NetNews Usenet Archive 1993 #1/NN_1993_1.iso/spool/comp/compress/4590

Internet Message Format | 1993-01-12 | 9.8 KB

Path: sparky!uunet!mcsun!uknet!glasgow!unix.brighton.ac.uk!amn
From: [e-mail] (Anthony Naggs)
Newsgroups: comp.compression
Subject: Re: pkzip204c--virus activity?
Keywords: virus, stealth virus
Message-ID: <[e-mail]>
Date: 12 Jan 93 04:43:59 GMT
References: <[e-mail]>
Reply-To: [e-mail]
Followup-To: [e-mail]
Organization: University of Brighton, UK
Lines: 230

I have tried to edit excess from the previous post, while keeping most
of the context.  If anything is unclear check Mark's original post yesterday.

Sorry folks about the bandwidth/inappropriate newsgroup (?), I am posting
this for the educational value!  (Also I have directed followups to me,
to save filling comp.compression with virus related discussions).


Beware, this is a worst case (IMO) interpretation of the evidence.
Also I have tried to make comments helpful to other readers, if I seem
a little rude it is due to my efforts to warn/educate and also that I
am writing this at an ungodly hour of the day.


Mark Achtemeier <[e-mail]> reports:
> AN ANOMALOUS INCIDENT INVOLVING PKZIP 2.04C
>
> The following is a report of an incident of virus-like activity which
> appeared recently on my system, possibly in connection with the use
> of the new version 2.04c of PKZIP.  ...

This is unlikely to be infected at this stage.


> ... I am recording the
> events as accurately and completely as I possibly can so that others
> can be on the lookout for similar phenomena.

Thanks, it helps.


> I FTP'd the file ... [details deleted]
>
> On the public terminal, I ran pkz204c.exe to extract the various
> program and documentation files, ...

Because pkz204c.exe is a self extracting program, rather than a ZIP
file :-), any TSR virus on the public PC could infect the file at 3 points:
1.  Running pkz204c.exe, most TSR viruses infect programs when they are
    loaded by DOS to run.
2.  Access to the file to copy it.
3.  Access to the file by SCAN.

<No sermon in clean booting public PCs, but folks please remember, huh?>

> ... I ran the 'scan.exe' program in McAfee
> Associates' SCAN 8.6V93 package on both the original and the extracted
> archive files.  ...

I don't use SCAN, but I think the latest is V99.


> On my own system, ...   ... I executed my standard batch file
> (hereafter called the "standard scan") for running the McAfee scan
> program--I had used the /AF option some months earlier to create a
> file (called scanval.val, located on the c: drive) of validation codes
> for my program, *.sys and *.ovl files.  My standard scan batch file
> runs SCAN with the /CF option, checking these validation codes against
> the appropriate files on the disk.  ...

WARNING: "stealth viruses" are TSR viruses that sit around in memory.
    When it sees DOS functions to open a program file to read it (for copying
    or running) it first removes the virus from the file, when the is closed
    the virus re-infects it, also fiddling with directory listings so the
    size is correct.

    ** This means that any new stealth virus that your a-v s/w does recognise
    in memory can fool 'checksumming' a-v methods (eg SCAN /CF).  For
    reliability always keep the s/w & checksum/validation information on
    diskette & do a 'clean boot' before using it.


> ...   I then executed a
> standard batch file which calls PKZIP three times in order to back up
> three different directory trees onto a floppy disk.
>
> The job ran successfully, and again, I was delighted with the speed of
> the new version of PKZIP.

You backed up ALL the directories that showed up as having infected '.OVL'
files, yes?

> Wanting to be on the safe side, I then decided to do a final run of
> the standard scan.  This scan was done immediately after the PKZIP
> batch job, with no other programs run in the interim. This time, to my
> horror, the program produced alarms for my MSDOS.SYS file, along with
> every file on my disk containing and extension of '.OVL'.  No other
> files were affected.

Viruses do not spread on '.OVL' files, simply because they do not travel
often!  But viruses can infect them.

You must have had a 'stealth virus' either already on your system, or
brought in from the public pool.  When pkzip read the '.OVL' (also EXE & COM)
files the stealth virus recognised them as being program files & infected
them when they were closed.

"But why did only the '.OVL' files show as infected?"

Simple, the virus has a bug.  It uses different tests when infecting to
when it removes itself from files, it managed to hide when SCAN checked
the EXE & COM files but forgot to on the '.OVL' files!


> ... [planning omitted] ...

> The next morning, I executed a boot from power-off of the write-
> protected floppy disk.  ...
> ...  I then .. delete[d] the MSDOS.SYS and IO.SYS
> files (which I replace using the DOS 'sys' command) and also to
> overwrite all of the .OVL files with the clean versions.
>
> Having finished this procedure, I powered off the system and did a
> reboot from the c: drive.  I immediately ran the standard scan, and
> was puzzled to find that while the number of alarms had decreased, a
> number were still reported.  ...

Either you accidentally ran an infected utility from the hard drive
(very easy to do, especially as you thought only the '.OVL' files were
infected) or your 'clean boot disk' wasn't.

It really is incredibly easy to run a utility from the hard drive when
you wanted too use the one on the floppy, I have done it myself when
cleaning up viruses - we all have to learn the pitfalls.


[Don't shout!]  "What about the decrease?"

You accidentally infected the system, and when SCAN ran the virus infected
files, using a 'lucky number' system to choose files to infect.


> {On two occasions during all this--I am fuzzy on just when they were--
> I also noted that an attempt to run a program contained on my utility
> floppy produced an error message of "Write protect error: unable to
> write to floppy disk" or something to that effect.  This struck me as
> highly unusual, since nothing in the command or program involved
> should have called for a write to the diskette.}

This should cause virus aware people to be very worried!
(I know, most people just say "that's strange" and forget about it

Note: most viruses detect such problems and the DOS message is not given,
    so this is not a reliable detection method.  But if it does happen,
    try to:
    1.  prepare a floppy on another machine, with similar utilies or
        some from DOS;
    2.  write protect it;
    3.  use it on the suspect PC;
    4.  when you get a "write protect error" message, then remove the
        write protect, select 'Retry', now you have a 99% chance of
        capturing a sample of the virus, write protect the disk again.
    5.  either send the captured virus to you preferred a-v researcher,
        or find an a-v package that will identify the virus.


> Thinking that perhaps the files from my home system were infected, I
> .. run a comparison between the .. uninfected files on the floppy disk
> and the which were still producing alarms on the c: drive.  The
> comparison, to my bewilderment, showed that the MSDOS.SYS and overlay
> files in question were, in fact, different from their source files on
> the floppy which I had copied onto the c: drive a few moments earlier.

You rebooted before this, yes?  Okay, this -strongly- indicates a stealth
virus, and that you ran an infected file previously.


> In desperation I did a final run of the standard scan.  This time it
> produced *more* alarms ...

Supports the active virus/'lucky number' theory of infecting.


> At this point I panicked and decided that drastic action was called
> for. ...  [details of complete re-install omitted]
> ...  I did scans (with new validation files) throughout the
> process and have not encountered any virus alarms since.

You had a -new- 'stealth' virus, it may not show up with SCAN /CF, until
it accidentally infects an '.OVL' file again.

Be cautious, get the latest version of SCAN (as this is your favourite) and
also another good a-v tool (I suggest FPROT [2.06a is the latest], available
from SIMTEL20:  pd1:<msdos.trojan-pro>).

Hopefully the virus came from the public pool and you are now clear,
although an existing 'stealth' virus infection would not have been
obvious - so there is a small possibility of your backups being infected.


> A puzzling final note:  I have since had the opportunity to examine
> the copies of the infected files which I had copied to floppy disk.
> Compares run against uninfected versions of the same files on my home
> system reveals no difference between the files ...

I can't explain this, perhaps you were confused and copied the repaired files?

Send me a 'Diskcopy' of the disk and I'll check it further for you, (if the
newer a-v s/w doesn't find anything).


> ... [questions about the above strange symptoms] ...

I hope I have explained most of the strange symptoms, if you want
clarification just ask.


> I have available for the asking:  copies of the now mysteriously
> intact files which were copied from the infected c: drive onto floppy.
> Copies of the original pkz204c.exe file which started this whole
> incident (maybe!) to begin with.

Send me a 'Diskcopy' of the disk and I'll check it further for you, (if the
newer a-v s/w doesn't find anything).


Other people to consider sending disk/files to:
1.  The vendor of your preferred a-v product - McAfee
2.  Vesselin Bontchev, email: [e-mail]
3.  Frisk (author of FPROT): [e-mail]
Or ask advice from Ken van Wyk the moderator of comp.virus/virus-l:
    [e-mail]


Hope this helps,
Anthony Naggs
Software/Electronics Engineer                   P O Box 1080, Peacehaven
(and virus researcher)                          East Sussex  BN10 8PZ
Phone: [phone]                           Great Britain
Email: (c/o Univ of Brighton) [e-mail]  or  [e-mail]