Hacker Chronicles 2 (Alt)/The_Hacker_Chronicles_Volume_II-CD2.iso/virusl2/virusl2.182

Text File | 1995-01-03 | 8.7 KB | 214 lines

VIRUS-L Digest   Tuesday, 29 Aug 1989    Volume 2 : Issue 182

VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a non-digested Usenet counterpart.
Discussions are not limited to any one hardware/software platform -
diversity is welcomed.  Contributions should be relevant, concise,
polite, etc., and sent to [e-mail] (that's
LEHIIBM1.BITNET for BITNET folks).  Information on accessing
anti-virus, document, and back-issue archives is distributed
periodically on the list.  Administrative mail (comments, suggestions,
and so forth) should be sent to me at: [e-mail].
 - Ken van Wyk

Today's Topics:

Suggestion for "Ultimate Virus"
Re: Destructive virus...
Re: NEW VIRUS DICOVERED AND DISASSEMBLED
Re: Destructive virus...
List of viruses
Antidotes for the DATACRIME family (PC)
New PC Virus
Re: (Hardware) Destructive Virus (Story)

---------------------------------------------------------------------------

Date:    26 Aug 89 05:37:36 +0000
From:    [e-mail] (Ari Halberstadt)
Subject: Suggestion for "Ultimate Virus"

Hello everyone,

I've been thinking lately of how to write the ultimate virus, one
that would be very hard to identify with pattern matching
techniques, though perhaps single stepping through it would
work. At any rate, if my ideas are good [for the viruses, not
users], I do not want to post them to the world at large. I was
wondering who is a trusted expert on the subject who would
be interested in hearing my ideas?

I've never written a virus, and I do not intend to write one.
If I ever felt foolish enough to do so, it would be a benign
experiment -- though it may fill up the disk. This is simply
a theoretical exercise. Part of the value of dreaming up
an ultimate virus is being a step ahead of the virus
makers: if we know where they're going, we can beat them
to it.

- -- Ari Halberstadt '91, "Long live succinct signatures"
E-mail: [e-mail]       Tel: [phone]
Disclaimer: "Live Free or Die"

[Ed. I wonder if that's what RTM thought...]

------------------------------

Date:    25 Aug 89 16:53:27 +0000
From:    ucrmath!proton!muon![e-mail] (Michael Baumann)
Subject: Re: Destructive virus...


In article <[e-mail]> [e-mail] (David
 Gursky) writes:
>Does anyone on the list have some information about an alleged virus that
>caused monitors on either older PCs, Ataris, or Amigas (I forgot which plat-
>form was susceptible) to self-destruct?  We were discussing this nasty over
>lunch the other day and are interested in finding out more.

I believe that you are thinking of the older PC, with the original
IBM Mono adaptor. It is possible in software to shut off the sync signal,
and in the original mono monitor, this meant that DC was applied to the
flyback transformer. POOF.


- -----------------------------------------------------------------------------
Radiation Research Lab          |Internet: [e-mail]
Loma Linda Universtiy Medical Center |        UUCP: ...ucrmath!proton!baumann
Loma Linda, California. [phone]|

------------------------------

Date:    Sun, 27 Aug 89 08:33:09 -0400
From:    corpane!disk![e-mail] (Jim Sewell)
Subject: Re: NEW VIRUS DICOVERED AND DISASSEMBLED

Regarding the name VACSINA:

        Vaccine makes no sense as a name for a virus unless it was to be
passed off as a vaccine.  This program doesn't sound as if it was meant to
fool people with that ruse so I suggest that perhaps the name has nothing
to do with vaccines.  Perhaps it is the Dec VAX or Vacation or Vaccuum as
opposed to vaccine.  Just a thought.
                Jim

------------------------------

Date:    25 Aug 89 09:03:25 +0000
From:    Sam Wilson <[e-mail]>
Subject: Re: Destructive virus...


In article <[e-mail]> [e-mail] (David
 Gursky) writes:
>Does anyone on the list have some information about an alleged virus that
>caused monitors on either older PCs, Ataris, or Amigas (I forgot which plat-
>form was susceptible) to self-destruct?

I don't know of any virus which does this but a couple of years ago I
recall being told about a screen saver for the PC which assumed you were
using an {IBM|Hercules} controller.  It worked by directly writing to
the registers of the controller chip.  When you used it with a
{Hercules|IBM} card the the controller was different and the values
poked into the registers caused the controller to run at some strange
scan rate which occasionally caused the monitor and/or the driver
hardware on the controller card to burst into flames.

Sam Wilson
Edinburgh University Computing Service, Scotland
- ----------
"What we really need ....

... is a piece of software that actually makes a computer blow up just
like in the movies...."


------------------------------

Date:    Mon, 28 Aug 89 12:19:00 -0500
From:    Craig Minton <[e-mail]>
Subject: List of viruses

If someone is keeping a list of all of the viruses that have been
talked about on this list, I would appreciate it if he/she would
send me a list of them in message format.  If you don't have
them all, I would appreciate what you have.  I am trying get a
compilation of them for later reference, etc.  I need it to
say what the virus is, what it does, how it works, and possible
remedies.  I particularly like the format that was used when
the swapping virus was reported.  Thanks for any help.
                .....Craig.....

------------------------------

Date:    Mon, 28 Aug 89 13:45:10 -0700
From:    [e-mail] (Christina Fu)
Subject: Antidotes for the DATACRIME family (PC)

    Recently, I have had a chance to investigate the 1280, 1168 and
DATACRIME II viruses, and found some interesting differences between
the first two versions and DATACRIME II.  As a result, I have
developed an antidote for both 1280 and 1168, and an antidote for the
DATACRIME II.  Among the differences between these viruses, the most
significant one for developing antidotes is that the DATACRIME II
virus generates a mutually exclusive signature set than the other two.
Because of the said difference, the antidote for the 1280 and 1168
becomes a de-antidote for the DATACRIME II, and vice versa.  Which
means, if a file is infected with either 1280 or 1168, it is still
vulnerable of contracting DATACRIME II, and vice versa (this situation
does not exist between 1280 and 1168, however).  If we view these
viruses as two different strains, then these antidotes make more
sense, otherwise, they can be useless.

    Another interesting thing is that the DATACRIME II purposely
avoids infecting files with a "b" as the second character in the name
(such as IBMBIO.COM and IBMDOS.COM), while the other two avoids to
infect files with a "d" as the seventh character in the name (such as
COMMAND.COM), and aside from that, the DATACRIME II virus can also
infect EXE files, unlike the other two.

    I am looking into providing them to the public free of charge (I
do not claim responsibility or ask for donation).  Any interested
archive sites please let me know.

    By the way, I need a sample disclaimer for programs distributed in
this manner.


------------------------------

Date:    Mon, 28 Aug 89 21:10:56 -0700
From:    portal!cup.portal.com![e-mail]
Subject: New PC Virus

    A new PC virus has been turned over to the CVIA by RAP Systems of
San Bruno, CA.  RAP Systems discovered the virus at one of their
Northern California client sites on August 17.  The virus infects COM
and EXE files (with the exception of COMMAND.COM) and increases their
size by exactly 2500 bytes.  The virus seems to have an activation
date of Friday 13, and when activated, it destroys both executable and
data files in a seemingly random fashion.
    Of interest is the fact that the infected client was also infected
with the Jerusalem Virus version B.  Both viruses appeared able to
infect the same files.
    The virus has been temporarily dubbed the RAP virus.  More info.
will be reported as we take it apart.
Alan

------------------------------

Date:    29 Aug 89 09:09:22 +0000
From:    [e-mail] (Kelly Goen)
Subject: Re: (Hardware) Destructive Virus (Story)

p.s. I did in fact accidentally test the code to destruction...sigh I
didnt beleive at the time that the design could be so abysymally
stupid and managed to burn out my monitor at the time!! thoroughly
embarrassing!!

------------------------------

End of VIRUS-L Digest
*********************
Downloaded From P-80 International Information Systems 304-744-2253