Hacker Chronicles 2 (Alt)/The_Hacker_Chronicles_Volume_II-CD2.iso/virusl2/virusl2.227

Text File | 1995-01-03 | 12.6 KB | 309 lines

VIRUS-L Digest   Tuesday, 31 Oct 1989    Volume 2 : Issue 227

VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a non-digested Usenet counterpart.
Discussions are not limited to any one hardware/software platform -
diversity is welcomed.  Contributions should be relevant, concise,
polite, etc., and sent to [e-mail] (that's
LEHIIBM1.BITNET for BITNET folks).  Information on accessing
anti-virus, document, and back-issue archives is distributed
periodically on the list.  Administrative mail (comments, suggestions,
and so forth) should be sent to me at: [e-mail].
 - Ken van Wyk

Today's Topics:

Re: Virus scanners
Re: Virus source available in Toronto
RE: BootChek (possible virus) (PC)
Re: MacDraw II 1.1/GateKeeper 1.1 problems (Mac)
Re: Another suggestion for preventing viral spread (PC)
stoned removal? (PC)
Re: Macintoch MacWrite, STR 801 (Mac)
Free catalog disk update
Yale/Alameda & Stoned Viruses (PC)

---------------------------------------------------------------------------

Date:    Mon, 30 Oct 89 16:32:39 +0000
From:    yale!slb-sdr!sdr.slb![e-mail] (Jeff Shulman)
Subject: Re: Virus scanners

portal!cup.portal.com![e-mail] writes:

>My point about "How good are scanning programs" is mainly that if the
>program uses well-chosen search strings it can be more effective than
>I, at least, initially expected.  Several scanning programs for the
>Macintosh relied only on resource names (resources include program
>code on the Mac).  These resource names, such as nVIR, are very easily
>and quickly changed to hPat or anything else, completely defeating the
>scanning program.

>Charles M. Preston                     MCI Mail 214-1369
>Information Integrity                  BIX cpreston
>Box 240027                             907-344-5164
>Anchorage, AK 99524

Very true.  Which is why the scanning strings in VirusDetective(TM)
are (1) resource type/ID independent (for all the Mac viruses) and (2)
*user* configurable [but the GIGO rule applies: Use invalid search
strings and you will get invalid results].

Plug:

VirusBlockade(TM) II Ltd. has just been released by me (along with VD
3.1) which, among other things, allows you to scan floppies in
background (when used with VD 3.1) when they are inserted WITHOUT
having to have VD open.  [VB II Ltd. is a DEMO of VB II which does
everything except save any configuration changes to disk]

                                   Jeff Shulman
                                   VirusDetective & VirusBlockade author
- --
uucp:      ...rutgers!yale!slb-sdr!shulman
CSNet:     [e-mail]
Delphi:    JEFFS
GEnie:     KILROY
CIS:       76136,667
AppleLink: KILROY

------------------------------

Date:    30 Oct 89 17:04:03 +0000
From:    [e-mail] (Kelly Goen)
Subject: Re: Virus source available in Toronto

Yes it is indeed true that viral sources are published in several
areas... however "Viruses , A high Tech disease" published only
overwriting viruses!! more similar to a logic bomb as when they infect
the target executable the file is immediately destroyed(VERY EASY to
detect) by the overwriting process. However any COMPETANT Assembly
coder can manufacture far more unobtrusive viruses if he just thinks
about it!! the published sources working or non working are really not
that much of a threat...
            cheers from the front lines!!
             kelly/silly CON Valley!!

------------------------------

Date:    Mon, 30 Oct 89 10:15:39 -0500
From:    Arthur Gutowski <[e-mail]>
Subject: RE: BootChek (possible virus) (PC)

In Virus-L Digest v2, i226, Jeffrey Perry expressed some concern about
his copy of BootChek that he is running.  I sent him a note asking him
to send me the copy of the program he is running now, the corrupt.hex
files, and the copy of the boot sector generated by BootChek.  Since
ViruScan and other products have failed to find anything, I doubt it
is a virus that infected him (although it is possible a new nasty has
surfaced :-( ... Thus my interest in the corrupted boot sector files).
I can only make the assumption for the time being that the program is
bugged.  I am looking into the matter, and if in fact there is a bug
in the program, a version update will be released with the fix and
posted via Jim Wright's antiviral archives.

I also asked him to take some measures in re-running the program in a
(relatively) guaranteed clean environment.  Hopefully, these tests will
show that there isn't yet another new virus out there.

I will post an update when more info is available.

Arthur Gutowski,
Co-author of BootChek

+--------------------------------------------------------------------+
| Arthur J. Gutowski, Student Assistant                              |
| Antiviral Group / Tech Support / WSU University Computing Center   |
| 5925 Woodward; Detroit MI  48202; PH#: [phone]              |
| Bitnet: AGUTOWS@WAYNEST1   Internet: [e-mail]       |
+====================================================================+
| Rules to live by, #153:                                            |
|     Never get caught on the wrong side of a Doppler shift.         |
+--------------------------------------------------------------------+

------------------------------

Date:    30 Oct 89 17:04:46 +0000
From:    ut-emx![e-mail] (Chris Johnson)
Subject: Re: MacDraw II 1.1/GateKeeper 1.1 problems (Mac)

In article <[e-mail]> [e-mail] w
rites:
>Question: Does GateKeeper 1.1 have problems with MacDraw 1.1? Our
(stuff deleted)
>                      Travis Butler at [e-mail]

The answer is that GateKeeper 1.1 is making the problem apparent -
it's not at all clear whether the problem is a very obscure bug in
GateKeeper (and it would have to be obscure since so few pieces of
software demonstrate this problem) or a bug in MacDraw.  I've been
working with Ken Walters at Claris for some time now, and we haven't
reached any useful conclusions as yet.

There are other packages that demonstrate related problems.  They
include MacWrite 1.x and Claris CAD, and a few programs from other
vendors, as well.

The solution (after a fashion) is to use version 1.1.1 of GateKeeper.
Although the problem remains, 1.1.1 can be warned about programs that
suffer from the problem.  Thus warned, GateKeeper avoids the
situations that give rise to the problem.

There are a number of other good reasons to upgrade to 1.1.1, so consider
the upgrade *highly* recommended.

- ----Chris (Johnson)
- [e-mail]
- ----Author of Gatekeeper

------------------------------

Date:    30 Oct 89 17:37:56 +0000
From:    [e-mail] (Kelly Goen)
Subject: Re: Another suggestion for preventing viral spread (PC)

 Sorry close but no cigar... OBJ files are even easier for a viral
writer to manipulate... the format is EXTREMELY well document...  how
do I know??? simply I have written a few linkers!! its quite trivial
to cause a OBJ type virus to repropagate!! I suggest if you are
interested further check out the MS-DOS encyclopedia!! from microsoft
press!!
    cheers
    kelly

------------------------------

Date:    Mon, 30 Oct 89 13:18:15 -0500
From:    [e-mail] (Howard Betel)
Subject: stoned removal? (PC)

I have a friend that has recently been hit by the stoned virus.  His
question quite simply is whether there is anyway to eradicate the virus
without having to do a low level format.  After the low level, is there
anything else he should be worried about?

If no files are involved in your answer could you please mail him at:
[e-mail] or if there are files involved please respond
to me so I can grab them for him.

Thanks for any help you can give, I think he's almost around the bend.  :-0

- --
Howard Betel                                    [e-mail]
Dept of Computer Science                     ...!unet!utai!utgpu!maccs!howard
McMaster University

------------------------------

Date:    30 Oct 89 22:29:42 +0000
From:    ut-emx![e-mail] (Chris Johnson)
Subject: Re: Macintoch MacWrite, STR 801 (Mac)

In article <[e-mail]> JS05STAF%MIAMIU.BITNET@VMA.
CC.CMU.EDU (Joe Simpson) writes:
>I'm unclear about the STR 801 discussion.  Let me tell a little story
>to see if I can further confuse things.
>
>About 4 months ago a client reported that MacWrite was growing in file
>size on a public Mac.  I checked to see that VACCINE was turned on.
>I ran Disinfectant 1.2.  A clean machine.
>
>I then ran ResEdit to look at the MacWrite file.  There were a large
>number of STR 801 resources.  The program was adding STR 801 resources
>at some unknown interval.
>
>I replacedthe file with a fresh copy of MacWrite and the problem disappeared.
>
>I put it down to normal computer miseries and not a computer virus.

You were right to assume that it was just normal "miseries".  Ken Walters
at Claris recently mentioned that they've received reports of this problem
in the past with version 5.x of MacWrite (possibly earlier versions, too -
I didn't get all the details on which versions).  They don't worry about
it, though, because they now put out MacWrite II which doesn't have this
problem, so, as far as they're concerned, the bug is "fixed".  :-)

And, when you consider it, it would be a pretty simple mistake to
make...  all that's required is for someone to forget to do a
UseResFile() at the right time (just before the AddResource() call is
made), and the STR 801 could go into any of the currently open
resource files, including MacWrite's own file.

So, it doesn't sound like there's anything to be concerned about.

- ----Chris (Johnson)
- [e-mail]
- ----Author of Gatekeeper

------------------------------

Date:    Mon, 30 Oct 89 18:30:00 -0500
From:    IA96000 <[e-mail]>
Subject: Free catalog disk update

Regarding the xxx catalog disk mentioned last week. here is an update.
the three infected files were uploaded to homebase for evaluation by
the experts there. one of the files cl.com was a hidden file and
would not be seen just by doing a dir command.

the company was contacted, (the phone was answered by a kid who yelled
out, "hey daddy it's for you"),and the responsible party was informed
that the disk received had three viruses on it.

his reply, and i quote was "that is impossible, i wrote the all of the
programs on the free catalog disk." he then proceeded to ask why he
would include a virus. an attempt was made to explain that the infected
programs were shareware used by batch files on the catalog disk.

he was not at aLL INTERESTED IN HEARING ABOUT THE PROBLEM AND RATHER
RUDELY SLAMMED THE PHONE DOWN, AFTER UTTERING A FEW CHOICE WORDS.

TO REITERATE, THIS DISK WAS received in response to a "bingo card"
request from the back of one of the major computer magazines. the
ad offered a free disk containing a catalog of shareware and other
software sold by the xxx company in hesperia, california.

the disk label appears as follows:

                        1989 xxx catalog
                     **********************
                  p.o. xxxx hesperia, ca 92345
                may view or print catalog & orderform
                   to start catalog . . . a>start

the company name and post office box number have been replaced by
x's to avoid any legal problems.

on the disk there is the root directory and a subdirectory named
\ord. in the root directory two files are infected. cl.com is the
hidden file in the root which is infected. in the \ord directory
a file is also infected.

other than that i am at a loss. attempts to speak to the company
have failed, so i guess it will take a complaint to the editor
of the magazine where the ad appeared.

------------------------------

Date:    Mon, 30 Oct 89 18:45:54 -0500
From:    Tom Luthman <[e-mail]>
Subject: Yale/Alameda & Stoned Viruses (PC)

   Here in the PC labs at UGA we've been having outbreaks of what
Scanv45 calls the Yale/Alameda virus in the boot sector.
   What does this virus do and how dangerous is it?

   Also, one user found a "stoned" virus on his hard drive.

   Are there removal programs available for either or both of these?
And how can we get 'em?
              Thanks...

                      --- Tom Luthman (st9 @ uga)

------------------------------

End of VIRUS-L Digest
*********************
Downloaded From P-80 International Information Systems 304-744-2253