such a stealth scheme to work. Roger that. A program (such as a virus) can possibly figure out a checksum or CRC and "fool" your checker. But complex and random checksumming or CRCing is beyond the real-world possibility of defeat by a PC virus -- it would have to be too big and complex itself. Our strategy on our anti-virus program is to have eight different algorithms, and to use two of them on each checksum pass. Which two, even we do not know. Your virus then would have to take into account 64 reasonably complex algorithmic possibilities to defeat it. Patti is technically correct that this can be done -- but not in the real world. I'd tend to be slightly suspicious if my word processor suddenly grew by the size of THIS virus. Most programs would, in fact, be incapable of loading it. As you say -- make it complex (which isn't so difficult) and keep churning out hundreds of different algorithms. Then you can forget about "stealth" viruses succeeding. - From Thailand, a warm country in more ways than one. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 4543 *Virus Info* 09-01-90 21:26:00 (Read 5 Times) From: ALAN DAWSON To: PHILLIP LAIRD Subj: REPLY TO MSG# 3154 (RE: SCAN WEIRDNESS) PL> Allan, I NEVER SCAN from the C Drive or any hard disk. I PL> always scan from a write protected Floppy Diskette in Drive A. This is absolutely correct, of course, and EXACTLY what's recommended in the doc. I was just curious whether others had had the experience. I do do some experimenting with viruses and anti-virus stuff, because Bangkok's a "virus capital" (dumb dealers plus a whole raft of pirates) and because I'm involved in a commercial anti-virus project. This was just a weird thing that happened to me when I was "playing" with Dark Avenger. I do wonder how many people follow that "write-protected floppy" recommendation (order???) in the SCAN docs, though. One note on your comment: it might be hard for some people to follow the recommendation, i.e. those with one floppy. The total beauty of SCAN, really, is to look over that new stuff. A lot of machines go to new people with one floppy drive. A lot also go with two different floppy drives (my own setup) although this of course is combatted simply by having TWO write-protected diskettes with SCAN aboard. - From Thailand, a warm country in more ways than one. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 4544 *Virus Info* 09-01-90 23:00:00 (Read 5 Times) From: ALAN DAWSON To: SANDY LOCKE Subj: REPLY TO MSG# 3819 (RE: REMAPPING...) SL> long time programmer I can testify the keyboard mapping is SL> really quite simple... no real problem and the business of SL> using terminal control code is quite as simple... SL> sandy Finally, some sanity, sandy. [grin] (no pun intended until after I read that). The letter bomb, as a friend calls it, is alive, well and could certainly flourish. I wouldn't lay a huge amount of money on the ability to write a *virus* with remapping, but a bomb's a piece of cake. I THINK this thread started with the ability to put one directly over a terminal BBS-to-user connection, and in general there seem by my own experiments to be two chances of this: slim and fat. But, like a virus, a letter bomb can be transmitted via a BBS to a user, and then set off by that user in a number of pernicious ways that occur to me right off the top of my head. None of which you will see writ here, you understand -- but after watching this thread for a few weeks, I'm glad you leapt in with both feet. - From Thailand, a warm country in more ways than one. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 4545 *Virus Info* 09-06-90 18:59:00 (Read 5 Times) From: ALAN DAWSON To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 4543 (RE: SCAN WEIRDNESS) PH> There are a couple of possibilities here. First, if the virus PH> is on a non-executable file, such as one with a .VOM or .VXE Nope, wasn't either of these Patti. I tried to put in everything, and then forgot to say it was a regular file called AVENGER.COM -- a small utility I infected to harbor the virus when I ran it for tests. The utility originally was a small screen shell for looking at files a la LIST. It USED to be 3K, but now it's a little bigger [grin] PH> The other case is if your copy of Dark Avenger does not occur PH> at the correct place in the file. Dark Avenger always adds its PH> code to the End Of Programs. If your copy happens to have it at Roger. This is right up against the end of the file. PH> Hope that helps....those are the only three cases that I've PH> heard of a similar problem to yours. OK, no biggie. It was just that it was so weird I thought maybe you'd heard of it. I'll try it again when we get SCAN66B just for fun. It's not the kind of "bug" that's detrimental -- it's just one of those hey-it's-not-supposed-to-do-that things. Stupid machines. - From Thailand, a warm country in more ways than one. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 4546 *Virus Info* 09-06-90 19:00:00 (Read 5 Times) From: ALAN DAWSON To: SANDY LOCKE Subj: REPLY TO MSG# 4539 (RE: VIRUS SCANNERS....) SL> UH ALAN... you mind sending the NAME of this vendor via private SL> e-mail... accidentally I can understand BUT ON PURPOSE??? what SL> end would this kind of action serve??? SL> cheers SL> sandy This was before the Great Virus Scare of 1989 of course -- it was, if my tremendously failing memory isn't failing me, in 1986. A Toronto magazine put the virus in as a joke -- every time you started an infected program, a brief ad for the mag jumped up. Ald. . . whoops, the company name almost slipped out there, thought this was hilarious, left it in and shipped the thing. I'll send full details your way. This same company, the next time it shipped viruses, claimed that a guy in the shipping department was playing a game and accidentally infected the shipment (exclaimer!!!!). Is this a company with a weird sense of security, or what? - From Thailand, a warm country in more ways than one. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 4746 *Virus Info* 09-09-90 14:33:00 (Read 4 Times) From: CHARLES HANNUM To: PHILLIP LAIRD Subj: RE: MAKING SCAN READ ONLY. > Patti, is it feasible to make Scan.Exe Read only? Doug Emmett was > wondering about doing that. Couldn't you change the archive bits to > read only? Also, doesn't scan have an internal routine to determine > if it is damaged? Setting the "Read-only" attribute wouldn't even *phase* a decent virus, and SCAN's internal checksum is VERY weak. (It quite literally is a checksum. It simply checks to see if all the words in the files add up to 0.) --- ZMailQ 1.12 (QuickBBS) * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0) Msg#: 4747 *Virus Info* 09-09-90 07:35:00 (Read 5 Times) From: JERRY MASEFIELD To: CHARLES HANNUM Subj: REPLY TO MSG# 4279 (RE: PKZ120.ZIP) > >Didn't someone say that because someone had already hacked an earlier > >version of PKZIP that 120 would be the next scheduled release? > >Anybody have any info? > > Yes. Phil Katz said it. No, Phil Katz said there WOULDN'T be a 120 release because of the same reason. This would eliminate any confusions between the real and phony versions. Also, Katz is offering a reward for any info leading to the arrest of the perpetrator of this hacking. --- TosScan 1.00 * Origin: On A Clear Disk You Can Seek Forever! (1:260/212) Msg#: 4748 *Virus Info* 09-09-90 23:16:00 (Read 5 Times) From: PHILLIP LAIRD To: CHARLES HANNUM Subj: REPLY TO MSG# 4747 (RE: PKZ120.ZIP) ** Quoting Charles Hannum to Phillip Laird ** >Yes. Phil Katz said it. > >--- ZMailQ 1.12 (QuickBBS) > * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0) ** End of Quote ** That is what I thought. As soon as he went and said it, somebody appearently decided to hack it, huh? --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 4749 *Virus Info* 09-08-90 17:42:00 (Read 4 Times) From: PAUL FERGUSON To: KEN DORSHIMER Subj: YEAH, BUT... You're on the right track, Ken....But TSR's have a nasty habit of fighting for control amongst each other. Some do not behave very well. -Paul --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 4750 *Virus Info* 09-09-90 08:43:00 (Read 6 Times) From: PATRICIA HOFFMAN To: PHILLIP LAIRD Subj: JERUSALEM B AND CLEANP64.ZIP PL> I cleaned 17 infected files today with clean version 64. I have a good PL> question. While the program removes the file, some where removed the PL> first time around, others were scanned several times before the virus PL> was actually removed. Can you tell me why? The programs that were scanned several times probably were infected multiple times with Jerusalem virus. A lot of the variants of Jerusalem B will infect .EXE files repeatedly, eventually the program will get too large to fit into memory. On files that are infected multiple times with Jerusalem, you'll see a message come up for each infection as it is removed. That is my guess as to what you observed... Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 4751 *Virus Info* 09-09-90 11:01:00 (Read 5 Times) From: PATRICIA HOFFMAN To: HERB BROWN Subj: REPLY TO MSG# 4281 (LET ME REPHRASE THAT.....) HB> I seem to be missing something here. As I understand it, to check for HB> virii with a scanner, such as SCAN, or whatever, you boot from a HB> uninfected floppy that has scan residing on it. Ok, now, how would a HB> virus that works as a TSR, that probably is loaded from the boot sector HB> from the hard disk be loaded, if you are booting from the floppy? HB> Which, the floppy being write protected, of course, would not have this HB> viral infection. I was under the assumption that the BIOS first HB> checked drive A: at bootup for a disk, etc. It seems that it would be HB> impossible to find a virii in memory with this type of scheme.. Please HB> enlighten me.. The memory resident viruses that are a real problem when they are in memory and any antiviral, whether a scanner or CRC checker, is run are not boot sector infectors....4096, Fish-6, Dark Avenger, and many others which infect on file open are file infectors. There are three that are file infectors but can also infect and replicate from the partition table and/or boot sector: V2100, Anthrax, and Plastique 5.21. (These last three are extremely rare, fairly new, and not known in the United States.) All of the viruses mentioned about use "Stealth" techniques to avoid detection or infect on file open. If you are booting from an uninfected diskette when powering on the computer, you wouldn't ever find a virus in memory. However, if you are performing a warm reboot from a floppy, you could have a virus in memory still. The real point here was that most people do not run scan or other anti-viral utilities after powering on and booting from a floppy, so it is always possible for the virus to be in memory. In that particular case, for a CRC checker which is what was being discussed, there are definite cases (the "Stealth" viruses) where the virus can get around the CRC checker simply because if the virus is in memory it disinfects the infected programs as they are read into memory. The CRC checker, since it is performing file reads, reads the DOS buffers to check the program, so the program it sees isn't infected and isn't the same as what is actually on the disk. In the case of viruses that infect on file open, running an anti-viral product against all the programs on a system with the virus active in memory can very well result in all the programs becoming infected. I'm not against CRC checkers, I use one all the time on several of my systems. These systems all have master boot diskettes with clean system files, the CRC checker, and the log of all the expected crc values to be returned. Most people simply do not have that type of diskette setup for their systems since they feel they'll never be infected with a virus. In fact, the probability that a person will be infected with a virus is fairly low, though it does change depending on the person's computing habits and how often they exchange diskettes and/or programs with others. I was trying to point out that NONE of the current anti-virals will absolutely protect a user from getting a virus....all the techniques currently used by anti-viral products can be circumvented by some of the newer, more technologically advanced viruses. Not to point that out would be like burying one's head in the sand, especially when the discussion has to do with someone thinkin of writing a new anti-viral who needs to know what can currently be circumvented. It is easier to fix the design before the program is written then to fix it later after the hole is found.... Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 4967 *Virus Info* 09-10-90 16:55:00 (Read 5 Times) From: CHARLES HANNUM To: JERRY MASEFIELD Subj: REPLY TO MSG# 4748 (RE: PKZ120.ZIP) >> >Didn't someone say that because someone had already hacked an earlier >> >version of PKZIP that 120 would be the next scheduled release? >> >Anybody have any info? >> >> Yes. Phil Katz said it. > No, Phil Katz said there WOULDN'T be a 120 release because of the > same reason. This would eliminate any confusions between the real > and phony versions. Also, Katz is offering a reward for any info > leading to the arrest of the perpetrator of this hacking. Err, <retracting foot from mouth> I must have misread the original note... --- ZMailQ 1.12 (QuickBBS) * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0) Msg#: 4968 *Virus Info* 09-10-90 17:54:00 (Read 5 Times) From: CHARLES HANNUM To: WHOM IT MAY CONCERN Subj: LHARC 1.14B(ETA) The 'b' is actually a beta, which makes me think he released it for testing and it got loose, but is not yet an "official" release. At any rate, I NEED AN ANSWER!! I have "LHarc 1.14b(eta)", and I really need a definitive answer. IS IT REAL OR NOT? --- ZMailQ 1.12 (QuickBBS) * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0) Msg#: 4969 *Virus Info* 09-10-90 23:13:00 (Read 4 Times) From: PHILLIP LAIRD To: DUANE BROWN Subj: REPLY TO MSG# 4278 (RE: SECURING YOUR UPLOADS) ** Quoting Duane Brown to Phillip Laird ** > >That's easy to fix the problem about del *.* -- just do > >echo y | del *.* > >then the Y gets placed in there automatically...no keyfake, >nothing! > >--- > * Origin: End of the Line. Stafford, Va. (703)720-1624. (1:274/16) ** End of Quote ** Thanx.... Using the pipe redirection will do just that like you say. I use the KEYFAKE Program for a reason with KEY.DAT in the program I just finished that will check for bugs in uploads. It calls the routine externally from the Execute file. --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 4970 *Virus Info* 09-10-90 23:21:00 (Read 6 Times) From: PHILLIP LAIRD To: ALAN DAWSON Subj: REPLY TO MSG# 4545 (RE: SCAN WEIRDNESS) ** Quoting Alan Dawson to Phillip Laird ** > >This is absolutely correct, of course, and EXACTLY what's recommended > >in the doc. I was just curious whether others had had the experience. > >I do do some experimenting with viruses and anti-virus stuff, >because >Bangkok's a "virus capital" (dumb dealers plus a whole raft >of >pirates) and because I'm involved in a commercial anti-virus >project. >--- Opus-CBCS 1.13 > * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand >(3:608/9.0) ** End of Quote ** I totally agree that most people do not read the docs. I work for a University in South East Texas. Some of the Micros have been plagued with viruses. I have setup a routine for the Labs to Scan the Floppies coming in with SCAN. This has just taken Place. Next thing I know, the clerk decides to run SCAN From her hard drive on her desktop! Then Alameda hit her! The SCAN Program has gone over good at the University. We are getting an order ready for a Site License Agreement with MCafee and Associates. I do a little research on some of the strains. However this BBS keeps me busy after work! Weird thing about CLEAN.EXE the program to remove the Viruses. I am using Clean Version 66 and sometimes the program will scan the file numerous times before the virus is eventually removed. I guess the Marker is trying to move around in the file? Anybody know? --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 4971 *Virus Info* 09-09-90 10:59:00 (Read 5 Times) From: MIKE BADER To: MARC SHEWRING Subj: INFORMATION Several anti-virus programs use signature files. IBM (yech) for one, but VirHUNT by DDI alos uses a file for signatures and goes into quite a bit of detail in their manual. I'll look up a better address and phone. Mike --- FD 1.99c * Origin: P-1 BBS ][ (313) 542-9615 Ferndale, MI (HST) (1:120/45) Msg#: 4972 *Virus Info* 09-06-90 20:56:00 (Read 8 Times) From: CY WELCH To: DEREK BILLINGSLEY Subj: REPLY TO MSG# 3817 (POSSIBLE VIRUS?) In a message to All <01 Sep 90 11:34:00> Derek Billingsley wrote: DB> This just hit me today - I am not sure if it is some kind of system DB> error or a potential virus. DB> Last night (September first) and before gave me no indication of any DB> virus being present on my system. It is now september 1st and now, DB> whenever a file is written to disk (I noticed the text files first, DB> but a downloaded zip'd file was also garbled...) it took out about DB> 10 bytes from the beginning of each line... DB> When I realized this may be set to occur on this date, I set my DATE DB> back a night and everything worked fine... I made a sample text file DB> with a known pattern of characters -- any date past september 1st DB> 1990 leaves the file altered as mentioned above. Any date previous DB> is written unharmed... DB> SCANV56 reports only that the SCAN program is damaged - no disk DB> presence of the source is evident. DB> Has anyone heard of something like this happening? Can't say I have heard of that but it sure sounds like a virus. I would recommend getting a copy of scan v64 and see what it says. It might even be something new. --- XRS! 3.41+ * Origin: Former QuickBBS Beta Team Member (99:9402/122.1) (Quick 1:125/122.1) Msg#: 4973 *Virus Info* 08-14-90 18:15:00 (Read 5 Times) From: JAMES BLEACHER To: DOUG BAGGETT Subj: REPLY TO MSG# 2904 (ANTI VIRUS VIRUSES) * Replying to a message originally to Patricia Hoffman DB>well..here is a question..where exactly did viruses DB>originate anyway..was it in this country or others? DB>Doug According to want I've read Dr. Fred Cohen at MIT developed the first virus back in 1964 or so. This was to prove that code could actually replicate and spread throughout a mainframe. My question is why on earth would he want to do that in the first place? --- * Origin: "Hey! Why's my COMMAND.COM larger than normal?" (1:151/801) Msg#: 4974 *Virus Info* 08-14-90 18:23:00 (Read 5 Times) From: JAMES BLEACHER To: PAUL FERGUSON Subj: REPLY AND ADDENDUM TO MSG 145 * Replying to a message originally to Alan Dawson PF>You can always be sure of an uninfected SCAN IF you download PF>from the PF>authors' BBS....The program itself will terminate upon PF>detection and PF>has safeguards written into it to protect against such PF>occurances....Of PF>course, there are ways for an unsuspecting user (You know PF>who) to PF>infect the programs themselves and then re-archive PF>unwittingly a PF>viral Scan that will never know (depending upon the WRONG! Scan checks itself upon startup and will give you a message to the effect of: FILE DAMAGED! "C:\SCAN.EXE" But will continue to operate. If you see that message then you're in big trouble. Viruses like the Dark Avenger will use scan's file checking (since it opens all the files it's checking) to spread itself all over your floppy/hard drive. Unless you've got a totally new virus that scan can't detect you don't have anything to worry about if it's already infected when you get it. (Except that it's probably detecting the virus all over your drive because it just helped put it there!) --- * Origin: "Hey! Why's my COMMAND.COM larger than normal?" (1:151/801) Msg#: 4975 *Virus Info* 09-10-90 18:02:00 (Read 6 Times) From: JAMES BLEACHER To: DEREK BILLINGSLEY Subj: REPLY TO MSG# 4972 (POSSIBLE VIRUS?) DB>SCANV56 reports only that the SCAN program is damaged - no DB>disk presence of the source is evident. DB> DB>Has anyone heard of something like this happening? Well, first of all you've got an old version of scan. Try downloading scanv66b from someone. I have it if you can't locate it elsewhere. Second if scan ever reports being damaged there's a 99% chance that you've got a virus! Better check into it quick! Hope you don't find that you have one but it sure sounds like you do! --- * Origin: "Hey! Why's my COMMAND.COM larger than normal?" (1:151/801) Msg#: 5238 *Virus Info* 09-10-90 15:11:00 (Read 6 Times) From: JOE MORLAN To: JONO MOORE Subj: REPLY TO MSG# 4028 (RE: LHARC114?) I have learned from other sources that the latest official release of LHARC is LH113D. The 'new' LHARC114 is said to be another unauthorized hack. It evidently is NOT a virus. Yoshi has been quoted as stating on GENIE that the next official release will be ver. 2.0. I hope this helps. --- Telegard v2.5i Standard * Origin: Telegard BBS (000-000-0000) (1:161/88.0) Msg#: 5239 *Virus Info* 09-10-90 15:12:00 (Read 6 Times) From: JOE MORLAN To: HERB BROWN Subj: REPLY TO MSG# 5238 (RE: LHARC114?) Exactly. LHARC v1.14b is not a real release. Just another unauthorized hack. --- Telegard v2.5i Standard * Origin: Telegard BBS (000-000-0000) (1:161/88.0) Msg#: 5240 *Virus Info* 09-07-90 20:35:00 (Read 6 Times) From: CHRIS BARRETT To: SIMON FOSTER Subj: RE: MYSTERY VIRUS?? Could I ask wy the buffers would be causing the Boot Block to be altered. I have since removed the val checks using ScanV66B and put some new ones on using ScanV66B. Could it be possible that someone has altered a bit of the code and as ScanV66 uses a string (or is it hex search) it doesn't find it? eg In the Virus it originaly said "Your disk is stoned' and the person converted it to say 'Your disk is now stoned'. If ScanV66 happens to look for the original string to my knowlegde the virus would not be recognized. Chris. --- TBBS v2.1/NM * Origin: 1990 MultiLine Perth Western Australia - 09-370-3333 - (690/654) Msg#: 5241 *Virus Info* 09-12-90 22:11:00 (Read 6 Times) From: PHILLIP LAIRD To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 4751 (RE: LET ME REPHRASE THAT.....) ** Quoting Patricia Hoffman to Herb Brown ** >If you are booting from an uninfected diskette when powering >on the computer, you wouldn't ever find a virus in memory. > However, if you are performing a warm reboot from a floppy, >you could have a virus in memory still. The real point here >was that most people do not run scan or other anti-viral utilities >after powering on and booting from a floppy, so it is always >possible for the virus to be in memory. ** End of Quote ** THat is exactly the way I have found some of the Virii I researched as being. If the virus is present in memory, then it is possible the the file will infect, however, if the Scan Diskette is write protected and the diskette is bootable, Like oyu say. It is BEST to cut the power to the system and then re-boot the system. However, if you wanted to go a step further, it is possible to clear all volatile RAM if you want to do a warm boot. The Warm Boot can result in infection, since the ram is not cleared. The various hardware interrupts are still performed and cotrol passed to Command.com, but the System files are still present in memory, along with a virus possibly. Too many people are now taking the virus issue too lightly. It can effect you, take precaution and use the Floppy to boot up on with a Write Protect on the Diskette. Then scan the drive from there. --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 5242 *Virus Info* 09-12-90 22:16:00 (Read 6 Times) From: PHILLIP LAIRD To: PATRICIA HOFFMAN Subj: RE: JERUSALEM B AND CLEANP64.Z ** Quoting Patricia Hoffman to Phillip Laird ** > PL> I cleaned 17 infected files today with clean version 64. > I have a good > PL> question. While the program removes the file, some where >removed the > PL> first time around, others were scanned several times before >the virus > PL> was actually removed. Can you tell me why? > >The programs that were scanned several times probably were >infected multiple times with Jerusalem virus. A lot of the >variants of Jerusalem B will infect .EXE files repeatedly, >eventually the program will get too large to fit into memory. > On files that are infected multiple times with Jerusalem, >you'll see a message come up for each infection as it is removed. > > >That is my guess as to what you observed... > >Patti > ** End of Quote ** That is exactly what I had suspected. I assumed the file was re-infected several times as the size of the Original WP.EXE files that were infected once was for example 112K, and the ones that were infected several times was around 173K. Some of the programs were non functional after clean ws performed on the file. We just delte the file and re-copy it when that happens. The only safe way to do it I have found is to go ahead anuse scans' /D option and delete the file and re-copy it. --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 5887 *Virus Info* 09-14-90 14:05:00 (Read 5 Times) From: MIKE MCCUNE To: PATRICK TOULME Subj: MOTHER FISH Everybody was talking about the Mother Fish a few weeks ago. Now that it has been out for mor than a week, nobody is saying anything about it. What's the deal with this virus? --- Opus-CBCS 1.13 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0) Msg#: 6048 *Virus Info* 09-14-90 07:05:00 (Read 4 Times) From: JOE MORLAN To: CHARLES HANNUM Subj: REPLY TO MSG# 4968 (RE: LHARC 1.14B(ETA)) According to folks posting on the technical echo, Yoshi has stated on Genie that the next official release after LHarc 1.13c will be LHarc 2.xx. Beta versions of LHarc 2.0 are said to have been released in Japan. It is illogical that 114b would be a valid release. The main change is the same as the known unauthorized hack, ICE. There are a few people on that echo that seem to believe that the release is "real" based mostly on the source where the file had been posted. It seems clear to me that it is just another unauthorized hack. --- Telegard v2.5i Standard * Origin: The Twilight Zone (415)-352-0433 (1:161/88.0) Msg#: 6659 *Virus Info* 09-15-90 08:13:00 (Read 4 Times) From: RICHARD HECK To: ALL Subj: CLEAN UP I think that the newest version of cleanup was alot better then the version before it. Oh and watch out for that Sunday Virus. --- outGATE v2.10 # Origin: SIGnet International GateHost (8:7501/103) * Origin: Network Echogate (1:129/34) Msg#: 6660 *Virus Info* 09-16-90 11:28:00 (Read 5 Times) From: SATYR DAZE To: CHRIS BARRETT Subj: REPLY TO MSG# 5240 (RE: MYSTERY VIRUS??) Sorry to butt in ..... you aparently have been infected by the Stoner-Marijauna Virus , quite a few people here in florida myself included have seen this little beauty. After disinfecting yourself the damaged caused by the virus is unaltered. Backup your harddrive and reformat it, after restoring it. Delete and redo Autoexec.bat and Config.sys they have both also been altered. Your Hardrive should now be back to snuff .... but before i forget run a utility to mark and lock out bad sectors the Virus may have caused. These unfortunaly are not always recoverable. G'Day ....................... The Satyr Daze --- TBBS v2.1/NM * Origin: Eclectic Multi-BBS System / Miami FL (305)662-1748 (1:135/2) Msg#: 6661 *Virus Info* 09-16-90 11:39:00 (Read 4 Times) From: SATYR DAZE To: GARY MOYER Subj: REPLY TO MSG# 4546 (RE: VIRUS SCANNERS....) Well you can Download a Virus scanner from a reputable BBS -- one that actually checks all of it's files for viruses --- or go out and purchase a Virus Scanner. Most of the downloadable stuffis by Mcaffe Associates, You can purchase Virucide (commercial version) which checks and disinfects your files, also by Mcaffe Associates for about $30.00. Not a bad buy when you consider the consequences of not having a good scanner. Just make sure that after Downloading a file, unarc-unzip-unwhatever it, But under no circumstance activate it --- run it --. Run the scanner, if the file checks clean go ahead and run it then. If it dosn't the program will warn you and disinfect it. The reason you must open the file (unzip) is because scanners can't look into an archived file. The Satyr Daze --- TBBS v2.1/NM * Origin: Eclectic Multi-BBS System / Miami FL (305)662-1748 (1:135/2) Msg#: 6662 *Virus Info* 09-16-90 13:40:00 (Read 4 Times) From: SATYR DAZE To: CHARLES HANNUM Subj: REPLY TO MSG# 4973 (RE: ANTI VIRUS VIRUSES) Actually the Honor of creating Viruses Belongs to John Conway, he was trying to develop software that emulated living organisms. He developed the first "Game of Life". As he created these new programs they became more and more complex having intricate enviroments that the elements would have to over come in order to survive. But these were never allowed to get beyond that scope, Virus programs where never destructive untill the "Core Wars". Opposing Programmers would create self-replicating programms that when they encountered other self-replicaters would try to devour them. Incidently it was called "Core Wars" because the game itself took place in Core Memory . These young Programmers were actually quite small in number and never publicly discussed what they were doing. If any blame is to be attached it should be to Ken THompson who went public with the process in 1983..... at that point it was "Discovered" by university students who began creatingthe real nasties ..... Today many strains are just variation of their original work. Just a little History............... The Satyr Daze --- TBBS v2.1/NM * Origin: Eclectic Multi-BBS System / Miami FL (305)662-1748 (1:135/2) Msg#: 6663 *Virus Info* 09-14-90 19:31:00 (Read 5 Times) From: RAJU DARYANANI To: ALL Subj: NETWARE BYPASSING JERUSALEM VIRUS Does anyone have any details on the CERT announcement that it has isolated a version of the Jerusalem virus that can bypass Novell Netware's file protection settings and infect files ? Anyone know of actual infections, how common it is and whether McAfee's SCAN detect this virus ? Raju --- via Silver Xpress V2.24 [NR] --- QM v1.00 * Origin: TAIC Maximus - DVNet Asia, PEP/V.32 High Speed PathFinder (3:700/1.0) Msg#: 6664 *Virus Info* 09-16-90 00:41:00 (Read 4 Times) From: ALAN DAWSON To: PHILLIP LAIRD Subj: REPLY TO MSG# 4970 (RE: SCAN WEIRDNESS) PL> been plagued with viruses. I have setup a routine for the Labs PL> to Scan the Floppies coming in with SCAN. This has just taken PL> Place. Next thing I know, the clerk decides to run SCAN From PL> her hard drive on her desktop! Then Alameda hit her! The SCAN The next "killer-ap" should be the anti-stupidity program. If ever it needed to be proved that "a little knowledge is a dangerous thing," computer users prove it to their techies daily! PL> Weird thing about CLEAN.EXE the program to remove the Viruses. PL> I am using Clean Version 66 and sometimes the program will scan PL> the file numerous times before the virus is eventually removed. I really don't like the whole idea of a "popular" virus remover. (A specific cure for a specific virus on one site is different.) Any yo-yo with PC-Tools or Norton can make a "new" virus and this makes the possible results from a removal program very iffy. I really believe in brute-force removal i.e. DEL VIRUS.COM, and re-install. It's safer that way, and certain (after you check the floppies, of course). - From Thailand, a warm country in more ways than one. --- Opus-CBCS 1.13 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0) Msg#: 7165 *Virus Info* 08-31-90 20:15:00 (Read 4 Times) From: CHRIS BARRETT To: ALL Subj: BOOKS ON VIRUSES Could someone tell me somenames of books on Viruses and their authors. As I am in Australia getting hold of them may be a problem though. Hope you can help... Chris.. --- TBBS v2.1/NM * Origin: 1990 MultiLine Perth Western Australia - 09-370-3333 - (690/654) Msg#: 7166 *Virus Info* 08-31-90 20:21:00 (Read 5 Times) From: CHRIS BARRETT To: ALL Subj: REPLY TO MSG# 6660 (MYSTERY VIRUS??) At my school we have some XT's with 2 360K FDD each. Lately we have noticed that some of the students disks are being over written by the program disk they were using. Eg some people have found the Turbo pascal files on their data disks. I brought in a copy of ScanV66 and placed a validation check on the program disks (Not the data disks). Scanning showed no viruses (well known ones anyway). But when we scanned them a week later we found some had had their Boot Blocks altered. In some cases the files on the data disk are just renamed to one on the program disk. Eg we listed "TURBO.EXE" and found it to contain a students pascal source code. Could someone shed some light please.. I have told the teacher it is most likely home grown and he is sh*tting himself. Chris. --- TBBS v2.1/NM * Origin: 1990 MultiLine Perth Western Australia - 09-370-3333 - (690/654) Msg#: 7167 *Virus Info* 09-01-90 18:28:00 (Read 4 Times) From: DOUG EMMETT To: PHILLIP LAIRD Subj: REPLY TO MSG# 6664 (RE: SCAN WEIRDNESS) For the new boy would you mind explaining how to write protect Scan.Exe on the C: drive-Thanks --- Opus-CBCS 1.13 * Origin: The U.S.A. Connection-*HN-NZ*-(+64-71-566851) (3:772/260.0) Msg#: 7168 *Virus Info* 09-02-90 14:18:00 (Read 4 Times) From: WARREN ANDERSON To: MIKE DURKIN Subj: REPLY TO MSG# 2475 (INTERNET WORM) Hi, No I have never come across the book. I would appreciate it if you could provide a copy of the password list (just in case I can't get hold of a copy of the book). Thanks again. Regards \/\/ /\/\ Anderson --- Telegard v2.5 Standard * Origin: InfoBoard BBS - Auckland - New Zealand (3:772/140.0) Msg#: 7169 *Virus Info* 09-04-90 06:12:00 (Read 4 Times) From: PAUL FERGUSON To: YASHA KIDA Subj: REPLY TO MSG. 134 Right on, Yasha......I couldn't have said it better myself.....This town (DC) seems to have a real problem concerning this. That's OK, though, as you have said, we shall see who they come running to when the going gets rough..... -Paul --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 7170 *Virus Info* 09-05-90 12:50:00 (Read 4 Times) From: MICHAEL ADAMS To: RICK THOMA Subj: RE: PKZ120.EXE Rick .. I had one uploaded to my Board called "PKZ120.exe". The File looks Authentic. Even went to the point of -AV and the Pkware registeration number on the last line after self extraction. If it were not for the file "Warning.txt" put out by "Pkware" I'd still be using it. Really went through alot of trouble authenticating it! Michael Adams Baud Horizons (504) 436-9590 --- Maximus-CBCS v1.00 * Origin: The Southern Star - SDS/SDN/PDN - 504-885-5928 - (1:396/1) Msg#: 7171 *Virus Info* 09-05-90 16:06:00 (Read 4 Times) From: LONNIE DENISON To: ALL Subj: HEY Just letting you know that I have joined my board (The Maze) to this echo.. hope we can contribute some info here! Lonnie Denison --- Telegard v2.5i Standard * Origin: => The Maze <= 916-391-6118 "Would ya Believe" (1:203/60.0) Msg#: 7172 *Virus Info* 09-05-90 18:28:00 (Read 4 Times) From: PHILLIP LAIRD To: KEVIN HIGGINS Subj: REPLY TO MSG# 4969 (RE: SECURING YOUR UPLOADS) Kevin, nice batch file for testing files for virrii. I am now Alpha testing my new program that will work with TAG at present. I have the Key fake program if it will help you! That file will enter the "Y or N" Question when the batch file comes to Are you sure? Y or N. Meaning you had the batch file to delete all programs in the temp check directory. I plan on a new realease of the program to several BBSES that will work to help all Sysops keep out the Virii. If you want Keyfake Program, just Tell me, and I will netmail it to you... I had a run in with Jerusalem B [jeru] today at Lamar University. Seems the Chemistry Department stockroom manager had already infected 17 files on his hard drive. Clean removed the virus. --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 7173 *Virus Info* 09-05-90 18:30:00 (Read 5 Times) From: PHILLIP LAIRD To: PATRICIA HOFFMAN Subj: REPLY TO MSG# 4750 (JERUSALEM B AND CLEANP64.ZIP) Patti: I cleaned 17 infected files today with clean version 64. I have a good question. While the program removes the file, some where removed the first time around, others were scanned several times before the virus was actually removed. Can you tell me why? --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 7174 *Virus Info* 09-05-90 18:32:00 (Read 4 Times) From: PHILLIP LAIRD To: RICK THOMA Subj: REPLY TO MSG# 4967 (RE: PKZ120.ZIP) Didn't someone say that because someone had already hacked an earlier version of PKZIP that 120 would be the next scheduled release? Anybody have any info? --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 7175 *Virus Info* 09-05-90 18:37:00 (Read 4 Times) From: PHILLIP LAIRD To: ALL Subj: PROCOMM 3.10 Beware, there is a version of Procomm.zip going around in our area here in Texas which boasts Procomm 3.10. After consulting with my friend at Datastorn Technologies, he called my BBS and downloaded the file. I had a user complain that the file hung and said "NUKE" at the lower left of his terminal. Datastorm Technologies stated that this version doesn't exist, I.E.... the latest was 2.4.3. The same user told me that the file one night then put a message on his screen that stated "Does this IBM PC or Compatible have more than one drive? Y or N " He immediately turned off the computer and didn't answer the question. Althought we scanned this program and found no virus, we disassembled it and also didn't find anything suspicious either. Be careful, it might be a time bomb. If you know of this program, let me know at 1:19/49. I would like to keep tabs on it. --- TAGMAIL v2.20 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49) Msg#: 7176 *Virus Info* 09-04-90 16:04:00 (Read 4 Times) From: MIKE MCCUNE To: TALLEY RAGAN Subj: REPLY TO MSG# 4030 (RE: REMOVING JOSHI) I have posted a new version that checks for the virus before trying to remove it (now that I have a working copy of the virus). It will not damage the partition table on uninfected hard disks...<MM>. --- KramMail v3.15 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0) Msg#: 7177 *Virus Info* 09-04-90 13:31:00 (Read 4 Times) From: PAUL FERGUSON To: KEN DORSHIMER Subj: REPLY TO MSG# 5241 (LET ME REPHRASE THAT.....) Ken- This is a continuation of msg.# 156 (I dropped the keyboard....Looong day, you know)..... Actually, I really should have said "virtually preconceived". From what I can gather on the topic (I don't yet have a copy of 4096), they actually redirect CRC/Checksum interrogators to a "snapshot" of the original file as it appeared before infection.(Someone, I'm sure, will correct me if I'm wrong or at least add enlightenment.) The infected file, in the case of 4096, has in reality grown by 4096 bytes and would more than likely hang the system, therefore, which would lead me to believe that running the CRC check without the virus TSR would allow you to identify the actual infected files. Also, it seems like the only way to catch it TSR is to trace the interrupt vectors (although everyone seems to have a little bit of differing ideas on this '->) Until I can get my hands on this little fellow, I guess that I'll just follow the more logical explanations from the sources with credibilty and make a judgement from that! Sounds credible. But, as I'v said before- I sure would like to see it. I've been following several different message base threads on this particular virus, with input from users at the basic levels to BBS SysOps to the AntiViral research community.......I must say, it gets overwhelming at times to keep objective. *:) -Paul --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 7178 *Virus Info* 09-05-90 09:20:00 (Read 4 Times) From: PAUL FERGUSON To: EVERYONE Subj: DETAILED INFO ON 4096... The description in VSUM (August 15 release) of the 4096 virus has gotten my usual curiousity arouser, along with a plethora of discussion on this particular virus within many message conferences and viral echos......Since I have not had the opportunity, yet, to obtain a sample to personally examine, I must post a few questions to the field: 1.) Would someone like to elaborateon the structure of "Phases" that the CVIA uses to catorgorize viruses? Please? ;-) 2.) I seem to remember mention (No, I don't have my copy of VSUM in front of my now) of the virus (4096) containing it's own boot sector. Could someone enlighten me on this , also? 3.) And, under what ? circumstances does the 'FRODO LIVES' msg. appear and when does it not? No offense, Patti, but I did think that on a couple of these points that the VSUM doc was kinda sketchy (I know that is ALOT of work to compile that baby and continually update, etc.!). Perhaps with a little more detail, I will have settled my curiousity and returned to other problems at hand... -Paul Patti- Any luck with last U/L? ,-) --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 7179 *Virus Info* 09-05-90 20:34:00 (Read 5 Times) From: PATRICIA HOFFMAN To: SEAN SOMERS Subj: REPLY TO MSG# 4544 (RE: REMAPPING...) SS> Off topic here, anybody out there encounter the French Revoloution SS> virus? I was the first out here to discover it. What it does is nuke SS> your HD while displaying an anti Western/English speaking Canadians. Haven't seen or heard of that one before.... What does it infect? .COM, .EXE, overlays, boot sectors, only floppies? If you want to send me a copy of it, I'd be happy to take a look at it as well as pass it along to John McAfee's group. Snail mail address is: Patricia M. Hoffman 1556 Halford Avenue #127 Santa Clara, CA 95051 It can also be sent in a .ZIP file to my system, though be sure you don't route it thru anyone, or directly uploaded here to a suspect area that is secured. Not off-topic at all, that is what this conference is for.... Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 7180 *Virus Info* 09-05-90 20:01:00 (Read 5 Times) From: PATRICIA HOFFMAN To: PAUL FERGUSON Subj: REPLY TO MSG# 7178 (DETAILED INFO ON 4096...) PF> 1.) Would someone like to elaborateon the structure of "Phases" that PF> the CVIA uses to catorgorize viruses? Please? ;-) PF> VSUM doesn't necessarily use the McAfee or CVIA categorization techniques to classify viruses. VSUM's categorization is a bit finer than McAfee's since in many cases he can group things together for detection/removal purposes. However, in describing them they don't make much sense that way. I haven't seen a copy of the CVIA categorization in some time, but I believe they classified by: boot sector infector parasitic file infector overwriting file infector Partition table infectors were (I think) thrown in with boot sector infectors since at the time the only partition table infector was Stoned, which also infected floppy boot sectors. They also classified by memory resident or non-resident. Generally, VSUM classified by memory resident/non-resident, what it infects, file length change, symptoms, and other characteristics, as well as what virus the new entry is based on if applicable. In the case of memory resident viruses, there is a code to indicate how or where it is memory resident. McAfee and I had a loooonnnnnggggg discussion on classification and naming awhile back, and "agreed we could disagree" since how he uses the names in Scan isn't workable for VSUM, and using the VSUM naming in Scan would not serve his purposes since he needs to group variants in many cases. If possible, though, we try to use the same names. If VSUM differs, the name that will be indicated by Scan is indicated as an alias. McAfee's current classification methods as indicated in VIRLIST.TXT which comes out with Scan also differs from the CVIA classifications, and is fairly close to VSUM. PF> 2.) I seem to remember mention (No, I don't have my copy of VSUM in PF> front of my now) of the virus (4096) containing it's own boot sector. PF> Could someone enlighten me on this , also? PF> Yes, it includes a boot sector, though do to an error in the virus, the included boot sector isn't ever written to the hard disk or floppy boot sector. This boot sector is where the "FRODO LIVES" message is.... PF> 3.) And, under what ? circumstances does the 'FRODO LIVES' msg. PF> appear and when does it not? PF> Normally, due to a bug in the virus, the message is never displayed. If one copies the boot sector from within the 4096 virus to a floppy diskette as sector 0, and boots from it, the message will appear. Of course, the above bugs may be fixed in a later version of the virus....but the versions I've seen hang on September 22 when they were meant to activate the Frodo Lives message. PF> PF> No offense, Patti, but I did think that on a couple of these points PF> that the VSUM doc was kinda sketchy (I know that is ALOT of work to PF> compile that baby and continually update, etc.!). PF> Perhaps with a little more detail, I will have settled my PF> curiousity and returned to other problems at hand... PF> No problem....A lot of time what makes perfect sense to me doesn't make sense to others :-). There is always this question with VSUM on where to draw the line on the descriptions. PF> Patti- Any luck with last U/L? ,-) PF> Not yet....I'm busy working on analysing a new virus right now, and it is going to take awhile....will probably be a Whale of a tale when I get done....and I don't want to say anything prematurely on it. Patti --- QM v1.00 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0) Msg#: 7181 *Virus Info* 09-06-90 11:33:00 (Read 4 Times) From: TONY JOHNSON To: ALL Subj: REPLY TO MSG# 3029 (CORE WARS) Core Wars was a simulation system, it was not per se' a breeding ground for the type of viri that you see today attacking systems and PCs. The programs tested were called viri in the way they attacked and behaved while operating within the Core Wars environment. I believe the "arena" used for the "viruses" was an 8K memory grid, and that the programs/"viri" were limited to that area. While those programs were not the same thing as what we see today chewing up our beloved computers, I can say that Core Wars was an extremely enlightening experience that had the programmers thinking about how a similiar type of situation could apply to the actual computing world. --- QM v1.00 * Origin: The 286 Express (504-282-5817) (1:396/30.0) Msg#: 7182 *Virus Info* 09-06-90 13:09:00 (Read 5 Times) From: CHARLES HANNUM To: CHRIS BARRETT Subj: REPLY TO MSG# 7166 (RE: MYSTERY VIRUS??) >At my school we have some XT's with 2 360K FDD each. Lately we have >noticed that some of the students disks are being over written by the >program disk they were using. Eg some people have found the Turbo >pascal files on their data disks. This could happen (and has) if you are using disk caching software. That would be a good place to look first. --- ZMailQ 1.12 (QuickBBS) * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0)