NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/comp/compress/4543

Internet Message Format | 1993-01-10 | 8.4 KB

Path: sparky!uunet!gatech!concert!duke!news.duke.edu!acpub.duke.edu!machteme
From: [e-mail] (Mark Achtemeier)
Newsgroups: comp.compression
Subject: pkzip204c--virus activity?
Message-ID: <[e-mail]>
Date: 11 Jan 93 03:34:03 GMT
Sender: [e-mail]
Organization: Duke University; Durham, N.C.
Lines: 150
Nntp-Posting-Host: raphael.acpub.duke.edu

AN ANOMALOUS INCIDENT INVOLVING PKZIP 2.04C

The following is a report of an incident of virus-like activity which
appeared recently on my system, possibly in connection with the use
of the new version 2.04c of PKZIP.  I confess that I do not understand
how all the pieces of the puzzle fit together, but I am recording the
events as accurately and completely as I possibly can so that others
can be on the lookout for similar phenomena.

I FTP'd the file 'pkz204c.exe' from the archive at garbo.uwasa.fi on
the Internet at approx. 2:00pm est on Thursday, January 7.  The file
was copied first to my storage area on the DEC terminals at Duke
University, and from their FTP'd to an IBM compatible terminal on a
public cluster in the Duke library.  The public terminal had been
turned on when I began to use it, but its associated directories
showed no files present.

On the public terminal, I ran pkz204c.exe to extract the various
program and documentation files, consulted these and ran some tests
comparing the performance of the new version against PKZIP 1.1 (I was
delighted, I might add, with the performance of the new product!)
Since I had read the discussion about the "maltese amoeba" alarms
associated with this program, I ran the 'scan.exe' program in McAfee
Associates' SCAN 8.6V93 package on both the original and the extracted
archive files.  The program reported no viruses found.

I copied the main archive file to a floppy disk and took it to my
office for installation on my office computer--a Zeos 286-12 with a 42
meg IDE drive, running MSDOS 3.3.

On my own system, I copied the original archive file to a temporary
directory.  Before extracting it, I executed my standard batch file
(hereafter called the "standard scan") for running the McAfee scan
program--I had used the /AF option some months earlier to create a
file (called scanval.val, located on the c: drive) of validation codes
for my program, *.sys and *.ovl files.  My standard scan batch file
runs SCAN with the /CF option, checking these validation codes against
the appropriate files on the disk.  This first run of the standard
scan produced one alarm: for a file entitled DESKTOP.OVL associated
with my PCTOOLS 5.0 package.  While it concerned me at the time, I
have since discovered that this file is written to every time the
PCTOOLS DESKTOP program is run in resident mode.  Since I had in fact
done this after creating the file of validation codes, I have no
reason to believe this file was infected at that time.

My next step was to execute the pkz014c.exe program in my c:\temp
directory in order to extract the program files from the archive.  All
of the files produced -AV validation codes.  Again I ran a standard
scan, which continued to produce a single alarm for DESKTOP.OVL.

Satisfied that the program was virus-free, I proceeded to rename the
old verisons of PKZIP and PKZIP in my utilities directory, and to copy
the new versions of these programs into it.  I then executed a
standard batch file which calls PKZIP three times in order to back up
three different directory trees onto a floppy disk.

The job ran successfully, and again, I was delighted with the speed of
the new version of PKZIP.

Wanting to be on the safe side, I then decided to do a final run of
the standard scan.  This scan was done immediately after the PKZIP
batch job, with no other programs run in the interim. This time, to my
horror, the program produced alarms for my MSDOS.SYS file, along with
every file on my disk containing and extension of '.OVL'.  No other
files were affected.  The overlay files, approximately twelve in all,
resided in three separate directories on my c: drive.  The alarms
simply said: "File has been modified, a virus infection may have
occurred".  No indication of the identity of the virus was given, nor
did the program's memory scans pick up anything.  I had to leave my
system for the day at this point, since the library where my office is
located was closing.

That evening I spent some time plotting strategy for ridding my system
of what I assumed was an infection.  I determined that I would prepare
a write-protected, bootable floppy disk on my home system, containing
uninfected copies of the overlay and MSDOS.SYS files, which I would
use to replace the damaged files.

The next morning, I executed a boot from power-off of the write-
protected floppy disk.  I had set up the floppy to install a new
versions of the PCTOOLS SHELL utility to a temporary directory on the
c: drive.  I then used this utility to delete the MSDOS.SYS and IO.SYS
files (which I replace using the DOS 'sys' command) and also to
overwrite all of the .OVL files with the clean versions.

Having finished this procedure, I powered off the system and did a
reboot from the c: drive.  I immediately ran the standard scan, and
was puzzled to find that while the number of alarms had decreased, a
number were still reported.  The MSDOS.SYS file still registered as
corrupt, along with three or four of the .OVL files.  After puzzling
over this awhile, I tried repeating the procedure of powering down the
system, booting from the floppy, deleting the old files and replacing
them with with the uninfected versions.  A subsequent run of the
standard scan continued to produce alarms.

{On two occasions during all this--I am fuzzy on just when they were--
I also noted that an attempt to run a program contained on my utility
floppy produced an error message of "Write protect error: unable to
write to floppy disk" or something to that effect.  This struck me as
highly unusual, since nothing in the command or program involved
should have called for a write to the diskette.}

Thinking that perhaps the files from my home system were infected, I
used the temporary version of PCTOOLS on the c: drive to run a
comparison between the supposedly uninfected files on the floppy disk
and the which were still producing alarms on the c: drive.  The
comparison, to my bewilderment, showed that the MSDOS.SYS and overlay
files in question were, in fact, different from their source files on
the floppy which I had copied onto the c: drive a few moments earlier.

In desperation I did a final run of the standard scan.  This time it
produced *more* alarms--still not for all the overlay files on the
disk, but for more than had been reported in the run immediately
preceeding it.
At this point I panicked and decided that drastic action was called
for.  I used PCTOOLS to make copies of the infected MSDOS.SYS and
*.OVL file on a clean floppy for future reference.  Alas, I did not
think to examine them closely at the time.  I then did a power-off
boot from my write-protected, utility floppy, and used FDISK to delete
all of my drive partitions.  I proceeded to set up the disk from
scratch, installing a new operating system (DRDOS 6) which I had been
meaning to do for some time anyway, and restoring my program and data
files from a set of backups which (fortunately) I had done only a few
days before.  I did scans (with new validation files) throughout the
process and have not encountered any virus alarms since.

A puzzling final note:  I have since had the opportunity to examine
the copies of the infected files which I had copied to floppy disk.
Compares run against uninfected versions of the same files on my home
system reveals no difference between the files--this in spite of the
fact that the differences were clearly evident when they resided on
the c: drive.

If this is a case of virus infestation, there are a lot of aspects of
it I don't understand--like how a virus could turn up active in a
system booted from a clean, write-protected floppy, for starters.  The
temptation for me has been to leave out various details from the
account in order to make the emergent picture a clearer one.  I have
decided, though, that everyone's best interest will be served by as
complete and accurate an account as possible, and this is what I have
struggled to provide.

I have available for the asking:  copies of the now mysteriously
intact files which were copied from the infected c: drive onto floppy.
Copies of the original pkz204c.exe file which started this whole
incident (maybe!) to begin with.

P. Mark Achtemeier
Duke University
[e-mail]