Hackers Underworld 2: Forbidden Knowledge/Hackers Underworld 2: Forbidden Knowledge.iso/VIRUS/VI900906.TXT

Text File | 1990-11-23 | 188KB | 5,239 lines

Msg#: 2473 *Virus Info*
08-19-90 09:46:00 (Read 11 Times)
From: PATRICIA HOFFMAN
  To: KEN DORSHIMER
Subj: RE: CRC CHECKING
 <KD>the deal is that the invading program would have to know how the CRC
 <KD>your
 <KD>program uses works. otherwise it would have a (bytes changed!/bytes in
 <KD>file!)
 <KD>chance of succeeding, or somewhere in that neighborhood...
 <KD>

Except in the case of Stealth Viruses....CRC checking doesn't work with them.

Patti


--- msged 1.99S ZTC
 * Origin: Sir Dep's Dungeon 714-740-1130 Adult Links Network (1:103/158)




Msg#: 2474 *Virus Info*
08-19-90 09:50:00 (Read 9 Times)
From: PATRICIA HOFFMAN
  To: SHEA TISDALE
Subj: FILE ECHO?
 <ST>Hey, what happened to connecting my system to the file echo?
 <ST>
 <ST>I have sent numerous netmail messages to you since you sent the info
 <ST>on setting it up and have not had a reply yet.

Recheck your netmail, I sent a reply after receiving the message "What is
Tick?" indicating that you need to be running Tick in order to be able to
participate in the file echo since that is how the files are processed and
extra files go with the .zip files that carry the description.  Tick is
available from most SDS nodes.

Patti


--- msged 1.99S ZTC
 * Origin: Sir Dep's Dungeon 714-740-1130 Adult Links Network (1:103/158)




Msg#: 2475 *Virus Info*
08-16-90 11:56:00 (Read 8 Times)
From: MIKE DURKIN
  To: WARREN ANDERSON
Subj: RE: INTERNET WORM
> I am interested in obtaining the list of passwords used by the
> Internet worm in the US. I am the administrator of several

The list is in the McAfee/Haynes book ("computer viruses,
worms...threats to your system") (pgs 89-91)...
I'll type it in for you if you can't find the book locally...

     Mike

--- RBBSMail 17.3A
 * Origin: The TeleSoft RBBS (RBBS 1:143/204)




Msg#: 2476 *Virus Info*
08-19-90 14:51:00 (Read 9 Times)
From: MIKE DURKIN
  To: JAMES DICK
Subj: REPLY TO MSG# 2473 (RE: CRC CHECKING)
> You might want to take a look at McAfee's FSHLD*.ZIP.   This is a new
> anti-virus program from the creator of SCAN that is designed
> specifically for developers.   It will build a 'shield' into an
> application such that the application _cannot_ be infected and if it
> does become infected, will remove that infection after execution but
> prior to running. You will find it in the virus scanners area of many

Jim... this is a little mis-leading... all programs will become infected
but FSHLD will remove it for most viruses.. for viruses like 4096, FSHLD
won't remove or even know/announce that the file is infected...

When FSHLD can remove a virus, 'after execution but before running'
really makes no difference since a resident virus will still go TSR and
a direct action virus will still do it's infecting of other programs...

But all things considered...  I definately agree that FSHLD is a must
have...

      Mike

--- RBBSMail 17.3A
 * Origin: The TeleSoft RBBS (RBBS 1:143/204)




Msg#: 2477 *Virus Info*
08-20-90 04:44:00 (Read 8 Times)
From: KEN DORSHIMER
  To: PATRICIA HOFFMAN
Subj: RE: SCANV66B RELEASED

 On 19-Aug-90 with bulging eyes and flailing arms Patricia Hoffman said:

 <KD>>does this mean i should erase the old scanv66 that i just d/l'd from
 <KD>>SDN?
 <KD>>:-(
 <KD>>

 PH> Yep, ScanV66 has a bug or two in it involving the validate codes it
 PH> can add to the end of files.  The validate codes were not being
 PH> calculated correctly in
 PH>

swell. think i'll wait for the next release.
ps, you have net-mail waiting. :-) BTW why on earth would anyone take time
off from a disneyland vacation to call a bbs? <grin>
 ...Your attorney is in the mail...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 2478 *Virus Info*
08-20-90 04:46:00 (Read 9 Times)
From: KEN DORSHIMER
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 2476 (RE: CRC CHECKING)

 On 19-Aug-90 with bulging eyes and flailing arms Patricia Hoffman said:

 <KD>>the deal is that the invading program would have to know how the CRC
 <KD>>your
 <KD>>program uses works. otherwise it would have a (bytes changed!/bytes in
 <KD>>file!)
 <KD>>chance of succeeding, or somewhere in that neighborhood...
 <KD>>

 PH> Except in the case of Stealth Viruses....CRC checking doesn't work
 PH> with them.
 PH>

i'd have to see that for myself. i think a complex enough algorithm would
keep them at bay. the probability factor is just too low for such a stealth
scheme to work.

 ...Your attorney is in the mail...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 2479 *Virus Info*
08-20-90 04:50:00 (Read 9 Times)
From: KEN DORSHIMER
  To: MIKE DURKIN
Subj: REPLY TO MSG# 2478 (RE: CRC CHECKING)

 On 19-Aug-90 with bulging eyes and flailing arms Mike Durkin said:

 >> You might want to take a look at McAfee's FSHLD*.ZIP.   This is a new
 >> anti-virus program from the creator of SCAN that is designed
 >> specifically for developers.   It will build a 'shield' into an
 >> application such that the application _cannot_ be infected and if it
 >> does become infected, will remove that infection after execution but
 >> prior to running. You will find it in the virus scanners area of many
 MD> Jim... this is a little mis-leading... all programs will become
 MD> infected but FSHLD will remove it for most viruses.. for viruses like
 MD> 4096, FSHLD won't remove or even know/announce that the file is
 MD> infected... When FSHLD can remove a virus, 'after execution but before

i have some misgivings about this particular protection scheme myself. i
don't like embedding someone else's stuff into my executables, partly for
licensing reasons. not to knock what is probably a good idea...


 ...Your attorney is in the mail...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 2653 *Virus Info*
08-20-90 17:09:00 (Read 10 Times)
From: TALLEY RAGAN
  To: MIKE MCCUNE
Subj: RE: REMOVING JOSHI


In a message to Philip Laird <08-16-90 14:09> Mike Mccune wrote:

MM>> Just be sure to boot off a clean diskette to remove the
MM>>virus from memory, otherwise the virus will not be removed.
MM>> If RMJOSHI is used on an unifected hard drive, it will
MM>>destroy the partition table. This next program, RETURN.COM
MM>>will restore the partition table.
MM>> I will post this program in my next listing...<MM>.

        Does this mean that RMJOSHI.COM, if run on an uninfected hard
drive by it self is a virus?




                Talley




--- ZAFFER v1.01
--- QuickBBS 2.64 [Reg] Qecho ver 2.62
 * Origin: Southern Systems *HST DS* Tampa Fl [phone] (1:377/9)




Msg#: 2654 *Virus Info*
08-21-90 09:32:00 (Read 10 Times)
From: PATRICK TOULME
  To: MIKE MCCUNE
Subj: RE: HAVE ANYONE TRIED SECURE ?

MM> I have tried Secure and have found it to be the only interrupt moniter
MM> that will stop all the known viruses.

  Mike perhaps you should add a caveat to that statement.  Secure
neither detects, nor does it stop, Virus-101.


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2655 *Virus Info*
08-21-90 12:11:00 (Read 8 Times)
From: PAUL FERGUSON
  To: HERB BROWN
Subj: KEYBOARD REMAPPING (AGAIN)...
Herb,
      I stand corrected on that last bit of dialogue....You are
correct, indeed.....But, you know what I mean along those lines of
getting what you don't expect, whether damaging or not, NO ONE wants
the unexpected on thier system.....Touche!
-Paul ^@@^........


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2656 *Virus Info*
08-21-90 22:29:00 (Read 10 Times)
From: PATRICIA HOFFMAN
  To: YASHA KIDA
Subj: AKA AND BBS HANDLES
 YK> What is the rule in this message echo concerning BBS HANDLES?
 YK> Would like some clarification,  I have users expressing interest in
 YK> using bbs handles in this echo, since they are seeing them used .
 YK> As you can see I have not allowed this, feeling this echo to be
 YK> professial in nature.
 YK>
 YK> I understand the use of AKA names in this echo maybe needed.
 YK>
 YK> Example :
 YK> After my SITE Manager saw my interest in viruses, I was called in to
 YK> his office.  After explaining my reseach, was to protect not to infect,
 YK> he relaxed.
 YK>

[Note: the above quote is muchly editted....]

Yasha, Aliases are ok in this echo, as long as the Sysop of the system where
the messages originate knows who the user is and can contact him if the need
arrises.  I fully understand the sitation that you describe about your Site
Manager...which is a fully valid reason to use an alias here.  I used to use
the alias of "Merry Hughes" for exactly that reason!

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2657 *Virus Info*
08-21-90 22:32:00 (Read 9 Times)
From: PATRICIA HOFFMAN
  To: KEN DORSHIMER
Subj: REPLY TO MSG# 2477 (RE: SCANV66B RELEASED)
 KD> swell. think i'll wait for the next release.
 KD> ps, you have net-mail waiting. :-) BTW why on earth would anyone take
 KD> time
 KD> off from a disneyland vacation to call a bbs? <grin>

<laughing>  I was eating dinner or lunch while entering those messages, then we
went back to Dizzyland and Knott's.  Besides, I had to see what you guys were
up to while I was gone.....Mom instinct....what can I say?

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2658 *Virus Info*
08-22-90 18:21:00 (Read 8 Times)
From: HERB BROWN
  To: PAUL FERGUSON
Subj: REPLY TO MSG# 2655 (KEYBOARD REMAPPING (AGAIN)...)
With a sharp eye <Aug 21 12:11>, Paul Ferguson (1:204/869) noted:
 PF>Herb,
 PF>      I stand corrected on that last bit of dialogue....You are
 PF>correct, indeed.....But, you know what I mean along those lines of
 PF>getting what you don't expect, whether damaging or not, NO ONE wants
 PF>the unexpected on thier system.....Touche!
 PF>-Paul ^@@^........

I knew what you meant.  Glad to know you do too. :-) ( No flame intended )


--- QM v1.00
 * Origin: Delta Point (1:396/5.11)




Msg#: 2659 *Virus Info*
08-22-90 05:37:00 (Read 8 Times)
From: KEN DORSHIMER
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 2657 (RE: SCANV66B RELEASED)

 On 21-Aug-90 with bulging eyes and flailing arms Patricia Hoffman said:

 KD>> swell. think i'll wait for the next release.
 KD>> ps, you have net-mail waiting. :-) BTW why on earth would anyone take
 KD>> time
 KD>> off from a disneyland vacation to call a bbs? <grin>

 PH> <laughing>  I was eating dinner or lunch while entering those
 PH> messages, then we went back to Dizzyland and Knott's.  Besides, I had
 PH> to see what you guys were up to while I was gone.....Mom
 PH> instinct....what can I say?
 PH>

did you go on the roller coaster at Knotts that looks like a corkscrew? my
personal favorite after a big dinner. <erp!>
in other news there was a report <<unconfirmed>> that there is a hack of
lharc floating around called lharc190. might want to keep an eyeball open for
it. what am i doing up at this hour? just got thru writting the docs for a
program <yawn>. as usual, the program looks better than the docs. have fun,
see ya.

 ...All of my dreams are in COBOL...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 2660 *Virus Info*
08-20-90 15:40:00 (Read 9 Times)
From: RON LAUZON
  To: PAUL FERGUSON
Subj: RE: KEYBOARD REMAPPING....
yes, it is possible to re-map the keyboard from a remote system.  However, most
people are protected by this because the term program rather than ANSI.SYS is
handling the ANSI escape sequences.

If you are using a "dumb" terminal that has no terminal emulation and allowing
ANSI.SYS to handle your screen formatting, you may be in trouble.

--- Telegard v2.5i Standard
 * Origin: The Flight of the Raven (313)-232-7815 (1:2200/107.0)




Msg#: 2661 *Virus Info*
08-21-90 20:29:00 (Read 8 Times)
From: MARTIN NICHOL
  To: MICHAEL TUNN
Subj: WHAT'S THE SOLUTION?
mt said => It seems to me our Virus checking programs will just
mt said => get bigger and bigger as more viruses and strains of
mt said => the same viruses are discovered. If so (and if their
mt said => development is excelerating) then we may find in the
mt said => near future that it has become impossiable to deal
mt said => with the outbreaks!
mt said => Do we do develop new Operating Systems which are far
mt said => more secure!

Develope different virus scanning programs.  Make them more generic where virus
signatures/characteristics can be kept in a seperate file and the virus scanner
just reads the file and interprets it accordingly.

---
 * Origin: JoJac BBS - [phone]. HST  Kettleby, ON (1:250/910)




Msg#: 2683 *Virus Info*
08-22-90 22:55:00 (Read 8 Times)
From: FRED ENNIS
  To: ALL
Subj: VIRUS-486COMP.*

FORWARDED BY James Dick of 1:163/118

QUOTE ON

I've been informed by "reliable sources" that there's a file floating around
called 486COMP.* (select your favourite packing method) which claims to "show
you the difference between your machine and a 486".
.
When run, the program flashes a "too big for memory" message, and aborts.
.
Then, the next time you boot, you're informed that you have the "Leprosy 1.00"
virus which then hangs the machine.
.
After you manage to boot from a floppy, you find that COMMAND.COM has been
altered, although the date, time, and size appear not to have been changed.

Just thought you'd like to know.

Cheers!
Fred


--- msged 1.99S ZTC
 * Origin: Page Six, POINT of order Mr. Speaker  (1:163/115.5)




Msg#: 2684 *Virus Info*
08-22-90 11:07:00 (Read 8 Times)
From: SHEA TISDALE
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 2474 (FILE ECHO?)
Thanks Patricia...

I am all ready to go now.  Just poll your board?

---
 * Origin:  >- c y n o s u r e -<  919-929-5153  <XRS> <HST> (1:151/501)




Msg#: 2685 *Virus Info*
08-20-90 21:50:00 (Read 9 Times)
From: TOM PREECE
  To: PAUL FERGUSON
Subj: RE: KEYBOARD REMAPPING VIA COMMUNICA
I can't help but wonder if Herb was experiencing something that suggested that
kind of remapping.  Lately I have been experiencing keyboard problems that seem
to act like that.  When I use my down or left arrow the \ and | symbols toggle.
I can correct this when it happens by hitting the left hand shift key - but not
the right.  And tonight it seems as if I am occaissionaly transposing caps on
and off.

If either of you hears a  virus like this I'd like to know.  Q&A tested my
memory and keyboard fine.  Scanv66 detected nothing.
--- TBBS v2.1/NM
 * Origin: G.A.D.M. Multi-User TBBS Hayward,CA.[phone]  (1:161/208)




Msg#: 2738 *Virus Info*
08-23-90 23:49:00 (Read 7 Times)
From: PHILLIP LAIRD
  To: PATRICIA HOFFMAN
Subj: ONTARIO VIRUS
Patty, have you heard of such a Virus?  I was in the TAG Support Echo and saw
a message about a TAG Sysop who contracted that virus.  Any Info?  Supposedly
the Virus is scanned in version SCANV66.ZIP.

????

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 2739 *Virus Info*
08-22-90 12:55:00 (Read 7 Times)
From: PAUL FERGUSON
  To: EVERYONE
Subj: MOM!
Patti-
    Mom, huh?...What can you say?..It seems it has already been said!

-Paul <wide grin on this one>


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2740 *Virus Info*
08-23-90 12:06:00 (Read 8 Times)
From: PAUL FERGUSON
  To: TOM PREECE
Subj: REMAPPING...
Hello, Tom...
.
      More than likely there was nothing like that at all. Keyboard
remapping is an extremely complicated process and would take more than
forethought on the part of the programmer. What you have seen us
talking about here is figurative at best and personally, I would have
to see it to believe it. (you know the old saying: "Believe none of
what you hear and only half of of what you see."?) Although I do
believe that is quite possible under the proper circumstances, it would
indeed be a rare occurance. Sometimes when receiving odd characters
during telecommunications or not getting the exact same keys that you
typed could be attributed to disparity (parity differences), differing
data bits, stop bits, or even simply ANSI interpretation problems
between Comm Programs. I've seen the smallest, simplest things like
that have people pulling their hair out by the roots!
.
.....Clarke's Third Law
     Any sufficiently advanced technology is indistinguishable from
     magic.
.
.
       -Paul   ^@@^........


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2741 *Virus Info*
08-17-90 01:51:00 (Read 8 Times)
From: YEN-ZON CHAI
  To: DOUG BAGGETT
Subj: ANTI VIRUS VIRUSES
 DB> well..here is a question..where exactly did viruses originate
 DB> anyway..was it in this country or others?

Probably where hacker exists, virus exists.




--- outGATE v2.10
 # Origin: SIGnet International GateHost (8:7501/103)
 * Origin: Network Echogate (1:129/34)




Msg#: 2742 *Virus Info*
08-22-90 17:49:00 (Read 8 Times)
From: KEVIN HIGGINS
  To: MIKE MCCUNE
Subj: REPLY TO MSG# 2654 (RE: HAVE ANYONE TRIED SECURE ?)
    I took a look at it, but to be realistic, when you run a BBS, or are
continuously updating your files as new releases come out, you could easily get
to the point where you spend more time reconfiguring the anti-virus program
than you would getting any work done. I find it much more efficient to scan
every file for viruses as soon as I get it on my system, then rezip it, if I'm
not going to use it... a simple .bat file can be used such that if you want to
check multiple files, you can just feed the file names on the command line and
let the .bat file take care of unzipping, scanning and rezipping the file.
    Be best if someone would write a program that would do this, but I haven't
found one yet.
                                  Kevin

--- TAGMAIL v2.40.02 Beta
 * Origin: The Hornet's Nest BBS (1:128/74)




Msg#: 2743 *Virus Info*
08-22-90 21:52:00 (Read 8 Times)
From: CY WELCH
  To: PAUL FERGUSON
Subj: REPLY TO MSG# 2660 (KEYBOARD REMAPPING....)
In a message to Everyone <16 Aug 90  6:32:00> Paul Ferguson wrote:

 PF> Isn't it possible to remap some (or any) keyboard functions via
 PF> communications with some funky ANSI control characters?....I seem to
 PF> remember mention of this somewhere.....I really can't remember if was
 PF> in the form of a question, though, or an answer.....It also made
 PF> mention of PKWares' Safe-ANSI program...Somebody help us out here...

I think most of the "FAST" ansi replacements do not have the keyboard remapping
so that danger is removed in those cases.

--- XRS! 3.40+
 * Origin: Former QuickBBS Beta Team Member (99:9402/1.1) (Quick 1:125/122.1)




Msg#: 2744 *Virus Info*
08-24-90 15:14:00 (Read 8 Times)
From: PATRICIA HOFFMAN
  To: ALL
Subj: VIRUS RESCUE & F-PROT RELEASES
The latest version of Fridrik Skulason's F-PROT anti-viral program is now
available for download from my system as FPROT112.ZIP.  The program can also be
file requested as F-PROT, which will always return the latest copy I have
available.  This program is actually a "suite" of programs for use in
preventing and detecting viruses and trojans.  The program originates in
Iceland, and so updates to it reaching my system for distribution have been
rather sporatic.

The other new anti-viral program available on my system is Virus Rescue.  Virus
Rescue is from Tacoma Software, and is a shell for invoking ViruScan, CleanUp,
and VCopy from McAfee Associates.  Unlike other shell programs I've seen, this
one should not require updates every time a new release of Scan comes out.  It
picks up its virus information from the VIRLIST.TXT file which is packaged with
Scan and CleanUp.  It will be handy for those who have trouble with the Scan
and CleanUp command line switches, or who want the VIRLIST.TXT information
converted to english sentences.  This is a first public release, so I expect we
may see some changes in this product in the future.  Virus Rescue can be
downloaded from my system as RESQ01.ZIP.

Both programs are also file requestable by other systems.  File requests should
ask for magic file names as follows:

        F-PROT for the latest copy of F-PROT (currently FPROT112.ZIP)
        RESCUE for the latest version of Virus Rescue

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2745 *Virus Info*
08-24-90 23:37:00 (Read 9 Times)
From: KEN DORSHIMER
  To: KEVIN HIGGINS
Subj: REPLY TO MSG# 2742 (RE: HAVE ANYONE TRIED SECURE ?)

 On 22-Aug-90 with bulging eyes and flailing arms Kevin Higgins said:

 KH> I took a look at it, but to be realistic, when you run a BBS, or are
 KH> continuously updating your files as new releases come out, you could
 KH> easily get to the point where you spend more time reconfiguring the
 KH> anti-virus program than you would getting any work done. I find it
 KH> much more efficient to scan every file for viruses as soon as I get it
 KH> on my system, then rezip it, if I'm not going to use it... a simple
 KH> .bat file can be used such that if
 KH>
 KH> you want to check multiple files, you can just feed the file names on
 KH> the command line and let the .bat file take care of unzipping,
 KH> scanning and rezipping the file. Be best if someone would write a
 KH> program that would do this, but I haven't found one yet. Kevin
 KH>

sounds like a plan to me. it would actually be fairly simple to write a
program to look at all the files in your upload directory, unpack them based
on the extension, scan them, then re-compress them (if needed). of course
you'd still have to manually put the now scanned files into the proper
catagory directories yourself. when do you need it and what's it worth? :-)

 ...All of my dreams are in COBOL...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 2746 *Virus Info*
08-23-90 15:23:00 (Read 8 Times)
From: MIKE MCCUNE
  To: TALLEY RAGAN
Subj: REPLY TO MSG# 2653 (RE: REMOVING JOSHI)
No, it just modifies the partition record to remove the virus.
If the virus isn't there, it still modifies the partition
record. Return.com just reverses the modifications done to the
partition table. I will post an improved version of RMJOSHI that
scans the partition record for the virus before modifying
it...<MM>.


--- KramMail v3.15
 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0)




Msg#: 2747 *Virus Info*
08-23-90 15:26:00 (Read 8 Times)
From: MIKE MCCUNE
  To: PATRICK TOULME
Subj: REPLY TO MSG# 2745 (RE: HAVE ANYONE TRIED SECURE ?)
Maybe I should say all virus that are in the "public domain".
Virus 101 is a research virus that only a few people have (and
you wrote). Nothing is fool proof but Secure is better than any
other interrupt moniter.


--- KramMail v3.15
 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0)




Msg#: 2748 *Virus Info*
08-23-90 07:01:00 (Read 8 Times)
From: YASHA KIDA
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 2656 (AKA AND BBS HANDLES)
In a message of <21 Aug 90  22:29:34>, Patricia Hoffman (1:204/869) writes:

 PH>
 PH> Yasha, Aliases are ok in this echo, as long as the Sysop of the system
 PH> where the messages originate knows who the user is and can contact him
 PH> if the need arrises.  I fully understand the sitation that you
 PH> describe about your Site Manager...which is a fully valid reason to
 PH> use an alias here.  I used to use the alias of "Merry Hughes" for
 PH> exactly that reason!
 PH>
 PH> Patti


I understand AKA names like "MERRY",  but I speak of HACKER HANDLES.
like  "LINE RUNNER", "DATA BYTE" etc... I must have misunderstood FIDO ECHO
POLICY either way I will drop the subject.

Yasha Kida








--- msged 1.99S ZTC
 * Origin: Bragg IDBS, (FT. Bragg, NC - we're gonna kick some booty)
(1:151/305)




Msg#: 2749 *Virus Info*
08-08-90 23:23:00 (Read 7 Times)
From: ALAN DAWSON
  To: DAVID SMART
Subj: RE: VIRUS SCANNERS....
 DS> You can't win on this!  I've been downloading for quite a while
 DS> - always running a virus checker on the information.  So, where
 DS> did our virus come from?  Off a shrink-wrapped anti-virus
 DS> diskette one of our guys picked up in the US!

Nothing new about this, as people learn all the time. One MAJOR
company (really big, really well known) has shipped shrink-wrapped
viruses twice -- once on purpose! Shrink wrap doesn't keep the bugs
out.



--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 2750 *Virus Info*
08-08-90 23:31:00 (Read 7 Times)
From: ALAN DAWSON
  To: PATRICIA HOFFMAN
Subj: SCAN WEIRDNESS
(All answers gratefully received despite the TO: line)
   Anybody heard of this? I've got a floppy with some viruses on it,
among them a SCAN-known Dark Avenger. I SCAN this floppy from the C
drive, and the "hey, nothing to worry about there" report comes back.
Strange. I SCAN it again. This time 'round, SCAN barfs after 64K of
the memory check, telling me Dark Avenger is in memory, power down,
load the .45, get the cyanide tablet ready and so on.
   But DA of course is NOT in memory or active in any way. It is,
however, on the floppy, unrun.
   The above occurred with SCANV64. Out of curiosity, I cranked up
SCAN-54 and -- EXACTLY the same result.
   AST Bravo 286, no TSRs, nothing else loaded, clean (normal) boot
just performed.
   I have a bunch of viruses that I don't expect SCAN to find --
ever. But this kind of thing has never happened to me before. Can
anyone match this story, or event?



--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 2751 *Virus Info*
08-26-90 00:59:00 (Read 7 Times)
From: STEVEN TREIBLE
  To: KEN DORSHIMER
Subj: VOICE NUMBER

Ken,
I haven't mailed the disk yet as you can see.  I'd like to have your voice # so
I can talk to instead of sending Net Mail.
                                                        Thanks,
                                                             Steve.

--- ZMailQ 1.12 (QuickBBS)
 * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0)




Msg#: 2752 *Virus Info*
08-25-90 06:10:00 (Read 8 Times)
From: SANDY LOCKE
  To: HERB BROWN
Subj: RE: COMMUNICATION VIRALS


 PH> However, unless one of the above is occurring, just connecting via
 PH> telecom to a system won't directly transmit a virus....
 PH>


HB> Well, that is not exactly what I meant.  Sorry for the miscommunicatio
HB> should have used an example.  I'll have to dig for some old documentat
HB> about z-modem when it first came out.  I seem to remember it stating t
HB> locked the directory that a file was able to go to when being download
HB> has something to do with the structure of a .EXE file, or something.
HB> to also remember that it was possible to have the .exe "go were it wan
HB> as defined by this structure.  Thus, having some of the file go to a c
HB> part of a drive or memory.  It seems wild, but without the docs I read
HB> can't give any details.  Thought maybe you could shed some light on th

 Well considering that I am hosting chuck forsberg today ... hes down
here for the sco developer forum I will put the question to him
directly... but as one of the suggestors for feature addition to the
protocol in another personna... ZMODEM will INDEED allow one to
transmit a FULL path name... however this is mitigated by the ability
on the receiving end to override the transmitted pathname spec... I
dont really see a problem here... and when I put the question to chuck
I dont see where he will see one either... btw READ the DSZ DOCS and
register the product... that will turn on ALL the neat zmodem
features...
      sandy


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2753 *Virus Info*
08-25-90 06:18:00 (Read 15 Times)
From: SANDY LOCKE
  To: SKY RAIDER (Rcvd)
Subj: RE: VIRUS ORIGINALS
SR> Doug,

SR> It is my belief that viruses originated in the early days of computing
SR> effort to see what kind of stuff could be done with them, a group of
SR> programmers (financed by the US government as I recall) institued a se
SR> programs that would attempt to 'beat' others in taking over a computer
SR> system. These programs led to a gaming system known as the CORE WARS.
SR> today there is an International Core Wars Society.

SR> I think it can be easily seen how a program to destroy/circumvent a st
SR> operating system can develope into a virus.

SR> I tried to double check this information for accuracy, names, dates, e
SR> but it seems I have deleted this file. I will try to get further info
SR> you, but beleive this info is shrouded in secrecy, and may be hard to
SR> relocate.

SR> So, the original viruses did come from the US (and even possibly with
SR> government help).

SR>                                Ivan Baird
SR>  * Origin: Northern Connection, Fredericton, N.B. Canada <HST 14.4K>
SR> (1:255/3)
WHAT a LOAD of UNADULTERATED CRAP... redcode is simply a GAME created by
bored programmers... ORIGINAL CORE WARS games were created as far back
as 1969 back on the OLD IBM 360 architectures under both OS/MFT and
OSMVT OS's... neither had anything to do with so-called secret
financing by the US government...BTW I was AROUND and A Systems
Programmer during that period... we created our own versions when we
heard of the rumours... it was an old system programmers game designed
to give Egotistal programmers some lighthearted fun... at this point
ALL code ran in real Address space and redcode hadnt even been though
of... the MUCH later article by Scientific American in 1979 gave this
fun with out harm via the redcode interpreter implemented on early 6502
and 8080 systems... really... I am going to have to move to canada...
sounds like there are some really potent and fun drugs in circulation
up there... jeese... what a simp...
   sandy


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2754 *Virus Info*
08-25-90 06:19:00 (Read 14 Times)
From: SANDY LOCKE
  To: STEVE HOKE
Subj: REPLY TO MSG# 2752 (RE: COMMUNICATION VIRALS)
SH> In a message to Herb Brown <15 Aug 90 17:44:00> Patricia Hoffman wrote

 PH> The only way a virus could be directly transmitted via a
 PH> telecommunications link ...
 PH> is if the particular "service" has a feature where they upgrade
 PH> their software on your system when you connect.

SH> Is there any commercial system that does this? I don't know of one, bu
SH> like to know what types of systems to be wary of.

SH> Steve
just one word for you... PRODIGY avoid it like the plague...
    sandy


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2755 *Virus Info*
08-25-90 06:25:00 (Read 9 Times)
From: SANDY LOCKE
  To: MIKE MCCUNE
Subj: REPLY TO MSG# 2747 (RE: HAVE ANYONE TRIED SECURE ?)

MM> I have tried Secure and have found it to be the only interrupt moniter
MM> that will stop all the known viruses. It won't stop the boot viruses,
MM> obviously (because a boot virus loades before Secure does), but it wil
MM> detect them as soon as Secure is loaded. Secure is hard to configure,
MM> but once it is configured, it will give few false alarms. With string
MM> scanners becoming increasingly easy to defeat, Secure may be the way t
MM> go for virus protection...<MM>.

 well kiddies... a certain couple of anti-viral types on HOMEBASE BBS
managed to sting SECURE with modified version of JER-B... one of them
continues to find holes with the same tool... SECURE is simply NOT
SECURE...
   sandy


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2756 *Virus Info*
08-25-90 06:31:00 (Read 9 Times)
From: SANDY LOCKE
  To: KEN DORSHIMER
Subj: REPLY TO MSG# 2479 (RE: CRC CHECKING)

KD>  On 19-Aug-90 with bulging eyes and flailing arms Patricia Hoffman sai

KD>  <KD>>the deal is that the invading program would have to know how the
KD>  <KD>>your
KD>  <KD>>program uses works. otherwise it would have a (bytes changed!/by
KD>  <KD>>file!)
KD>  <KD>>chance of succeeding, or somewhere in that neighborhood...
KD>  <KD>>

 PH> Except in the case of Stealth Viruses....CRC checking doesn't work
 PH> with them.
 PH>

KD> i'd have to see that for myself. i think a complex enough algorithm wo
KD> keep them at bay. the probability factor is just too low for such a st
KD> scheme to work.

KD>  ...Your attorney is in the mail...

check out Gilmore Data Systems in LA authors of the OLD FICHECK and
XFICHECK... the techniques is called CRC padding after the addition of
the viral code the file is padded with a given number of bytes to make
the CRC Polynomial come out with the same result... the FCB is then
Patched to the original file length leaving nothing for standrad CRC
checkers to detect... Childs play really...
      sandyp.s. in the case of most stealth viruses... the file read
code is simply altered to disinfect the file as the CRC checking
program reads it... agains simply childs play...


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2757 *Virus Info*
08-25-90 06:32:00 (Read 10 Times)
From: SANDY LOCKE
  To: PATRICK TOULME
Subj: REPLY TO MSG# 2755 (RE: HAVE ANYONE TRIED SECURE ?)

MM> I have tried Secure and have found it to be the only interrupt moniter
MM> that will stop all the known viruses.

PT>   Mike perhaps you should add a caveat to that statement.  Secure
PT> neither detects, nor does it stop, Virus-101.

 Right on Patrick...
    sandy
p.s. Damn nice design on the code complex as HELL....


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2758 *Virus Info*
08-25-90 06:36:00 (Read 9 Times)
From: SANDY LOCKE
  To: PAUL FERGUSON
Subj: REPLY TO MSG# 2740 (RE: REMAPPING...)
PF> Hello, Tom...
PF> .
PF>       More than likely there was nothing like that at all. Keyboard
PF> remapping is an extremely complicated process and would take more than
PF> forethought on the part of the programmer. What you have seen us
PF> talking about here is figurative at best and personally, I would have
PF> to see it to believe it. (you know the old saying: "Believe none of
PF> what you hear and only half of of what you see."?) Although I do
PF> believe that is quite possible under the proper circumstances, it woul
PF> indeed be a rare occurance. Sometimes when receiving odd characters
PF> during telecommunications or not getting the exact same keys that you
PF> typed could be attributed to disparity (parity differences), differing
PF> data bits, stop bits, or even simply ANSI interpretation problems
PF> between Comm Programs. I've seen the smallest, simplest things like
PF> that have people pulling their hair out by the roots!
PF> .
PF> .....Clarke's Third Law
PF>      Any sufficiently advanced technology is indistinguishable from
PF>      magic.
PF> .
PF> .
PF>        -Paul   ^@@^........

 well paul normally on hombase you are quite lucid... but as a long
time programmer I can testify the keyboard mapping is really quite
simple... no real problem and the business of using terminal control
code is quite as simple...
    sandy


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2759 *Virus Info*
08-25-90 06:39:00 (Read 9 Times)
From: SANDY LOCKE
  To: CY WELCH
Subj: REPLY TO MSG# 2743 (RE: KEYBOARD REMAPPING....)
CW> In a message to Everyone <16 Aug 90  6:32:00> Paul Ferguson wrote:

 PF> Isn't it possible to remap some (or any) keyboard functions via
 PF> communications with some funky ANSI control characters?....I seem to
 PF> remember mention of this somewhere.....I really can't remember if was
 PF> in the form of a question, though, or an answer.....It also made
 PF> mention of PKWares' Safe-ANSI program...Somebody help us out here...

CW> I think most of the "FAST" ansi replacements do not have the keyboard
CW> remapping so that danger is removed in those cases.
 Well if you are referring to FANSI.SYS by hershey Microsystems it too
is vunerable to remap effects... and since it implemnt FULL ANSI 3.64
terminal control codes plus some extensions it is even more vunerable
to a whole class of tricks that go way beyond noremally keyboard
remapping... but to there credit they ahve include a way to turn this
"FEATURE" OFF... just most users get it off a BBS and never order or
look at the 50.00 set of docs that come when you pay for the
products...
    sandy


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2760 *Virus Info*
08-25-90 08:49:00 (Read 9 Times)
From: PATRICIA HOFFMAN
  To: PHILLIP LAIRD
Subj: REPLY TO MSG# 2738 (ONTARIO VIRUS)
 PL> Patty, have you heard of such a Virus?  I was in the TAG Support Echo
 PL> and saw
 PL> a message about a TAG Sysop who contracted that virus.  Any Info?
 PL> Supposedly the Virus is scanned in version SCANV66.ZIP.

Yep, I've heard of this one....I was the one that named it after it was
submitted by Mike Shields (Sysop of 1:244/114).  Ontario is a memory resident
generic infector of .COM and .EXE files, including COMMAND.COM.  Infected .COM
files will increase in length by 512 bytes.  Infected .EXE files will increase
in length between 512 bytes and 1023 bytes on disk drives with standard 512
byte sectors.  When files are infected, the virus adds itself to the end of the
program, and then places a jump at the beginning so that the virus's code will
always execute before the program that was infected.  Ontario is not a
low-system memory TSR, it goes memory resident installing itself at the top of
free memory, but below the 640K line.  Available free memory will decrease by
2,048 bytes.  Once the virus has installed itself in memory, any program which
is executed will then become infected.

It was reported with the sample I received from Mike that infected systems may
experience hard disk errors, but I was unable to duplicate that here.  This may
only happen in severe infections, I try not to let them get that severe when
I'm working with a virus :-).

Scan V66 and above can detect the Ontario Virus on both .COM and .EXE files.
Unfortunately, Ontario is one of the viruses that uses a "double-encryption"
technique to prevent scanners from being able to use a search string to detect
it, so there isn't a simple way to find it with a hex string and a utility such
as Norton Utilities.  As of right now, there aren't any disinfectors available
for the Ontario virus, so if you happen to be infected with it you need to
remove the infected programs and replace them with clean copies from your
uninfected backups or original write-protected distribution diskettes.

A more complete description of the Ontario virus is in VSUM9008, which was
released on August 10.  The above is just off of the top of my head, which
happens to hurt right now.  Hope it is understandable.....

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2761 *Virus Info*
08-25-90 09:02:00 (Read 10 Times)
From: PATRICIA HOFFMAN
  To: YEN-ZON CHAI
Subj: REPLY TO MSG# 2741 (ANTI VIRUS VIRUSES)
 YC>  DB> well..here is a question..where exactly did viruses originate
 YC>  DB> anyway..was it in this country or others?
 YC>
 YC> Probably where hacker exists, virus exists.
 YC>

Well, the two oldest known viruses for MS-DOS are the Pakistani Brain and
VirDem.  The Brain is from Pakistan, VirDem from West Germany.  Both of these
originated in 1986.  Both have known authors.  The viruses from 1987 include
Jerusalem and the Suriv series from Israel, Alameda/Yale from the United
States, and 405 from Austria or Germany.

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2762 *Virus Info*
08-25-90 09:07:00 (Read 10 Times)
From: PATRICIA HOFFMAN
  To: KEVIN HIGGINS
Subj: REPLY TO MSG# 2757 (RE: HAVE ANYONE TRIED SECURE ?)
 KH>     I took a look at it, but to be realistic, when you run a BBS, or
 KH> are continuously updating your files as new releases come out, you
 KH> could easily get to the point where you spend more time reconfiguring
 KH> the anti-virus program than you would getting any work done. I find it
 KH> much more efficient to scan every file for viruses as soon as I get it
 KH> on my system, then rezip it, if I'm not going to use it... a simple
 KH> .bat file can be used such that if you want to check multiple files,
 KH> you can just feed the file names on the command line and let the .bat
 KH> file take care of unzipping, scanning and rezipping the file.
 KH>     Be best if someone would write a program that would do this, but I
 KH> haven't found one yet.

You might want to take a look at CheckOut and Shez.

CheckOut uses ViruScan to check .ARC, .PAK, .ZIP, .LZH, and other archive
formats for viruses by automatically creating a temporary directory and
unarchiving the file to it.  It then invokes Scan to check the executable
files.  One of its nice features is that it will never invoke a program in that
temporary directory, as well as you can have it either delete an infected file
or move it to a badfiles directory.  It will also find archives which are
damaged for you.  It can be invoked easily from a .BAT file, such as if you
want to run it at midnight against all new uploads.

Shez is another program which can be used to scan inside archives.  It is
interactive, so you need to manually invoke it.  After you have selected the
archive and listed the contents, hitting ctrl-Z will result in Scan checking
the contents.

There are other scanning shells which handle archived files, though these are
the two that I've used regularly and are the most familiar with.  I was also
involved in the beta testing of CheckOut with some known to be infected files,
and it does function properly in that instance.  I've also tested Shez with
infected files, and it works well....

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2763 *Virus Info*
08-24-90 16:53:00 (Read 8 Times)
From: PRAKASH JANAKIRAMAN
  To: ALL
Subj: LEPROSY
Exactly what is the Leprosy virus supposed to do? I was informed that it had
been included in McAfee's latest version of Scan, but, having never used Scan
before in my life, and never having encountered a virus, are there "symptoms",
shall we say, caused by the Leprosy virus, or for any virus? If there is a
textfile explaining what each virus is capable of doing, and how it can be
detected, I'd like to get a copy of it, if any of you know where I can get
something of that sort.

Also, does anyone have the number to McAfee's BBS? I'd like to become a user
over there as well. (I remember it being in the 408 area code, but I can't
recall the actual number). Anyways, thanks a bunch, all...

Prakash
--- TBBS v2.1/NM
 * Origin: G.A.D.M. Multi-User TBBS Hayward,CA.[phone]  (1:161/208)




Msg#: 2896 *Virus Info*
08-26-90 20:55:00 (Read 9 Times)
From: HERB BROWN
  To: SANDY LOCKE
Subj: REPLY TO MSG# 2754 (RE: COMMUNICATION VIRALS)
With a sharp eye <Aug 25 06:10>, Sandy Locke (1:204/869) noted:
 SL> Well considering that I am hosting chuck forsberg today ... hes down
 SL>here for the sco developer forum I will put the question to him
 SL>directly... but as one of the suggestors for feature addition to the
 SL>protocol in another personna... ZMODEM will INDEED allow one to
 SL>transmit a FULL path name... however this is mitigated by the ability

I have the understanding that other protocols would do this, not by choice.
Without the security on the recieving end, this could be disasterous, to say
the least..  I would be happy to hear what you find.. Speaking of registering
zmodem, is it still free to sysops? You can asnwer that in net-mail.. :-)


--- QM v1.00
 * Origin: Delta Point (1:396/5.11)




Msg#: 2897 *Virus Info*
08-24-90 13:39:00 (Read 7 Times)
From: MIKE MCCUNE
  To: VESSELIN BONTCHEV
Subj: REPLY TO MSG# 2746 (REMOVING JOSHI)
In your recent letter to me you wrote to me you suggested that I check for the
virus before trying to remove it. Now that I've got a working copy of the Joshi
(and don't have to let someone else test RMJOSHI), I rewrote the program to
check for the virus first.
mov dx,80h
mov cx,1h
mov bx,200h
mov ax,201h
int 13h
or ah,ah
jnz read_error
es:
cmp w[bx],1feb
jnz no_virus
mov cx,000ah
mov ax,301h
int 13h
or ah,ah
jnz write_error
mov cx,9h
mov ax,201h
int 13h
or ah,ah
jnz read_error
mov cx,1h
mov ax,301h
int 13h
or ah,ah
jnz write_error
mov ah,9h
lea dx,remove_message
int 21h
int 20h
remove_message:
db 'Joshi Removed$'
no_virus:
mov ah,9h
lea dx,virus_message
int 21h
int 20h
virus_message:
db 'Joshi not found$'
read_error:
mov ah,9h
lea dx,read_message
int 21h
int 20h
read_message:
db 'Read Error$'
write_error:
mov ah,9h
lea dx,write_message
int 21h
int 20h
write_message:
db 'Write Error$'
I wrote it for the shareware A86, but it should assemble under MASM, TASM or
WASM with minor modifications. Next I will scan the memory for the virus
because the remover won't work while the virus is active in memory....<MM>.


--- Opus-CBCS 1.13
 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0)




Msg#: 2898 *Virus Info*
08-25-90 23:46:00 (Read 6 Times)
From: TALLEY RAGAN
  To: MIKE MCCUNE
Subj: REPLY TO MSG# 2897 (RE: REMOVING JOSHI)


In a message to Talley Ragan <08-23-90 15:23> Mike Mccune wrote:

MM>>No, it just modifies the partition record to remove the virus.
MM>>If the virus isn't there, it still modifies the partition
MM>>record.

        Thanks for the information.  That clears up the question just
fine.


                Talley




--- ZAFFER v1.01
--- QuickBBS 2.64 [Reg] Qecho ver 2.62
 * Origin: Southern Systems *HST DS* Tampa Fl [phone] (1:377/9)




Msg#: 2899 *Virus Info*
08-23-90 17:31:00 (Read 6 Times)
From: DAVID BURGESS
  To: MARTIN NICHOL
Subj: REPLY TO MSG# 2661 (WHAT'S THE SOLUTION?)
In a message to michael tunn <21 Aug 90 20:29:00> Martin Nichol wrote:

 MN> mt said => It seems to me our Virus checking programs will just
 MN> mt said => get bigger and bigger as more viruses and strains of
 MN> mt said => the same viruses are discovered. If so (and if their
 MN> mt said => development is excelerating) then we may find in the
 MN> mt said => near future that it has become impossiable to deal
 MN> mt said => with the outbreaks!
 MN> mt said => Do we do develop new Operating Systems which are far
 MN> mt said => more secure!

 MN> Develope different virus scanning programs.  Make them more generic
 MN> where virus signatures/characteristics can be kept in a seperate
 MN> file and the virus scanner just reads the
 MN> file and interprets it accordingly.

That opens the door to having the virus scanner or part of the virus scanner
to become contaminated.


--- [Q] XRS 3.40
 * Origin: Eurkea! I've found the secret elephant playground (RAX 1:124/3106.6)




Msg#: 2900 *Virus Info*
08-17-90 21:06:00 (Read 6 Times)
From: CHRIS BARRETT
  To: PATRICIA HOFFMAN
Subj: RE: VIRUCIDE V1.2
Thanks for the info..  If ya remeber the name could ya tell us it..
I think i'll stick with the ScanV?? and CleanP?? for now then..

Chris..
--- TBBS v2.1/NM
 * Origin: 1990 MultiLine Perth Western Australia - 09-370-3333 - (690/654)




Msg#: 2901 *Virus Info*
08-17-90 06:26:00 (Read 6 Times)
From: ZEBEE JOHNSTONE
  To: ALL
Subj: MAC VIRUS
Anyone know anything about a mac virus which:

        Sets the delete flag on any folder with a name which starts with the
letter "o" or higher (eg system...)

IT doesn't actually delete the folder, the machine will still boot, but the
folder is missing from the desktop and the delete flag is set.

Weird one hmm?

---
 * Origin: Lighten up! What man can make, man can break! (3:680/813)




Msg#: 2902 *Virus Info*
08-19-90 22:31:00 (Read 6 Times)
From: BRENDON THOMPSON
  To: PATRICIA HOFFMAN
Subj: "STONED 2"
Patti, I sent you a message the other day about a new variant of
"Stoned" that I found in Christchurch, New Zealand.  It had reference
to some "S & S program for testing anti-virus software" and the
phone number  0494 791900 in it.

I have since had the time to pull it to bits, and it is only the
original "Stoned" virus.  The code at the start of the sector is
still the same, but some clown has modified the message after
location 65H.

I'm still pleased to send you a specimen by airmail if you like,
but it ain't "Stoned 2".

Regards..


... Doon.
--- Via Silver Xpress V2.26
 * Origin: TONY'S BBS - Gateway to New Zealand. (3:770/101)




Msg#: 2903 *Virus Info*
08-19-90 09:25:00 (Read 6 Times)
From: DONALD ANDERSON
  To: FRIAR NESTOR
Subj: RE: LOOKIN' FOR FUN?
I always looking for fun


--- KramMail v3.15
 * Origin: get real (3:621/221.0)




Msg#: 2904 *Virus Info*
08-26-90 23:36:00 (Read 7 Times)
From: GLENN JORDAN
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 2761 (ANTI VIRUS VIRUSES)
 PH> The Vacsina Viruses were written in Bulgaria to seek out and destroy
 PH> certain other viruses, or at least that was their original purpose.


     In examples of the VACSINA virus I have investigated, I have found the
following odd behavior, which I wonder if you have also noted :

     .COM files of over a certain size are infected at first bite, but .EXE
files are different. It takes two Exposures to infect an .EXE file, each of
which adds a bit to the file length, but only at the second exposure do you get
a live virus, signaled by a short beep. A tiny .EXE will take the first
exposure, but never complete on a subsequent exposure to become a live virus.
     I wonder if in some way this behavior, which I have not seen in any other
viruses so far, is in some way related to the original "anti-virus" nature of
this beast ?

--- XRS 3.30-DV (286)
 * Origin: Jordan Computer Consulting (RAX 1:151/223.3)




Msg#: 2905 *Virus Info*
08-26-90 07:54:00 (Read 6 Times)
From: KEN DORSHIMER
  To: SANDY LOCKE
Subj: REPLY TO MSG# 2756 (RE: CRC CHECKING)

 On 25-Aug-90 with bulging eyes and flailing arms Sandy Locke said:

 SL> check out Gilmore Data Systems in LA authors of the OLD FICHECK and
 SL> XFICHECK... the techniques is called CRC padding after the addition of
 SL> the viral code the file is padded with a given number of bytes to make
 SL> the CRC Polynomial come out with the same result... the FCB is then
 SL> Patched to the original file length leaving nothing for standrad CRC
 SL> checkers to detect... Childs play really... sandyp.s. in the case of
 SL> most stealth viruses... the file read code is simply altered to
 SL> disinfect the file as the CRC checking program reads it... agains
 SL> simply childs play...
 SL>

could you send me this article? i still believe that the virus would have to
know your crc algorithm in order to perform this magic. additionally if the
file is padded, it's size would increase and would be detected that way.
correct? sooo, the person writting the virus would require a copy of your
file to disassemble, see how you performed your checks, then create a means
to circumvent it. sounds like a lot of trouble to me for very little gain.
catch ya on the rebound.

 ...All of my dreams are in COBOL...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 2906 *Virus Info*
08-26-90 23:58:00 (Read 6 Times)
From: KEN DORSHIMER
  To: STEVEN TREIBLE
Subj: REPLY TO MSG# 2751 (RE: VOICE NUMBER)

 On 26-Aug-90 with bulging eyes and flailing arms Steven Treible said:

 ST> Ken, I haven't mailed the disk yet as you can see.  I'd like to have
 ST> your voice # so I can talk to instead of sending Net Mail. Thanks,
 ST> Steve.

 you got it look for it in a net-mail-o-gram. i'd rather not leave it in the
 public msg area as everyone would try to call and shoot the breeze. :-)

 ...All of my dreams are in COBOL...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 2907 *Virus Info*
08-26-90 13:09:00 (Read 6 Times)
From: PAUL BENDER
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 2744 (VIRUS RESCUE & F-PROT RELEASES)
 * Replying to a message originally to All

PH> Both programs are also file requestable by other systems.
PH> File requests should ask for magic file names as follows:
PH>
PH>         F-PROT for the latest copy of F-PROT (currently
PH> FPROT112.ZIP)
PH>         RESCUE for the latest version of Virus Rescue
PH>

Would it be possible for you to hatch these out into SDS or arrange for the
authors to do so?

        Paul

--- RemoteAccess 0.04a via QEcho 2.
 * Origin: -=* Rassi's Retreat *=- 10pm to 8am Only! [phone] (1:116/37)




Msg#: 2908 *Virus Info*
08-26-90 12:44:00 (Read 7 Times)
From: PATRICIA HOFFMAN
  To: ALL
Subj: VIRUS_INFO INTRODUCTION & RULES
Welcome to the VIRUS_INFO echo.  The purpose of this echo is to allow
BBS users and sysops to ask questions about computer viruses and to be
able to get back up-to-date information.  Discussion topics may include,
but is not necessarily limited to:

    - what are viruses
    - how to prevent getting infected
    - how to determine if your system is infected
    - how to clean up an infected system and salvage as much information
      as possible
    - reviews and announcements of new anti-viral products and product
      releases.

There was a lot of hysteria in the press over the Columbus Day/
DataCrime/October 12 virus, for example, but little mentioned of how
rare the virus is or how to determine if a system is infected with it
and how to remove it.  This type of information is an example of what
this echo is intended to carry.

Some messages appearing in this conference may be cross-postings from
the Dirty_Dozen echo which is sysop only.  Cross-postings may only be
done by the originator of the message.  For example, several of my
messages posted in the Dirty_Dozen echo will be cross-posted here.
Messages from the HomeBase/CVIA BBS run by Mr. John McAfee in Santa
Clara, CA and/or CVIA bulletins may be posted here by Patricia Hoffman,
these are being done with Mr. McAfee's permission.  Replies to these
messages, as well as netmail received at 1:204/869 for Mr. McAfee, is
manually transferred to his system as it is received.

Conference rules are very simple.....
1.   Discussions of how to write a virus, specific technical discussions
     of how a virus works, or anything of an illegal nature, are not
     allowed.  This rule is *not* open to debate.
2.   Messages with a sexually suggestive nature are not allowed, please keep
     in mind that minors as well as adults participate in this conference.
3.   Discussions of a ethical or retorical nature that lead into a debate are
     considered off-topic in that they will not ever be resolved and do not
     help anyone.  An example in this category would be a discussion in the
     area of "Should live viruses or virus disassemblies be made available
     to the public?".  These questions and topics will be allowed until such
     a point that they start to severely disrupt the echo, or start a flame
     war.  At that point, the moderator will request that the discussion be
     discontinued.
4.   Be courteous to your fellow echo participants, and remember there
     is no such thing as a dumb question, except for the question that some-
     one is afraid to ask.  Everyone needs to help everyone else understand
     viruses and why they are a problem.
5.   This conference is not to be distributed thru Group-mail or any
     other mail processor which will obscure the ability to track a
     message back to an originating system.  All messages must have
     seen-bys and path statements if the BBSs participatings software
     can generate them.
6.   If you have a question or problem of an extremely sensitive nature,
     consider sending it NetMail to 1:204/869 or 99:9403/2 instead of
     posting it here.  If you are netmailing a file that you think is
     infected, be sure to send a message in NetMail with it so I know
     what it is, I'll be sure it gets to someone to get analysed for you.
     Do not under any circumstances host route a file that you think is
     infected.  Suspect files may also be sent on diskette via US Mail
     to the following address:
          Patricia Hoffman
          1556 Halford Avenue #127
          Santa Clara, CA 95051
7.   This conference is available to FidoNet and EggNet systems.
     The conference echomail tag in FidoNet is VIRUS_INFO, in EggNet
     the conference is available as E_VIRUS_INFO.
8.   This conference is available on the FidoNet Backbone.  While you
     are welcome to freely pass this echo along to other systems, out
     of region links must be approved by moderator of the echo.  Gating
     the echo into another network or Zone must be approved by the
     conference moderator.
9.   Opinions are welcome in the conference, however the ethics of the
     behavior of people that write viruses, or name calling, is frowned
     upon.  Likewise, accusations of virus writing are strictly forbidden.
     Please keep opinions down to a single message, and do not
     repeatedly post them, as these messages tend to water down the
     purpose of the conference and degrade the level of information that
     is being presented.
10.  Handling of off-topic messages or messages that violate the
     conference rules will be done by the moderator.  First and second
     warnings on these messages will be in private Netmail.  Please
     do not respond to the off-topic messages so that the conference
     doesn't get further off-track.  Let the moderator do the moderating.
11.  Handles are allowed in this conference, however sysops of boards
     carrying the conference are expected to be able to determine which
     of their users entered a message if a problem arises.  This in
     effect means, for example, that Opus systems must not set this echo
     up to allow anonymous messages.
12.  If a matter arises where the moderator needs to contact a participant
     in the echo, the moderator will contact the system where the message
     was entered and request that the sysop allow the user netmail access,
     or call the participant with a request for them to logon to the
     moderator's system or provide a phone number with the participant's
     permission.  Sysops are not expected to provide their users' phone
     numbers to the moderator without the user's express permission, their
     privacy is important.  There are times, however, when a phone call
     or chat can resolve a problem much faster than any other route.  This is
     the only reason for this rule.
12.  This echo is not a programming echo for answering questions
     on how to code programs in assembler.  If you want to exchange
     assembler (or any other program language) techniques, please
     locate an appropriate programming echo or start your own echo.

Patricia M. Hoffman is the moderator of the VIRUS_INFO echo conference.  She
has previously used the name "Merry Hughes" in moderating this conference, and
is the originator of the conference and the original moderator.

Patricia Hoffman is also the author of the Virus Information Summary List, and
is an independent anti-viral researcher.

Please contact the moderator, Patricia Hoffman, at 1:204/869 or 99:9403/2
if you need assistance on setting up an echofeed for this echo to your
system.


thanks...
Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2909 *Virus Info*
08-26-90 15:13:00 (Read 7 Times)
From: PATRICIA HOFFMAN
  To: PRAKASH JANAKIRAMAN
Subj: REPLY TO MSG# 2763 (LEPROSY)
 PJ> Exactly what is the Leprosy virus supposed to do? I was informed that
 PJ> it had been included in McAfee's latest version of Scan, but, having
 PJ> never used Scan before in my life, and never having encountered a
 PJ> virus, are there "symptoms", shall we say, caused by the Leprosy virus,
 PJ> or for any virus? If there is a textfile explaining what each virus is
 PJ> capable of doing, and how it can be detected, I'd like to get a copy of
 PJ> it, if any of you know where I can get something of that sort.

The Leprosy virus is a non-resident overwriting virus.  It infects .COM and
.EXE files, overwriting the first 666 bytes of the file.  Symptoms of it
include that infected files will not execute properly...instead of what they
are supposed to do, they will upon execution, infect other files then display a
message and end.  A complete description of this virus and all (with the
exception of V2P2, V2P6, V2P6 and Stoned II) known MS-DOS viruses as of August
10, 1990 is available in the Virus Information Summary List.  Its current
version is VSUM9008.ZIP.  It is available on my system at 408-244-0813, as well
as many other systems, including McAfee's BBS.  Check around your area before
you make the long distance call, it could save you the phone call cost.

 PJ>
 PJ> Also, does anyone have the number to McAfee's BBS? I'd like to become a
 PJ> user over there as well. (I remember it being in the 408 area code, but
 PJ> I can't recall the actual number). Anyways, thanks a bunch, all...

The number of the HomeBase BBS is 408-988-4004.  The 9600 HST number is
408-988-5138.

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 2910 *Virus Info*
08-24-90 23:05:00 (Read 7 Times)
From: CY WELCH
  To: TALLEY RAGAN
Subj: REPLY TO MSG# 2898 (REMOVING JOSHI)
In a message to Mike Mccune <20 Aug 90 17:09:00> Talley Ragan wrote:

 >MM>> Just be sure to boot off a clean diskette to remove the
 >MM>>virus from memory, otherwise the virus will not be removed.
 >MM>> If RMJOSHI is used on an unifected hard drive, it will
 >MM>>destroy the partition table. This next program, RETURN.COM
 >MM>>will restore the partition table.
 >MM>> I will post this program in my next listing...<MM>.

 TR>        Does this mean that RMJOSHI.COM, if run on an uninfected hard
 TR> drive by it self is a virus?

Actually I think it would fit the description of trojan rather than virus as it
doesn't replicate.

--- XRS! 3.40+
 * Origin: Former QuickBBS Beta Team Member (99:9402/122.1) (Quick 1:125/122.1)




Msg#: 2911 *Virus Info*
08-26-90 21:13:00 (Read 6 Times)
From: TOM PREECE
  To: SANDY LOCKE
Subj: REPLY TO MSG# 2758 (RE: REMAPPING...)
As you may see by looking at my other entry's, I have been loading a cache
program that is clearly implementing software to remap my keys to s certain
extent.  If this is possible as a glitch, its is obviously possible as an
attack.  Let's hope it never comes to that.
--- TBBS v2.1/NM
 * Origin: G.A.D.M. Multi-User TBBS Hayward,CA.[phone]  (1:161/208)




Msg#: 2993 *Virus Info*
08-27-90 07:54:00 (Read 7 Times)
From: JAMES DICK
  To: KEN DORSHIMER
Subj: REPLY TO MSG# 2762 (RE: HAVE ANYONE TRIED SECURE ?)
On Fri, 24 Aug, 1990 at the ungodly hour of 23:37, while ducking Broccoli Jello
and drinking jolt, Ken Dorshimer wrote to Kevin Higgins, TO WIT...

 KD > sounds like a plan to me. it would actually be fairly simple to write
 KD > a
 KD > program to look at all the files in your upload directory, unpack them
 KD > based
 KD > on the extension, scan them, then re-compress them (if needed). of

Sounds like CHECKOUT....available here, homebase excaliber! and others as
CKOT11.*

-={ Jim }=-




--- QM v1.00
 * Origin: The Clipperist - Home to happy Clippheads in Ottawa, Canada
(1:163/118.0)




Msg#: 2994 *Virus Info*
08-27-90 19:34:00 (Read 6 Times)
From: PHILLIP LAIRD
  To: ALAN DAWSON
Subj: REPLY TO MSG# 2750 (RE: SCAN WEIRDNESS)
** Quoting Alan Dawson to Patricia Hoffman **
 >among them a SCAN-known Dark Avenger. I SCAN this floppy from
 >the C
 >drive, and the "hey, nothing to worry about there" report comes
 >back.
 >Strange. I SCAN it again. This time 'round, SCAN barfs after
 >
 >--- Opus-CBCS 1.13
 > * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand
 >(3:608/9.0)
** End of Quote **

Allan, I NEVER SCAN from the C Drive or any hard disk.  I always scan from a
write protected Floppy Diskette in Drive A.  I also have a third system (Yep
that's right a third system to do all my scanning from.  However, I have never
had happen to me what happened to you.  I did one time find Scan.EXE infected
at my place of employment when I didn't write protect the floppy and scanned
the b drive, PLEASE write protect the floppy or SCAN.EXE on the hard drive...

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 2995 *Virus Info*
08-27-90 19:50:00 (Read 10 Times)
From: PHILLIP LAIRD
  To: SANDY LOCKE
Subj: REPLY TO MSG# 2753 (RE: VIRUS ORIGINALS)
Sandy, maybe this might help.  I have read an excellent book on the Subject of
Origins of Viruses, but let me quote you guys first...

** Quoting Sandy Locke to Sky Raider **
 >SR> effort to see what kind of stuff could be done with them,
 >a group of
 >SR> programmers (financed by the US government as I recall)
 >institued a se
 >SR> programs that would attempt to 'beat' others in taking
 >over a computer
 >SR> system. These programs led to a gaming system known as
 >the CORE WARS.
 >SR> today there is an International Core Wars Society.
 >
 >SR> I think it can be easily seen how a program to destroy/circumvent
 >a st
 >SR> operating system can develope into a virus.
 >
 >SR> I tried to double check this information for accuracy,
 >names, dates, e
 >SR> but it seems I have deleted this file. I will try to get
 >further info
 >SR> you, but beleive this info is shrouded in secrecy, and
 >may be hard to
 >SR> relocate.
 >
 >SR> So, the original viruses did come from the US (and even
 >possibly with
 >SR> government help).
 >
 >SR>                                Ivan Baird
 >SR>  * Origin: Northern Connection, Fredericton, N.B. Canada
 ><HST 14.4K>
 >SR> (1:255/3)
 >WHAT a LOAD of UNADULTERATED CRAP... redcode is simply a GAME
 >created by
 >bored programmers... ORIGINAL CORE WARS games were created
 >as far back
 >as 1969 back on the OLD IBM 360 architectures under both OS/MFT
 >and
 >OSMVT OS's... neither had anything to do with so-called secret
 >financing by the US government...BTW I was AROUND and A Systems
 >Programmer during that period... we created our own versions
 >when we
 >heard of the rumours... it was an old system programmers game
 >designed
 >to give Egotistal programmers some lighthearted fun... at this
 >point
 >ALL code ran in real Address space and redcode hadnt even been
 >though
 >of... the MUCH later article by Scientific American in 1979
 >gave this
 >fun with out harm via the redcode interpreter implemented on
 >early 6502
 >and 8080 systems... really... I am going to have to move to
 >canada...
 >sounds like there are some really potent and fun drugs in circulation
 >up there... jeese... what a simp...
 >   sandy
 >
 >
 >--- QM v1.00
 > * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813
 >(1:204/869.0)
** End of Quote **

O.K.  The above message is what I am quoting to you....

If you get a chance, you can pick this book up at Wladen Software at the
following locations in California and maybe other bookstores near you can order
the book, too:

                      Viruses, A High Tech Disease
                      By Ralph Burger
                      Published by Abacus
                      ISBN 1557550433
                      Retails at 18.95 US

Can be picked up at the following Walden Software Stores:

Doly City, Ca [phone]
San Leandro, Ca [phone]

It starts from way back when...

                      Phillip Laird

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 2996 *Virus Info*
08-27-90 19:58:00 (Read 7 Times)
From: PHILLIP LAIRD
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 2760 (RE: ONTARIO VIRUS)
** Quoting Patricia Hoffman to Phillip Laird **
 >after it was submitted by Mike Shields (Sysop of 1:244/114).
 > Ontario is a memory resident generic infector of .COM and
 >.EXE files, including COMMAND.COM.  Infected .COM files will
 >increase in length by 512 bytes.  Infected .EXE files will
 >A more complete description of the Ontario virus is in VSUM9008,
 >which was released on August 10.  The above is just off of
 >the top of my head, which happens to hurt right now.  Hope
 >it is understandable.....
 >
 >Patti
 >
 >
 >--- QM v1.00
 > * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813
 >(1:204/869.0)
** End of Quote **

Yea, I think Mike was the one the message came from I read about.  He Was
instrumental in helping us with another problem he found, too.  I am sure that
he is on the up and up about the hard disk problems.  Nope, I don't have the
Ontario Virus that I know of!  I read about the Virus after I had posted to
you,  Thanx for the info.  Nice to know where it loads in Mem, that would make
a util easier to write once I had a fix on what you have already told me.

I will see if I can locate that message from Mike about the Virus originally
and let you read it...

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 3029 *Virus Info*
08-26-90 14:01:00 (Read 7 Times)
From: RICK WILSON
  To: SANDY LOCKE
Subj: RE: CORE WARS
yep core wars was something that a bunch of people that had access to systems
messed with after hours, there was a artical in DDJ a few years ago about a
bunch of em out a Berkely of Stanford or something. really weired how these
folks that have recently ( within the last 8 to 10 years ) become such experts
on micros and mainframes and their history. later...
                                                                Rick

--- Telegard v2.5 Standard
 * Origin: Telegard BBS (000-000-0000) (1:161/88.0)




Msg#: 3030 *Virus Info*
08-26-90 16:45:00 (Read 7 Times)
From: JOE MORLAN
  To: CY WELCH
Subj: KEYBOARD REMAPPING.
In addition to PKWares's Safe-ANSI, ZANSI does not support keyboard remapping.
However, NANSI.SYS does have keyboard remapping.

--- Telegard v2.5 Standard
 * Origin: Telegard BBS (000-000-0000) (1:161/88.0)




Msg#: 3070 *Virus Info*
08-30-90 23:11:45 (Read 9 Times)
From: SKY RAIDER
  To: SANDY LOCKE
Subj: REPLY TO MSG# 2753 (Re: VIRUS ORIGINALS)
Firstly, I did not wish to anger you (although I seem to have done just this),
but only sought to answer your question to the best of my abilities (which you
seem to doubt).

Secondly, I stand by my original assertions that viruses were developed through
the original Core Wars gaming system. This has been corroborated by various
'virus gurus' here at the local university. In fact, without prompting, one
mentioned Bell Labs. Since, as you state, you are a Systems Programmer - it
should be obvious to yourself that a RedCode program could be easily adapted to
the microcomputer world. It should also be equally as obvious that these
RedCode experiments have laid the groundwork for many of the various virus
types infecting micros today (ie. trojans, worms, etc.).

Thirdly, I did not state, nor did I mean to imply (as you seem to believe),
that these RedCode 'fighter programs' are in fact the viruses we see today -
merely that they (RedCode fighters) provided the techniques for the micro
viruses. Furthermore, since the RedCode experiments were "old system
programmers games designed to give Egoistical programmers some lighthearted
fun", and since it is generally accepted that virus writers are in this for the
same reasons (the egotistical, not the fun), I find it hard to beleive that you
cannot equate the two.

If you will note in the extract below, I am not the only person who who
beleives the RedCode experiments were the forerunners of the modern viruses (in
fact, it may be noted they refer to these as viruses - which, of course, they
were);


From the Sept./89 issue of Popular Science;

Despite all the recent publicity, viruses aren't new. In the 1950's researchers
studied programs the called "self-altering automata," says Mike Holm...

In the 1960s computer scientists at Bell Laboratories had viruses battling each
other in a game called Core Wars. The object was to create a virus small enough
to destroy other viruses without being caught....


Also, just for the record, allow me to mention that this is an American
publication (apparently there are strange drugs down there too).

Again, for the record, allow me to mention that it is fact that Robert Morris,
Sr. was a participant in the Core Wars games. Is it a coincidence that his son
wrote the Internet Virus, or did his father give him the building blocks to
build upon? (With my apologies to the Morris family, but I felt this example
might carry some weight with Know-it-all System Programmers).

To answer your original question, in a form that you may deem acceptable (ie.
no RedCode, no mainframe systems, the US is not the origin - all those naive
things), the original micro virus was (at least in the IBM world, I can not be
sure this applies to early Apple ][ systems, or even the Pets from Commodore)
the "Pakistani Brain", released in Jan. '86.

But it must be noted (although I feel you will reject this also (ie. mainframe,
US, etc)), in Nov. '83, Fred Cohen, in 8 hours wrote a virus which attached
itself to users programs, and proceeded to use this program to gain access to
all system rights (in an average time of 30 mins). Also, although I don't have
a date (the computer name itself may give some indication of age) - on a UNIVAC
1108, with a secure operating system using the Bell-Lapadula model for OS
security, a virus was created that: infected the system in 26 hours, used only
legitimate activity with the Bell-Lapadula rules, and the infection took only
250 (approx.) of code (From "Computer Security: Are Viruses the AIDS of the
Computing Industry?", by Prof. Wayne Patterson, Chairman, Dept. of Computer
Science, University of New Orleans.).

I am not interested in a war of words, so I will suggest some reading before
you go off half cocked to this reply - "Computer Security; A Global Challenge,"
J.W. Finch & E.G. Douglas, eds., Elsevier Science Publishers, North-Holland -
especially the chapters by Fred Cohen. I have not read this, but will try to
when it becomes available to me. Also see the message posted by Phillip Laird.
--- TBBS v2.1/NM
 * Origin: Northern Connection, Fredericton, N.B. Canada <HST 14.4K>  (1:255/3)



Msg#: 3154 *Virus Info*
08-28-90 06:33:00 (Read 7 Times)
From: PATRICIA HOFFMAN
  To: ALAN DAWSON
Subj: REPLY TO MSG# 2994 (SCAN WEIRDNESS)
 AD>    Anybody heard of this? I've got a floppy with some viruses on it,
 AD> among them a SCAN-known Dark Avenger. I SCAN this floppy from the C
 AD> drive, and the "hey, nothing to worry about there" report comes back.
 AD> Strange. I SCAN it again. This time 'round, SCAN barfs after 64K of
 AD> the memory check, telling me Dark Avenger is in memory, power down,
 AD> load the .45, get the cyanide tablet ready and so on.
 AD>    But DA of course is NOT in memory or active in any way. It is,
 AD> however, on the floppy, unrun.
 AD>    The above occurred with SCANV64. Out of curiosity, I cranked up
 AD> SCAN-54 and -- EXACTLY the same result.
 AD>    AST Bravo 286, no TSRs, nothing else loaded, clean (normal) boot
 AD> just performed.
 AD>    I have a bunch of viruses that I don't expect SCAN to find --
 AD> ever. But this kind of thing has never happened to me before. Can
 AD> anyone match this story, or event?

There are a couple of possibilities here.  First, if the virus is on a
non-executable file, such as one with a .VOM or .VXE extension, Scan won't find
it since it is not one of the file extensions it checks for Dark Avenger.  In
this case, a subsequent run of Scan may find it in memory anyways since the DOS
buffers in memory are not cleaned out between program executions.  If this is
the case, running Scan with the /A option will find it on any file, regardless
of extension.

Likewise, if your copy of Dark Avenger has ever had a disinfector run against
it, it may have some "dead" Dark Avenger code after the end of file mark, but
within the last sector of the program as allocated on disk.  In this case, Scan
won't find it on disk, but may later find it in memory since the code after the
end of file mark was read in with the rest of the last sector of the program to
memory.  This is what is sometimes referred to as a "ghost virus", it isn't
really the virus, just dead remnant code remaining in the slack space in the
sector.  It can't be executed.  Running a disk optimization utility such as
Speed Disk from Norton Utilities will get rid of the "ghost virus".  They are
caused by the way DOS fills out the end of the buffer before it writes it out
to disk, doesn't always occur when disinfecting programs, but it sometimes will
occur.

The other case is if your copy of Dark Avenger does not occur at the correct
place in the file.  Dark Avenger always adds its code to the End Of Programs.
If your copy happens to have it at the beginning of the program, or perhaps
imbedded in the middle where it shouldn't be, it may not get found.  In this
case, your copy doesn't match either of the Dark Avenger's that McAfee has.

Hope that helps....those are the only three cases that I've heard of a similar
problem to yours.

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3155 *Virus Info*
08-28-90 15:16:00 (Read 5 Times)
From: KEN DORSHIMER
  To: JAMES DICK
Subj: REPLY TO MSG# 2993 (RE: HAVE ANYONE TRIED SECURE ?)

 On 27-Aug-90 with bulging eyes and flailing arms James Dick said:

 JD> On Fri, 24 Aug, 1990 at the ungodly hour of 23:37, while ducking
 JD> Broccoli Jello and drinking jolt, Ken Dorshimer wrote to Kevin
 JD> Higgins, TO WIT...
 KD >> sounds like a plan to me. it would actually be fairly simple to write
 KD >> a
 KD >> program to look at all the files in your upload directory, unpack them
 KD >> based
 KD >> on the extension, scan them, then re-compress them (if needed). of

 JD> Sounds like CHECKOUT....available here, homebase excaliber! and
 JD> others as CKOT11.*
 JD>
thanks but you might want to tell kevin higgins about that. :-) as for me,
hell i'll write the bloody thing myself. just wouldn't be a day without some
programming in it.

 ...All of my dreams are in COBOL...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 3156 *Virus Info*
08-27-90 14:14:00 (Read 5 Times)
From: MICHAEL CHOY
  To: ALL
Subj: IN THE MAC WORLD
Disinfectant 2.0 was released in July...it has the Disinfectant INIT, which is
like SAM only it removes viruses as well as detecting them..it catches the
Frankie virusa whoch in an old virus that ran on mac emulators for Atari..I
guess nobody has to worry about that...it also has much more info on protecting
yourself from virus and such..

--- Telegard v2.5 Standard
 * Origin: Telegard BBS (000-000-0000) (1:161/88.0)




Msg#: 3157 *Virus Info*
08-27-90 20:25:00 (Read 5 Times)
From: JOE MORLAN
  To: ALL
Subj: LHARC114?
I had heard that and infected version of LHARC was released last year under the
name LHARC114.  I also heard that because of that, the next release of LHARC
was expected to be LHARC200 to avoid confustion with the virus.  This week a
file appeared on a local board called LHARC114.  I left a message to the sysop
to check it out and he says it's clean.  The docs say that this is version
114b, the latest version.

Does anybody know what the deal is or was here?  Is LHARC114 safe to use?  Is
there a virus associated with this program?  Thanks.

--- Telegard v2.5 Standard
 * Origin: Telegard BBS (000-000-0000) (1:161/88.0)




Msg#: 3158 *Virus Info*
08-28-90 15:01:00 (Read 6 Times)
From: KEVIN HIGGINS
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 3155 (RE: HAVE ANYONE TRIED SECURE ?)
    Thanks for the info on CheckOut. I'd seen the file description usage
included in a .bat for for TAG, but never implemented it, or d/l'd the checkout
file because on my XT it sometimes takes awhile to dearc. a large .zip file--a
real pain for L/D types... Probably be wise to start using something like that,
though, since the BBS can do all the checking automatically following
uploads....
    Guess most users won't mind waiting a minute or so, if it makes their d/l's
almost certifiably safe.
                                            Kevin

--- TAGMAIL v2.40.02 Beta
 * Origin: The Hornet's Nest BBS (1:128/74)




Msg#: 3177 *Virus Info*
08-28-90 18:10:00 (Read 6 Times)
From: RICK PERCIVAL
  To: KEVIN HIGGINS
Subj: REPLY TO MSG# 3158 (RE: HAVE ANYONE TRIED SECURE ?)
 > command line and let the .bat file take care of unzipping, scanning
 > and rezipping the file.     Be best if someone would write a program
 > that would do this, but I haven't found one yet.
 >               Kevin

 Hi there, you guys must be behind the times or something but there is a very
good program which does exactly what you are looking for. Its called CHECKOUT.
The version we are using over here is called CKOT11.ZIP and it is a little
pearler!!

  What it does is, unzips a file, scans it and rezips it, menu driven or
command line driven. Try it, you'll love it.

--- FD 1.99c
 * Origin: The Cyclops BBS Auckland NEW ZEALAND (3:772/170)




Msg#: 3178 *Virus Info*
08-14-90 09:39:00 (Read 7 Times)
From: DAN BRIDGES
  To: KEN DORSHIMER
Subj: RE: CRC?
I've been reading, with interest, the messages about a program that provides a
demo of circumventing a single CRC generating program. I thought that its name
would be common knowledge, but apparently it isn't.

You were told the name of the file was MCRCx. May I suggest that you look for
it as FICHECKx. The one I got is v5 and has program called PROVECRC which
demonstrates the problem.


                        **********************
                        *  FICHECK  Ver 5.0  *
                        *  MFICHECK Ver 5.0  *
                        **********************

                 (C)Copyright 1988,1989 Gilmore Systems
              P.O. Box 3831, Beverly Hills, CA 90212-0831
                                 U.S.A.

             Voice: [phone]    Data: [phone]

Cheers,
Dan (no connection with the above firm).

--- Maximus-CBCS v1.02
 * Origin: Marwick's MadHouse (3:640/820)




Msg#: 3179 *Virus Info*
08-18-90 14:19:00 (Read 7 Times)
From: YVETTE LIAN
  To: FRED GOLDFARB
Subj: RE: VIRUS GROUPS....
FG> writing viruses".  The idea I got was that there are actual
FG> "virus groups" similar to the game cracking groups you hear
FG> of occasionally, who's sole purposes are to write viruses,
FG> not for research's sake, but to infect people.  Has anyone
FG> else heard of this before?  Are there really such groups?
FG> Imagine, when a new virus comes out three or four groups
FG> claiming to be the writers.. Kinda like terrorist bombings
FG> only different.  Come to think of it, I remember reading a

That'd be right... you would think that if these people were intelligent enough
to program something such as a virus they'd probably be better off not wasting
their time with it...

--- QuickBBS 2.64 (Eval)
 * Origin: Virus Info .. how to do it and not get it ! (3:640/886)




Msg#: 3180 *Virus Info*
08-18-90 14:42:00 (Read 7 Times)
From: ROD FEWSTER
  To: KERRY ROBINSON
Subj: RE: VIRUS CHECKERS
 > In a message of <12 Jun 90  7:31:31>, Patrick Curry (1:133/425) writes:
 >
 > Rarely does a MAC get a virus  It is an IBM phonomonum
                                  ^^^^^^^^^^^^^^^^^^^^^^^
Tell it to an Amiga user !!   B-)

--- FD 1.99c
 * Origin: The Edge of Reality .. THE NIGHTMARE BEGINS ! (3:640/886)




Msg#: 3181 *Virus Info*
08-30-90 13:01:00 (Read 7 Times)
From: BRIAN WENDT
  To: ALL
Subj: NEWSPAPER CLIPPING
The following item appeared in a newspaper in Brisbane, Austsralia yesterday.
Anyone care to comment?

VIRUS ATTACKS STATE'S PERSONAL COMPUTERS

A sophisticated computer virus is feared to have infected Queensland Government
and home computers.   The COMPUTER VIRUS INFORMATION GROUP at the QUEENSLAND
UNIVERSITY OF TECHNOLOGY has issued it first major warning to personal computer
users about the virus.

The virus, initially detected by the Israeli defence force, freezes computers
on September 22, the birthday of a character in Tolkien's book, 'Lord of the
Rings'.

A computer virus is a program designed to attach copies of itself to software
and disable a computer system, or destroy files.   Acting technologist, MR
EMLYN CREEVY said the warning was issued after a State Government public
servant gave the virus to the group for investigation.

Mr Creevy said somputers infected with the virus - known as FRODO, 4096, or
CENTURY - would freeze on September 22 or until the end of the year unless it
was removed.    He said the group expected to know if the virus had infected
computers in Queensland next week after users report the results of searches
they were requested to conduct.   The group warned all personal computer
operators that there was a bug in the FRODO virus which prevented it from
displaying a message 'FRODO LIVES' on September 22 and instead caused the
computer to 'hang' or freeze.

"It is from the FRODO name that the significance of the 22nd September can be
identified," they said.    "This is the birthday of Frodo Baggins in Tolkien's
story.    Users are advised to theck for the virus as soon as possible.

Mr Creevy said the virus had the ability to avoid detection and spread but was
not 'seriously destructive'.   He said it could become damaging if an expert
could disassemble the virus and change the instructions to wipe the computer's
disk.   "I'd say there's people working on it somewhere although probably not
in Australia," Mr Creevy said.

An expert would have created the Frodo virus because it had only one bug while
most viruses had more.

Mr Creevy said more than 100 viruses were believed to exist worldwide.

ENDS

Brian Wendt
Sysop
SUNMAP BBS

--- Maximus-CBCS v1.02
 * Origin: Sunmap BBS Node 5 (HST/DS) - Brisbane - Australia (3:640/206)




Msg#: 3182 *Virus Info*
08-28-90 19:33:00 (Read 7 Times)
From: SANDY LOCKE
  To: PATRICK TOULME
Subj: REPLY TO MSG# 3177 (RE: HAVE ANYONE TRIED SECURE ?)
MM> Maybe I should say all virus that are in the "public domain".
MM> Virus 101 is a research virus that only a few people have (and
MM> you wrote). Nothing is fool proof but Secure is better than any
MM> other interrupt moniter.

PT>
PT> I agree with you, Mike.

 and I have to concur with patrick, out of all the TSR type monitor
programs out there , SECURE is indeed the best of the group... BUT
PLEASE do NOT depend upon this as your ONLY protection... as on part of
a multilayered protection scheme it would be fine... I guess my real
problems with it stem from the NAME the Mark wasburn has chosen...it
can mislead the neophyte too easily...into thinking that it really is
the be-all and end-all of protection...I wouldnt hestitate to recommend
it over the socalled commercial products in this class... BUT again NOT
as a SOLE protection against viruses... sorry for any confusion my
comments may have caused...
     cheers
     sandy


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3183 *Virus Info*
08-28-90 19:35:00 (Read 6 Times)
From: SANDY LOCKE
  To: ALAN DAWSON
Subj: REPLY TO MSG# 2749 (RE: VIRUS SCANNERS....)
 DS> You can't win on this!  I've been downloading for quite a while
 DS> - always running a virus checker on the information.  So, where
 DS> did our virus come from?  Off a shrink-wrapped anti-virus
 DS> diskette one of our guys picked up in the US!

AD> Nothing new about this, as people learn all the time. One MAJOR
AD> company (really big, really well known) has shipped shrink-wrapped
AD> viruses twice -- once on purpose! Shrink wrap doesn't keep the bugs
AD> out.


 UH ALAN... you mind sending the NAME of this vendor via private
e-mail... accidentally I can understand BUT ON PURPOSE??? what end
would this kind of action serve???
    cheers
    sandy


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3184 *Virus Info*
08-28-90 19:44:00 (Read 6 Times)
From: SANDY LOCKE
  To: KEN DORSHIMER
Subj: REPLY TO MSG# 2905 (RE: CRC CHECKING)
well close... without discussing HOW its done... the file length is
altered back to the original length... its not that hard and does point
out one of the MAJOR problesm with crc scanners...that is that the
critical information that tells the operating system how long the file
is can be altered at will... as far as the comments of a virus author
disassembling the CRC package its commonly done during product testing
to find out ahead of time what algorithms are in use by the product...
it really depends on the level of security one wants for ones PC...
I really wouldnt put it past a good virus author to specifically
target anti-viral programs in this fashion... as far as disassemblies
being hard... well I do an average of 5-6 per day with files ranging in
size from 2k to 90k(although I will admit that some of the trickier
ones do cause head scratching occasionally...) note that i said
programs and not specifically viruses...
   cheers
   sandy


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3185 *Virus Info*
08-28-90 19:53:00 (Read 6 Times)
From: SANDY LOCKE
  To: TOM PREECE
Subj: REPLY TO MSG# 2911 (RE: REMAPPING...)
TP> As you may see by looking at my other entry's, I have been loading a c
TP> program that is clearly implementing software to remap my keys to s ce
TP> extent.  If this is possible as a glitch, its is obviously possible as
TP> attack.  Let's hope it never comes to that.
Tom,
    without adding too much fuel to any fire... certain
non-communication programs are susceptible to the ANSI programmable
attack... on my end I run no program that implements ANSI3.64
terminal control language without having a way to turn thoses "FEATURES
" off... certain programs without mentioning brand names do allow
this. if the echo moderator allows I will post a list of good and bad
programs in this regard... so that you can all protect yourselves
better...(n.b. after being chewed out by the moderator I am
constraining my comments carefully...)
   cheers
   sandyp.s. these attacks have been common since programmable
terminals came into being during the middle 1970's the problem is that
when these features were implemented in comm programs the possibility
arose that it was possible for malicious individuals to finally do some
real damage...the way to protect yourself is to STOP using programs
that implement such features and switch to others that are more secure
in their usage of such features...


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3186 *Virus Info*
08-29-90 05:44:00 (Read 6 Times)
From: PATRICIA HOFFMAN
  To: SANDY LOCKE
Subj: REPLY TO MSG# 3185 (RE: REMAPPING...)
 SL> attack... on my end I run no program that implements ANSI3.64
 SL> terminal control language without having a way to turn thoses "FEATURES
 SL> " off... certain programs without mentioning brand names do allow
 SL> this. if the echo moderator allows I will post a list of good and bad
 SL> programs in this regard... so that you can all protect yourselves
 SL> better...(n.b. after being chewed out by the moderator I am
 SL> constraining my comments carefully...)

Please feel free to go ahead and post the list.  Was just trying to keep you
out of trouble, you do sometimes get over excited in messages...didn't mean for
it to be "chewing out".

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3187 *Virus Info*
08-29-90 06:27:00 (Read 7 Times)
From: PATRICIA HOFFMAN
  To: PHILLIP LAIRD
Subj: REPLY TO MSG# 2996 (RE: ONTARIO VIRUS)
 PL> Nope, I don't have the Ontario Virus that I know of!  I read about the
 PL> Virus after I had posted to you,  Thanx for the info.  Nice to know
 PL> where it loads in Mem, that would make a util easier to write once I
 PL> had a fix on what you have already told me.
 PL>

Ontario loads into the top of free memory, right below the 640K boundary.  It
takes up 2,048 bytes.  If you run chkdsk after it is in memory, both total
system memory and free available memory will have decreased by 2,048 bytes.
Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3326 *Virus Info*
08-30-90 15:05:00 (Read 6 Times)
From: KEN DORSHIMER
  To: SANDY LOCKE
Subj: REPLY TO MSG# 3184 (RE: CRC CHECKING)

 ...at a time when Western civilization was declining
    too rapidly for comfort, yet too slowly to be very
    exciting Sandy Locke was saying:

 SL> well close... without discussing HOW its done... the file length is
 SL> altered back to the original length... its not that hard and does
 SL> point out one of the MAJOR problesm with crc scanners...that is that

interesting why don't you drop me some net-mail on this (see origin line)

 SL> the critical information that tells the operating system how long the
 SL> file is can be altered at will... as far as the comments of a virus
 SL> author disassembling the CRC package its commonly done during product
 SL> testing to find out ahead of time what algorithms are in use by the

i think that's one of the things i mentioned; that they would have to have
pre-existing knowledge of the crc scheme in order to make that work.

 SL> product... it really depends on the level of security one wants for
 SL> ones PC... I really wouldnt put it past a good virus author to
 SL> specifically target anti-viral programs in this fashion... as far as

one of the reasons i am interesting in developing my own anti-viral utils for
my software business.  i figure if they stay primarily in house, the chance
that some bozo will screw around with them and try to break them is reduced.

 SL> disassemblies being hard... well I do an average of 5-6 per day with
 SL> files ranging in size from 2k to 90k(although I will admit that some
 SL> of the trickier ones do cause head scratching occasionally...) note
 SL> that i said programs and not specifically viruses... cheers sandy

heh, yup source to assembled is always easier than the reverse process, of
course there's head scratching that goes on at that end too. :-)
the client said he wanted it to do what?!

 ...just part of the food chain...

--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 3327 *Virus Info*
08-29-90 11:37:00 (Read 6 Times)
From: PAUL FERGUSON
  To: EVERYONE
Subj: FLOPPY MBR BACKUP
I had originally posted this question to the moderator, but after a
little thought decided that I would be sure to receive a myriad of
answers from the ECHO participants if asking the question here,
also.....
      It is simply this:
 Does anyone have any decent (and simple) suggestions for extraction of
the floppy MBR???.....There are several very good utilities in the
public domain for strictly Hard Drive Boot Sector (ie. ST0) and other
utilities contained within, say for instance, PCTools, that can back-up
the HARD Drive Partition Table (I forgot to mention several PD programs
to back-up the FAT).....But, almost all of these that I have seen
pertain to the HDU! I realize that there are ways to write it to a file
using certain SPY-type programs, but what I am really interested in is
a simplified program that is easy to use at the lowest end of the USER
pyramid

  -Thanks in advance for your suggestions and assistance.....


  -Paul  ^@@^.........


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3328 *Virus Info*
08-29-90 18:46:00 (Read 6 Times)
From: PAUL FERGUSON
  To: EVERYONE
Subj: STEALTH FAMILY
I have read with great interest the July editions of VIRUS-L digest
(along with about the first week or so of August) and cannot, for the
life of me, figure the almighty hype with The (noticed that I
capitolized that!) Stealth Family of Virus....Only a Trojan should
deserve such attentention.....If one takes appropriate precautionary
measures, then the virus will (theoretically) be caught in memory..
...that is, it will make (and reside) a noticeable difference in
vectoring.....I truly believe WAY too much hype (Ok, maybe that is a
little strong!) has been given to this.....Yes, it can be a true menace
if one does not expect such a rogue, but come on.......I downloaded
some code today....Yes, I must say it IS quite ingenius, but at the
same time, I must also say, I enjoy the work I do, etc....

  PS.....Patrick Toulme, Check your E-Mail....


   ........"The Delicate Sound of Thunder".......


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3329 *Virus Info*
08-29-90 22:07:00 (Read 6 Times)
From: PAUL FERGUSON
  To: EVERYONE
Subj: LATENITE
Ok, so we're up again in the pale moonlite (unquote)...


    Next question (in paticular, to you, Sandy)
is:
    What diverse opinions do you have concerning those that, also,
fight the battle on the front lines (I'm noy alluding to who has any
more experience, to wit)...I feel that many of us (Tech
Support/Slash/Gov't Contractors)(No, We're not scum, nor
unknowledgable) have done much to benefit the Anti-Viral Research
Community.....I would like a little input on this topic.....



   .......We're not all BAD guys!........


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3330 *Virus Info*
08-31-90 13:05:00 (Read 6 Times)
From: HERB BROWN
  To: ALL
Subj: PKZ120.ZIP

I was informed that there is a bad version of PKZIP floating around by the name
of PKZ120.ZIP..  I am not sure if it is viral or not, but delete it if you find
it..


--- QM v1.00
 * Origin: Delta Point (1:396/5.11)




Msg#: 3331 *Virus Info*
09-01-90 11:34:00 (Read 7 Times)
From: DEREK BILLINGSLEY
  To: ALL
Subj: POSSIBLE VIRUS?

This just hit me today - I am not sure if it is some kind of system error or a
potential virus.

Last night (September first) and before gave me no indication of any virus
being present on my system. It is now september 1st and now, whenever a file is
written to disk (I noticed the text files first, but a downloaded zip'd file
was also garbled...) it took out about 10 bytes from the beginning of each
line...

When I realized this may be set to occur on this date, I set my DATE back a
night and everything worked fine... I made a sample text file with a known
pattern of characters -- any date past september 1st 1990 leaves the file
altered as mentioned above. Any date previous is written unharmed...

SCANV56 reports only that the SCAN program is damaged - no disk presence of the
source is evident.

Has anyone heard of something like this happening?

Derek Billingsley

--- SLMAIL v1.36M  (#0198)
 * Origin: Atlantic Access SJ/NB 1-506-635-1964 HST You can Run With Us !
(1:255/1)




Msg#: 3354 *Virus Info*
08-29-90 09:02:00 (Read 6 Times)
From: CY WELCH
  To: SANDY LOCKE
Subj: REPLY TO MSG# 2759 (KEYBOARD REMAPPING....)
In a message to Cy Welch <25 Aug 90  6:39:00> Sandy Locke wrote:

 >CW> In a message to Everyone <16 Aug 90  6:32:00> Paul Ferguson wrote:

 > PF> Isn't it possible to remap some (or any) keyboard functions via
 > PF> communications with some funky ANSI control characters?....I seem to
 > PF> remember mention of this somewhere.....I really can't remember if was
 > PF> in the form of a question, though, or an answer.....It also made
 > PF> mention of PKWares' Safe-ANSI program...Somebody help us out here...

 >CW> I think most of the "FAST" ansi replacements do not have the keyboard
 >CW> remapping so that danger is removed in those cases.
 SL> Well if you are referring to FANSI.SYS by hershey Microsystems it too
 SL> is vunerable to remap effects... and since it implemnt FULL ANSI 3.64
 SL> terminal control codes plus some extensions it is even more vunerable
 SL> to a whole class of tricks that go way beyond noremally keyboard
 SL> remapping... but to there credit they ahve include a way to turn this
 SL> "FEATURE" OFF... just most users get it off a BBS and never order or
 SL> look at the 50.00 set of docs that come when you pay for the
 SL> products...

Actually I was refering to zansi.sys which is a high speed replacement which
part of what they did to do it was to remove the keyboard remapping functions.

--- XRS! 3.40+
 * Origin: Former QuickBBS Beta Team Member (99:9402/122.1) (Quick 1:125/122.1)




Msg#: 3355 *Virus Info*
08-26-90 15:45:00 (Read 6 Times)
From: MIKE MCCUNE
  To: SANDY LOCKE
Subj: SECURE
Sandy,
Thanks for the information. I suspected that Secure probably had some
holes in its protection scheme and that someone knew about it. I am
curious about how the modified Jerusalem-B got around it. I'm pretty
sure how Virus 101 does it (the Air Force uses it) but I would like
to know if there are any other hole in secure...<MM>


--- Opus-CBCS 1.13
 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0)




Msg#: 3477 *Virus Info*
09-01-90 15:56:00 (Read 6 Times)
From: KEN DORSHIMER
  To: HERB BROWN
Subj: REPLY TO MSG# 3330 (RE: PKZ120.ZIP)
 >
 > I was informed that there is a bad version of PKZIP floating
 > around by the name of PKZ120.ZIP..  I am not sure if it
 > is viral or not, but delete it if you find it..

seem to remember seeing something about this a couple of months ago.
mostly, i wanted to drop a line and say "hey". got your net-mail, hopefully if
the routing is working right, you got a response. :-) how's new orleans this
time of year? later.



--- Opus-CBCS 1.12 & NoOrigin 3.7a


--- QM v1.00
 * Origin: Ion Induced Insomnia (1:203/42.753)




Msg#: 3478 *Virus Info*
09-02-90 10:45:00 (Read 6 Times)
From: JAMES KLASSEN
  To: PRAKASH JANAKIRAMAN
Subj: REPLY TO MSG# 2909 (LEPROSY)
   I have a copy of the Leprosy virus along with its source and
"documentation".  What it does is copies itself to 4 exe or com files
each time it is run and produces a memory error code so the user thinks
there is a problem with memory and runs it again. After all the com and
exe files have been infected, it displays a message that they have a
virus and "Good luck!"...   It increases file sizes by 666 but when I
tested it on a floppy, the bytes didn't increase...

--- W2Q v1.4
 * Origin: The C.F.I BBS * Norfolk, Va. * [phone] * (1:275/328)




Msg#: 3479 *Virus Info*
09-01-90 07:18:00 (Read 6 Times)
From: YASHA KIDA
  To: PAUL FERGUSON
Subj: REPLY TO MSG# 3329 (LATENITE)
In a message of <29 Aug 90 22:07:29>, Paul Ferguson (1:204/869) writes:

 PF> EID:6368 151db0ee
 PF> Support/Slash/Gov't Contractors)(No, We're not scum, nor
 PF> unknowledgable) have done much to benefit the Anti-Viral Research
 PF> Community.....I would like a little input on this topic.....
 PF>



I am a Private contractor for a Large Network installation an support company.
I work for the good of the Customer and the population (users).

I hear the phrase " SLIMY CONTRACTOR" " M.F.C." everyday. I also heard
"Can this be done", "Would you look into this...", "What are your suggestions
so I can put them in my report" when things get deep. We are the WHIPPING BOYS
and EMERGENCY 911 all in one.

I am sure there are Software contractors who have planted or released a virus
at contract renewal time. To show how much they are needed.
There are also those of us the that want to see their job sites safe from such
problems. We are the ones who own our time (Non-Paid) Compile information
on ways to safe guard our data from compermise or viral attacks.

The Anti-Viral reseach done by Mrs. Hoffman (PAT)  and John McAfees group
is carefully read and evaluated on my end. I am sure it has saved many a rear
from a bear trap.



--- msged 1.99S ZTC
 * Origin: Bragg IDBS, (FT. Bragg, NC - we're gonna kick some booty)
(1:151/305)




Msg#: 3480 *Virus Info*
09-02-90 19:19:00 (Read 6 Times)
From: HERB BROWN
  To: KEN DORSHIMER
Subj: REPLY TO MSG# 3477 (RE: PKZ120.ZIP)
With a sharp eye <Sep 01 15:56>, Ken Dorshimer (1:203/42.753) noted:
 >
 > I was informed that there is a bad version of PKZIP floating
 > around by the name of PKZ120.ZIP..  I am not sure if it
 > is viral or not, but delete it if you find it..
 KD>
 KD>seem to remember seeing something about this a couple of months ago.
 KD>mostly, i wanted to drop a line and say "hey". got your net-mail,
 KD>hopefully if the routing is working right, you got a response. :-)
 KD>how's new orleans this time of year? later.
 KD>


Hmmmm, first time I heard of this file.  How long ago did it appear?
Rained Sunday and had to BBQ inside.  Made watching TV a little hard, but we
managed.


--- QM v1.00
 * Origin: Delta Point (1:396/5.11)




Msg#: 3630 *Virus Info*
09-01-90 20:49:00 (Read 6 Times)
From: PAUL FERGUSON
  To: KEN DORSHIMER
Subj: REPLY TO MSG# 3326 (RE: CRC CHECKING)
Ken...

    I've GOT to agree with you on this one....only preconceived CRC
defeaters are just that...preconceived....no such luck...


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 3813 *Virus Info*
09-01-90 13:11:00 (Read 6 Times)
From: KEVIN HIGGINS
  To: JAMES DICK
Subj: SECURING YOUR UPLOADS
    I've got checkout, and while its a pretty neat program, there are a few
things I don't like about it, the main one being the initial memory scan. I
also don't like the auto-pause that seems to be at the beginning of it. That
means running gateway, which means the user may be able to get into DOS and
party. (have heard of Key-fake, but never seen it around to play with it..).
    TAG calls a file named postul.bat after every upload (if the .bat file is
present), so I hacked up this .bat file to auto-check for virii. But I'm not
smart enough to know how to use the %%f in a batch file to have it run through
for all the files in the active directory (for batch uploads)...
    Maybe there's a genius out there who can help. FYI the parameters passed to
the .bat file are: [Baud] [ComPort] [User#] [U/L Dir] [Filename].

Here it is. Chuckle, then help make it better <grin>.

echo off
cd\bbs\uploads
echo Verifying latest Pkzip version...... > com2
REM This program checks file integrity.
ozf -v %5 > com2
echo : > com2
REM These are the directories I don't want checked.
if %4 == D:\ZIPSTUFF\WRITERS\ goto end
if %4 == D:\ZIPSTUFF\AMIGA goto end
echo Testing file integrity, and checking for virii. > com2
echo Please wait..... (this is the scary part, eh?) > com2
echo : > com2
echo Moving the suspect file to a sterile cell for interogation.... > com2
REM This moves the file to an empty directory for the examination.
move %4%5 d:\bbs\bads
echo File is now undergoing interrogation... > com2
cd\bbs\bads
pkunzip -x D:\bbs\bads\%5 *.exe *.com > com2
scan d:\bbs\bads\*.exe /NOMEM > com2
scan d:\bbs\bads\*.com /NOMEM > com2
if errorlevel 1 goto Oops
echo Alright! (whew) File passed. > com2
del *.exe
del *.com
echo Almost finished. Releasing innocent file back into public. > com2
move %5 d:\bbs\uploads
echo : > com2
echo Now adding (Nested) zip comment to file... > com2
cd\
REM This adds the Hornet's Nest comment to the .Zip file.
call d:\commentr.bat
cd\bbs
echo Thanks for waiting!..
goto end
:Oops
echo Arrrrgghhhhh! File had a virus! File deleted! > com2
erase *.*
echo Logging your name to Scumbag.lst! > com2
echo Hey, Kato! User number %3 tried to upload a virus infected file! >>
d:\fd\scumbag.lst
echo Maybe you need to leave a message to Kato, eh? > com2
cd\bbs
:end


(Note: the fourth line from the end is a continuation of the line above it.)
Also, I have a program that will make a .com fil out of a .bat file, for faster
processing. Any reason why this couldn't be done with the above .bat file? How
about after the %%f is added?
                                            Kevin

--- TAGMAIL v2.40.02 Beta
 * Origin: The Hornet's Nest BBS (1:128/74)




Msg#: 3814 *Virus Info*
09-03-90 23:40:00 (Read 5 Times)
From: RICK THOMA
  To: HERB BROWN
Subj: REPLY TO MSG# 3480 (RE: PKZ120.ZIP)
 > Hmmmm, first time I heard of this file.  How long ago did it
 > appear?

   I have a copy, and think it came out around March, or so.  At the time,
SCANV detected no virus, but I thought better of running it.

   Sorry, folks.  Whatever it is, it isn't available for downloading, so please
don't ask.  I'm just waiting for the time to pick it apart, to see just what
kind of hack it is.

--- FD 2.00
 * Origin: Village BBS, Mahopac, NY  914-621-2719 *HST* (1:272/1)




Msg#: 3815 *Virus Info*
09-03-90 03:38:00 (Read 5 Times)
From: KEN DORSHIMER
  To: PAUL FERGUSON
Subj: REPLY TO MSG# 3630 (RE: CRC CHECKING)

 ...at a time when Western civilization was declining
    too rapidly for comfort, yet too slowly to be very
    exciting Paul Ferguson was saying:

 PF> Ken... I've GOT to agree with you on this one....only preconceived CRC
 PF> defeaters are just that...preconceived....no such luck...
 PF>

that's what i figured. that is if you're responding to the msg i think you're
responding to. what the hell does that mean?

 ...space is merely a device to keep everything from being
    in the same spot...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 3816 *Virus Info*
09-03-90 18:03:00 (Read 5 Times)
From: KEN DORSHIMER
  To: HERB BROWN
Subj: REPLY TO MSG# 3814 (RE: PKZ120.ZIP)

 ...at a time when Western civilization was declining
    too rapidly for comfort, yet too slowly to be very
    exciting Herb Brown was saying:

 HB> Hmmmm, first time I heard of this file.  How long ago did it appear?
 HB> Rained Sunday and had to BBQ inside.  Made watching TV a little hard,
 HB> but we managed.

i think it was a couple of months ago. which means any mention of it has long
since been renumbered off my system. yup BBQing indoors does have a certain
mystique. i know dinner is ready when the smoke alarm goes off.

 ...space is merely a device to keep everything from being
    in the same spot...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 3817 *Virus Info*
09-03-90 18:08:00 (Read 7 Times)
From: KEN DORSHIMER
  To: DEREK BILLINGSLEY
Subj: REPLY TO MSG# 3331 (RE: POSSIBLE VIRUS?)

 ...at a time when Western civilization was declining
    too rapidly for comfort, yet too slowly to be very
    exciting DEREK BILLINGSLEY was saying:

 DB> This just hit me today - I am not sure if it is some kind of system
 DB> error or a potential virus.
 DB>
 DB> Last night (September first) and before gave me no indication of any
 DB> virus being present on my system. It is now september 1st and now,
 DB> whenever a file is written to disk (I noticed the text files first,
 DB> but a downloaded zip'd file was also garbled...) it took out about 10
 DB> bytes from the beginning of each line...
 DB>

could you send a copy of what you believe is infected to me? i'd like to
analyse this myself, thanks.
my address is:
Dorshimer Software Systems
P.O. Box 191126
Sacramento, Ca. 95819-1126 USA

 ...space is merely a device to keep everything from being
    in the same spot...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 3818 *Virus Info*
09-03-90 20:57:00 (Read 4 Times)
From: JOHN HERRBACH
  To: ALL
Subj: PUBLIC KEY ENCRYPTION
Does anyone know the status or progress in regards to public key encryption?
Thanks.

John {|-)

--- ME2
 * Origin: The Lighthouse BBS/HST; Lansing, MI; 517-321-0788 (1:159/950)




Msg#: 3819 *Virus Info*
09-01-90 20:26:00 (Read 5 Times)
From: SEAN SOMERS
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 3186 (RE: REMAPPING...)

Off topic here, anybody out there encounter the French Revoloution virus? I was
the first out here to discover it. What it does is nuke your HD while
displaying an anti Western/English speaking Canadians.




--- outGATE v2.10
 # Origin: SIGnet International GateHost (8:7501/103)
 * Origin: Network Echogate (1:129/34)




Msg#: 3938 *Virus Info*
09-06-90 11:51:00 (Read 13 Times)
From: YASHA KIDA
  To: SKY RAIDER (Rcvd)
Subj: REPLY TO MSG# 2995 (RE: VIRUS ORIGINALS)

GLAD TO SEE SOMEONE  does their homework...

Well written.. If you don't mind I wish to post it as a bulletin
on my System (BBS).. Re written to as a document instead of a
msg reply...
                                                       '


Yasha
sysop 151/305



"What do you do when all of your users are in the sand lands, without a phone."






--- Maximus-CBCS v1.00
 * Origin: Bragg IDBS, We hunt bugs for the 82nd Airborne (1:151/305)




Msg#: 3974 *Virus Info*
09-08-90 13:42:35 (Read 5 Times)
From: SKY RAIDER
  To: YASHA KIDA
Subj: VIRUS POST ON BBS
Yasha,

You write:

GLAD TO SEE SOMEONE  does their homework...

Well written.. If you don't mind I wish to post it as a bulletin on my System
(BBS).. Re written to as a document instead of a msg reply...


Sure, no problems in rewritting and posting on your system. I try not to enter
into this type of a conversation without at least a bit of a footing in fact. I
wish I could find the original document I had quoting these things (it had
names, dates, etc.). How about giving me your system number so I can call and
see the finished form (never been quoted in this manner before).

                               A questor of knowledge,

                                        Sky Raider
                                        Ivan Baird, CET
--- TBBS v2.1/NM
 * Origin: Northern Connection, Fredericton, N.B. Canada <HST 14.4K>  (1:255/3)



Msg#: 4025 *Virus Info*
09-06-90 13:32:00 (Read 6 Times)
From: JONO MOORE
  To: JOE MORLAN
Subj: REPLY TO MSG# 3157 (LHARC114?)
JM >I had heard that and infected version of LHARC was released
JM >last year under the name LHARC114.  I also heard that
JM >because of that, the next release of LHARC was expected to
JM >be LHARC200 to avoid confustion with the virus.  This week a
JM >file appeared on a local board called LHARC114.  I left a
JM >message to the sysop to check it out and he says it's clean.
JM >The docs say that this is version 114b, the latest version.

LHARC v1.14b is a real release.  The author brought it out after the
controversy on the fake 1.14 release.




--- outGATE v2.10
 # Origin: SIGnet International GateHost (8:7501/103)
 * Origin: Network Echogate (1:129/34)




Msg#: 4026 *Virus Info*
09-05-90 19:47:00 (Read 5 Times)
From: PATRICIA HOFFMAN
  To: PAUL FERGUSON
Subj: LET ME REPHRASE THAT.....
 PF>     Actually, I really should have said "virtually preconceived".
 PF> From what I can gather on the topic (I don't yet have a copy of 4096),
 PF> they actually redirect CRC/Checksum interrogators to a "snapshot" of
 PF> the original file as it appeared before infection.(Someone, I'm sure,
 PF> will correct me if I'm wrong or at least add enlightenment.)

You are correct.....What the CRC/Checksum interrogator sees, if 4096 is in
memory, is the disinfected version of the program in memory, not what is
actually out on disk.  Fish 6 also does this, as do a couple of other viruses
using Stealth techniques.

 PF> The infected file, in the case of 4096, has in reality grown by 4096
 PF> bytes and would more than likely hang the system, therefore, which
 PF> would lead me to believe that running the CRC check without the virus
 PF> TSR would allow you to identify the actual infected files. Also, it
 PF> seems like the only way to catch it TSR is to trace the interrupt
 PF> vectors (although everyone seems to have a little bit of differing
 PF> ideas on this '->)

Lots of 4096 infected files will run without hanging the system....the virus
disinfects the program when it is read into memory so that anti-viral packages
can't find the virus as easily.  CRC checkers and scanners won't be able to
find it in the infected file if the virus is in memory, in fact, these viruses
usually infect on file open as well as execute.  Run a CRC checker or Scanner
that doesn't check memory for the virus with it present and you'll infect
everything that is openned that meets its infection criteria.

If the virus isn't in memory, the CRC checker technique will work to identify
the infected files in 99% of the cases.  I'm not going to say 100% because I
believe some of the 512 virus variants can get around it due to the way it
attaches to the files in some cases, but not all.  Some CRC checkers don't
actually CRC the entire file either....and as soon as I state it is a fool
proof way of doing it, someone will write a virus that gets around it
perfectly in all cases.

Patti

 PF>      Until I can get my hands on this little fellow, I guess that I'll
 PF> just follow the more logical explanations from the sources with
 PF> credibilty and make a judgement from that! Sounds credible. But, as I'v
 PF> said before-    I sure would like to see it.
 PF>
 PF>       I've been following several different message base threads on
 PF> this particular virus, with input from users at the basic levels to BBS
 PF> SysOps to the AntiViral research community.......I must say, it gets
 PF> overwhelming at times to keep objective. *:)
 PF>
 PF>      -Paul
 PF>
 PF>
 PF> --- QM v1.00
 PF>  * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813
 PF> (1:204/869.0)
 PF>

--- W2Q v1.4
 * Origin: The C.F.I BBS * Norfolk, Va. * [phone] * (1:275/328)




Msg#: 4027 *Virus Info*
09-07-90 12:48:00 (Read 4 Times)
From: MICHAEL ADAMS
  To: RICHARD HUFFMAN
Subj: RE: ARC.EXE
Thank you for the warning .... Kill keep an eye out for it.

--- Maximus-CBCS v1.00
 * Origin: The Southern Star - SDS/SDN/PDN - 504-885-5928 - (1:396/1)




Msg#: 4028 *Virus Info*
09-07-90 20:21:00 (Read 5 Times)
From: HERB BROWN
  To: JONO MOORE
Subj: REPLY TO MSG# 4025 (LHARC114?)

JM >I had heard that and infected version of LHARC was released
JM >last year under the name LHARC114.  I also heard that
JM >because of that, the next release of LHARC was expected to
JM >be LHARC200 to avoid confustion with the virus.  This week a
JM >file appeared on a local board called LHARC114.  I left a
JM >message to the sysop to check it out and he says it's clean.
JM >The docs say that this is version 114b, the latest version.

 JM>LHARC v1.14b is a real release.  The author brought it out after the
 JM>controversy on the fake 1.14 release.
 JM>

Now, how is someone going to know the difference?  That is about as dumb as
BBQ'ing indoors and forgetting to open the windows... Sheesh..


--- QM v1.00
 * Origin: Delta Point (1:396/5.11)




Msg#: 4029 *Virus Info*
09-07-90 20:25:00 (Read 4 Times)
From: HERB BROWN
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 4026 (LET ME REPHRASE THAT.....)


 PH>can't find the virus as easily.  CRC checkers and scanners won't be
 PH>able to
 PH>find it in the infected file if the virus is in memory, in fact, these
 PH>viruses
 PH>usually infect on file open as well as execute.  Run a CRC checker or
 PH>Scanner
 PH>that doesn't check memory for the virus with it present and you'll
 PH>infect
 PH>everything that is openned that meets its infection criteria.


I seem to be missing something here.  As I understand it, to check for virii
with a scanner, such as SCAN, or whatever, you boot from a uninfected floppy
that has scan residing on it.  Ok, now, how would a virus that works as a TSR,
that probably is loaded from the boot sector from the hard disk be loaded, if
you are booting from the floppy?  Which, the floppy being write protected, of
course, would not have this viral infection.  I was under the assumption that
the BIOS first checked drive A: at bootup for a disk, etc.  It seems that it
would be impossible to find a virii in memory with this type of scheme.. Please
enlighten me..


--- QM v1.00
 * Origin: Delta Point (1:396/5.11)




Msg#: 4030 *Virus Info*
09-07-90 17:03:00 (Read 5 Times)
From: TALLEY RAGAN
  To: MIKE MCCUNE
Subj: REPLY TO MSG# 2910 (RE: REMOVING JOSHI)


In a message to Talley Ragan <09-04-90 16:04> Mike Mccune wrote:

MM>>I have posted a new version that checks for the virus
MM>>before
MM>>trying to remove it (now that I have a working copy of the
MM>>virus). It will not damage the partition table on
MM>>uninfected
MM>>hard disks...<MM>.

        Thanks for the information.  This was very educational, as I have
had one case of a virus.  I don't know how it workedbut the screen would
show all garbage and then the computer would hang.  I low level formatted
the hard disk and restored from good backups.  I sure would like to know
how it got to me and where it came from!!...  Thanks again.


                Talley



--- ZAFFER v1.01
--- QuickBBS 2.64 [Reg] Qecho ver 2.62
 * Origin: Southern Systems *HST DS* Tampa Fl [phone] (1:377/9)




Msg#: 4031 *Virus Info*
09-05-90 21:23:00 (Read 5 Times)
From: TOM PREECE
  To: HERB BROWN
Subj: REPLY TO MSG# 3816 (RE: PKZ120.ZIP)
I seem to remember running into this file several months ago.  I don't remember
concluding that it had a virus - just that it didn't work properly. The sysop
on the sytem that had it apparently reached the same conclusion or something
similar because it disappeared here (SF Bay Area.)
--- TBBS v2.1/NM
 * Origin: G.A.D.M. Multi-User TBBS Hayward,CA.[phone]  (1:161/208)




Msg#: 4032 *Virus Info*
09-06-90 19:15:00 (Read 5 Times)
From: KEN DORSHIMER
  To: PAUL FERGUSON
Subj: REPLY TO MSG# 4029 (RE: LET ME REPHRASE THAT.....)

 ...at a time when Western civilization was declining
    too rapidly for comfort, yet too slowly to be very
    exciting Paul Ferguson was saying:

 PF> Ken- This is a continuation of msg.# 156 (I dropped the

just FYI the msg numbers don't have much bearing here. on my system is was
#75 or something. :-)

 PF> don't yet have a copy of 4096), they actually redirect CRC/Checksum
 PF> interrogators to a "snapshot" of the original file as it appeared
 PF> before infection.(Someone, I'm sure, will correct me if I'm wrong or

interesting. seems there would be some simple method of circumventing what
the virus does. (i don't have a copy of that one yet either)

 PF> system, therefore, which would lead me to believe that running the CRC
 PF> check without the virus TSR would allow you to identify the actual
 PF> infected files. Also, it seems like the only way to catch it TSR is to
 PF> trace the interrupt vectors (although everyone seems to have a little

i've always thought that by having your own tsr grab the interupts first
might be a good way to stop unwanted tsr's from grabbing them. (i'm sure
someone will argue the point tho)

 ...space is merely a device to keep everything from being
    in the same spot...


--- ME2
 * Origin: Ion Induced Insomnia (Fidonet 1:203/42.753)




Msg#: 4278 *Virus Info*
09-08-90 13:51:00 (Read 5 Times)
From: DUANE BROWN
  To: PHILLIP LAIRD
Subj: REPLY TO MSG# 3813 (SECURING YOUR UPLOADS)
 PL>present.  I have the Key fake program if it will help you!
 PL>That file will enter the "Y or N" Question when the batch
 PL>file comes to Are you sure? Y or N.  Meaning you had the
 PL>batch file to delete all programs in the temp check

That's easy to fix the problem about del *.* -- just do

echo y | del *.*

then the Y gets placed in there automatically...no keyfake, nothing!

---
 * Origin: End of the Line. Stafford, Va. [phone]. (1:274/16)




Msg#: 4279 *Virus Info*
09-07-90 12:45:00 (Read 5 Times)
From: CHARLES HANNUM
  To: PHILLIP LAIRD
Subj: REPLY TO MSG# 4031 (RE: PKZ120.ZIP)
 >Didn't someone say that because someone had already hacked an earlier
 >version of PKZIP that 120 would be the next scheduled release?
 >Anybody have any info?

Yes.  Phil Katz said it.

--- ZMailQ 1.12 (QuickBBS)
 * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0)




Msg#: 4280 *Virus Info*
09-08-90 10:49:00 (Read 4 Times)
From: JAMES BARRETT
  To: ALL
Subj: SEPTEMBER 18-20, 1990
I have heard somebody mention that there will be a major virus in the next
couple of weeks.  What's the scoop?  I'm involved in a college campus computer
lab and need to know what's coming and how to prepare for it.  Will ScanV66
catch it????

Thanks in advance...
--JCB
--- XRS 3.40+
 * Origin: >- c y n o s u r e -<  919-929-5153  <HST><XRS> (RAX 1:151/501.14)




Msg#: 4281 *Virus Info*
09-08-90 17:39:00 (Read 4 Times)
From: HERB BROWN
  To: KEN DORSHIMER
Subj: REPLY TO MSG# 4032 (RE: LET ME REPHRASE THAT.....)
With a sharp eye <Sep 06 19:15>, Ken Dorshimer (1:203/42.753) noted:

 KD>i've always thought that by having your own tsr grab the interupts
 KD>first
 KD>might be a good way to stop unwanted tsr's from grabbing them. (i'm
 KD>sure
 KD>someone will argue the point tho)

Depends on who got there first, I would presume.. Also, multiple TSR's would be
a nightmare, colliding and such.


--- QM v1.00
 * Origin: Delta Point (1:396/5.11)




Msg#: 4535 *Virus Info*
09-07-90 08:04:00 (Read 4 Times)
From: PAUL FERGUSON
  To: DOUG EMMETT
Subj: SCAN FROM C:
Hello, Doug....
       Doug, I must tell you that it is not advisable to run ViruScan
from your hard disc....It really should ALWAYS be run from a WRITE
PROTECTED FLOPPY....Scan can become easily infected when ran in an
infected environment on a HD. BTW....Software that "Write Protects" you
r hard disc may work in some cases, but can be circunvented.
Be safe.....
              -Paul


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 4536 *Virus Info*
09-07-90 08:06:00 (Read 4 Times)
From: PAUL FERGUSON
  To: LONNIE DENNISON
Subj: WELCOME...
Glad to have you........
                        Welcome aboard....
                                                -Paul   ^@@^........


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 4537 *Virus Info*
09-07-90 08:09:00 (Read 4 Times)
From: PAUL FERGUSON
  To: RICHARD HUFFMAN
Subj: REPLY TO MSG# 4027 (ARC.EXE)
Richard,
    Please E- me out of the conference....I would like to discuss this
a little further......Better yet, contact me at the NCSA BBS in DC
[phone] at 1200/2400, 8,N,1.....I can be reached in the VIRUS
Conference.....Thanks, -Paul


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 4538 *Virus Info*
08-16-90 08:30:00 (Read 5 Times)
From: ALAN DAWSON
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 3183 (RE: VIRUS SCANNERS....)
 PH> I just wish the people writing this viruses would find more
 PH> useful things to do with their talents....such as trying to
 PH> help people instead of harm their systems.

Hear, hear! The frustrating, rug-chewing, desk-beating,
monitor-smashing, stomp-down crying SHAME is that some of these
viruses, on a technical level, are tremendously slick, wonderous
programs. The people writing them are wonderful programmers. Just
think what these people could be doing to help our PCs work better by
writing a different kind of program -- and, potentially, how much
money they might be able to make. They obviously have inventive
minds, many of them. Such inventiveness could be put to such great
use.



--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 4539 *Virus Info*
08-16-90 08:36:00 (Read 5 Times)
From: ALAN DAWSON
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 4538 (RE: VIRUS SCANNERS....)
 PH> I'd agree with that.  The anti-viral program should be able to
 PH> detect that it is infected and produce a warning, though it may
 PH> still execute.  By the time the anti-viral program has
 PH> determined its been infected, you've already infected system
 PH> memory or spread the virus.

Sure. Something ELSE has infected it. No reason not to let it run so
long as it still works. One of our local youngsters wrote a wonderful
remover of the Dark Avenger -- about 1400 bytes and worked like a
charm. Only one teensy-weensy trouble -- the remover got infected and
didn't warn you. That's not really one of the more useful programs to
have around.
   Since it seems to be the constant topic of conversation here,
SCANV's routine of warning of infection and continuing its duties is
great.
   A common cause of re-infection is forgetting to remove the tools
you used in the disinfection process -- stuff like LIST, just for
example, that you might have used to examine the virus.




--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 4540 *Virus Info*
08-16-90 08:52:00 (Read 5 Times)
From: ALAN DAWSON
  To: MICHAEL TUNN
Subj: REPLY TO MSG# 2899 (RE: WHAT'S THE SOLUTION?)
 MT> It seems to me our Virus checking programs will just get bigger
 MT> and bigger as more viruses and strains of the same viruses are
 MT> discovered. If so (and if their development is excelerating)

Right. Question of the Year (1991??): What can you call it after you've
hit the SCANV999 wall?

 MT> Do we do develop new Operating Systems which are far more
 MT> secure!

Well, at least a new DOS which allows 9-character names? Then we
could do SCANV9999. [joke].

 MT> Do we crawl in a hole and hope it wont happen to us?

No, in a metaphor placed in 1970 terms, we get to the airport two
hours before flight time for the security checks. And for the same
reason, too -- the unwillingness of the many to take the resolve to
remove the few. We have, most of us, helped the virus writers build
up their existing sick belief that we are willing participants in
some kind of game here. They win if they manage to steal our time,
programs, disk space and data. They only do it because they had an
unhappy childhood, right?
   One tangible result of allowing them to feed on this warped view
is this echo, where we're all trying to get to the airport two hours
early for the security check -- AND WE'RE ALL WASTING TWO HOURS
because somebody we don't know might try to hurt us.
   We should have sympathy for Robert Morris, of course, because
after all, he was just experimenting and not REALLY trying to hurt
anyone, right? I have a one-word, two-syllable response to that but
FidoNet policy frowns down upon me for thinking of using it.



--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 4541 *Virus Info*
08-16-90 09:25:00 (Read 4 Times)
From: ALAN DAWSON
  To: KEN DORSHIMER
Subj: RE: VIRUSES, WHAT ELSE...
 KD> not sure on that one, who knows what menagerie of thoughts
 KD> wander through clients minds.. :-)  actually, i was unaware of
 KD> Corporate Vaccine (maybe I should get out more). I'm a little
 KD> concerned that the commercial programs may not be aware of some
 KD> of the newer viruses which crop up from time to time.

This is just a thought, too. But why not take your clients into your
confidence, and point out to them that it is virtually impossible for
anyone to match the up-to-dateness of a BBS distribution system?
You're a BBSer. You know, just for example, that without BBSes McAfee
couldn't have a program-of-the-week. Distribution of what your
clients think of as commercial software simply isn't up to this
standard -- isn't meant to be; never was; probably never will be.
   Seems to me if your clients like the SCANV concept, you should
explain to them why they should be using SCANV. Why reinvent the
wheel?
   If it wasn't that commercial messages which mention something
other than SCANV often seem to get flamed here, I'd tell you about my
commercial, non-BBS, wholly generic virus detector that doesn't need
upgrading, which is available in North America and which soon will be
launched there. But I don't want to get flamed, so I won't.



--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 4542 *Virus Info*
08-29-90 12:26:00 (Read 5 Times)
From: ALAN DAWSON
  To: KEN DORSHIMER
Subj: REPLY TO MSG# 3815 (RE: CRC CHECKING)
 PH>> Except in the case of Stealth Viruses....CRC checking doesn't work
 PH>> with them.
 PH>>

 KD> i'd have to see that for myself. i think a complex enough
 KD> algorithm would keep them at bay. the probability factor is
 KD> just too low for such a stealth scheme to work.

Roger that. A program (such as a virus) can possibly figure out a
checksum or CRC and "fool" your checker. But complex and random
checksumming or CRCing is beyond the real-world possibility of defeat
by a PC virus -- it would have to be too big and complex itself.
   Our strategy on our anti-virus program is to have eight different
algorithms, and to use two of them on each checksum pass. Which two,
even we do not know. Your virus then would have to take into account
64 reasonably complex algorithmic possibilities to defeat it.
   Patti is technically correct that this can be done -- but not in
the real world. I'd tend to be slightly suspicious if my word
processor suddenly grew by the size of THIS virus. Most programs
would, in fact, be incapable of loading it.
   As you say -- make it complex (which isn't so difficult) and keep
churning out hundreds of different algorithms. Then you can forget
about "stealth" viruses succeeding.

   - From Thailand, a warm country in more ways than one.





--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 4543 *Virus Info*
09-01-90 21:26:00 (Read 5 Times)
From: ALAN DAWSON
  To: PHILLIP LAIRD
Subj: REPLY TO MSG# 3154 (RE: SCAN WEIRDNESS)
 PL> Allan, I NEVER SCAN from the C Drive or any hard disk.  I
 PL> always scan from a write protected Floppy Diskette in Drive A.

This is absolutely correct, of course, and EXACTLY what's recommended
in the doc. I was just curious whether others had had the experience.
I do do some experimenting with viruses and anti-virus stuff, because
Bangkok's a "virus capital" (dumb dealers plus a whole raft of
pirates) and because I'm involved in a commercial anti-virus project.
This was just a weird thing that happened to me when I was "playing"
with Dark Avenger. I do wonder how many people follow that
"write-protected floppy" recommendation (order???) in the SCAN docs,
though.
   One note on your comment: it might be hard for some people to
follow the recommendation, i.e. those with one floppy. The total
beauty of SCAN, really, is to look over that new stuff. A lot of
machines go to new people with one floppy drive.
   A lot also go with two different floppy drives (my own setup)
although this of course is combatted simply by having TWO
write-protected diskettes with SCAN aboard.
   - From Thailand, a warm country in more ways than one.





--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 4544 *Virus Info*
09-01-90 23:00:00 (Read 5 Times)
From: ALAN DAWSON
  To: SANDY LOCKE
Subj: REPLY TO MSG# 3819 (RE: REMAPPING...)
 SL>  long time programmer I can testify the keyboard mapping is
 SL>  really quite simple... no real problem and the business of
 SL>  using terminal control code is quite as simple...
 SL>     sandy

Finally, some sanity, sandy. [grin] (no pun intended until after I
read that). The letter bomb, as a friend calls it, is alive, well and
could certainly flourish. I wouldn't lay a huge amount of money on
the ability to write a *virus* with remapping, but a bomb's a piece
of cake.
   I THINK this thread started with the ability to put one directly
over a terminal BBS-to-user connection, and in general there seem by
my own experiments to be two chances of this: slim and fat. But, like
a virus, a letter bomb can be transmitted via a BBS to a user, and
then set off by that user in a number of pernicious ways that occur
to me right off the top of my head. None of which you will see writ
here, you understand -- but after watching this thread for a few
weeks, I'm glad you leapt in with both feet.
   - From Thailand, a warm country in more ways than one.





--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 4545 *Virus Info*
09-06-90 18:59:00 (Read 5 Times)
From: ALAN DAWSON
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 4543 (RE: SCAN WEIRDNESS)
 PH> There are a couple of possibilities here.  First, if the virus
 PH> is on a non-executable file, such as one with a .VOM or .VXE

Nope, wasn't either of these Patti. I tried to put in everything, and
then forgot to say it was a regular file called AVENGER.COM -- a
small utility I infected to harbor the virus when I ran it for tests.
The utility originally was a small screen shell for looking at files
a la LIST. It USED to be 3K, but now it's a little bigger [grin]

 PH> The other case is if your copy of Dark Avenger does not occur
 PH> at the correct place in the file.  Dark Avenger always adds its
 PH> code to the End Of Programs. If your copy happens to have it at

Roger. This is right up against the end of the file.

 PH> Hope that helps....those are the only three cases that I've
 PH> heard of a similar problem to yours.

OK, no biggie. It was just that it was so weird I thought maybe you'd
heard of it. I'll try it again when we get SCAN66B just for fun. It's
not the kind of "bug" that's detrimental -- it's just one of those
hey-it's-not-supposed-to-do-that things. Stupid machines.
   - From Thailand, a warm country in more ways than one.





--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 4546 *Virus Info*
09-06-90 19:00:00 (Read 5 Times)
From: ALAN DAWSON
  To: SANDY LOCKE
Subj: REPLY TO MSG# 4539 (RE: VIRUS SCANNERS....)
 SL>  UH ALAN... you mind sending the NAME of this vendor via private
 SL> e-mail... accidentally I can understand BUT ON PURPOSE??? what
 SL> end would this kind of action serve???
 SL>     cheers
 SL>     sandy

This was before the Great Virus Scare of 1989 of course -- it was, if
my tremendously failing memory isn't failing me, in 1986. A Toronto
magazine put the virus in as a joke -- every time you started an
infected program, a brief ad for the mag jumped up. Ald. . . whoops,
the company name almost slipped out there, thought this was
hilarious, left it in and shipped the thing. I'll send full details
your way.
   This same company, the next time it shipped viruses, claimed that
a guy in the shipping department was playing a game and accidentally
infected the shipment (exclaimer!!!!). Is this a company with a weird
sense of security, or what?
      - From Thailand, a warm country in more ways than one.





--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 4746 *Virus Info*
09-09-90 14:33:00 (Read 4 Times)
From: CHARLES HANNUM
  To: PHILLIP LAIRD
Subj: RE: MAKING SCAN READ ONLY.
 > Patti, is it feasible to make Scan.Exe Read only?  Doug Emmett was
 > wondering about doing that.  Couldn't you change the archive bits to
 > read only?  Also, doesn't scan have an internal routine to determine
 > if it is damaged?

Setting the "Read-only" attribute wouldn't even *phase* a decent virus, and
SCAN's internal checksum is VERY weak.  (It quite literally is a checksum.
It simply checks to see if all the words in the files add up to 0.)

--- ZMailQ 1.12 (QuickBBS)
 * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0)




Msg#: 4747 *Virus Info*
09-09-90 07:35:00 (Read 5 Times)
From: JERRY MASEFIELD
  To: CHARLES HANNUM
Subj: REPLY TO MSG# 4279 (RE: PKZ120.ZIP)
 >  >Didn't someone say that because someone had already hacked an earlier
 >  >version of PKZIP that 120 would be the next scheduled release?
 >  >Anybody have any info?
 >
 > Yes.  Phil Katz said it.

No, Phil Katz said there WOULDN'T be a 120 release because of the same reason.
This would eliminate any confusions between the real and phony versions.  Also,
Katz is offering a reward for any info leading to the arrest of the perpetrator
of this hacking.


--- TosScan 1.00
 * Origin: On A Clear Disk You Can Seek Forever! (1:260/212)




Msg#: 4748 *Virus Info*
09-09-90 23:16:00 (Read 5 Times)
From: PHILLIP LAIRD
  To: CHARLES HANNUM
Subj: REPLY TO MSG# 4747 (RE: PKZ120.ZIP)
** Quoting Charles Hannum to Phillip Laird **
 >Yes.  Phil Katz said it.
 >
 >--- ZMailQ 1.12 (QuickBBS)
 > * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0)
** End of Quote **

That is what I thought.  As soon as he went and said it, somebody appearently
decided to hack it, huh?

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 4749 *Virus Info*
09-08-90 17:42:00 (Read 4 Times)
From: PAUL FERGUSON
  To: KEN DORSHIMER
Subj: YEAH, BUT...
You're on the right track, Ken....But TSR's have a nasty habit of
fighting for control amongst each other. Some do not behave very well.
-Paul


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 4750 *Virus Info*
09-09-90 08:43:00 (Read 6 Times)
From: PATRICIA HOFFMAN
  To: PHILLIP LAIRD
Subj: JERUSALEM B AND CLEANP64.ZIP
 PL> I cleaned 17 infected files today with clean version 64.  I have a good
 PL> question.  While the program removes the file, some where removed the
 PL> first time around, others were scanned several times before the virus
 PL> was actually removed.  Can you tell me why?

The programs that were scanned several times probably were infected multiple
times with Jerusalem virus.  A lot of the variants of Jerusalem B will infect
.EXE files repeatedly, eventually the program will get too large to fit into
memory.  On files that are infected multiple times with Jerusalem, you'll see a
message come up for each infection as it is removed.

That is my guess as to what you observed...

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 4751 *Virus Info*
09-09-90 11:01:00 (Read 5 Times)
From: PATRICIA HOFFMAN
  To: HERB BROWN
Subj: REPLY TO MSG# 4281 (LET ME REPHRASE THAT.....)
 HB> I seem to be missing something here.  As I understand it, to check for
 HB> virii with a scanner, such as SCAN, or whatever, you boot from a
 HB> uninfected floppy that has scan residing on it.  Ok, now, how would a
 HB> virus that works as a TSR, that probably is loaded from the boot sector
 HB> from the hard disk be loaded, if you are booting from the floppy?
 HB> Which, the floppy being write protected, of course, would not have this
 HB> viral infection.  I was under the assumption that the BIOS first
 HB> checked drive A: at bootup for a disk, etc.  It seems that it would be
 HB> impossible to find a virii in memory with this type of scheme.. Please
 HB> enlighten me..

The memory resident viruses that are a real problem when they are in memory and
any antiviral, whether a scanner or CRC checker, is run are not boot sector
infectors....4096, Fish-6, Dark Avenger, and many others which infect on file
open are file infectors.  There are three that are file infectors but can also
infect and replicate from the partition table and/or boot sector: V2100,
Anthrax, and Plastique 5.21.  (These last three are extremely rare, fairly new,
and not known in the United States.)  All of the viruses mentioned about use
"Stealth" techniques to avoid detection or infect on file open.

If you are booting from an uninfected diskette when powering on the computer,
you wouldn't ever find a virus in memory.  However, if you are performing a
warm reboot from a floppy, you could have a virus in memory still.  The real
point here was that most people do not run scan or other anti-viral utilities
after powering on and booting from a floppy, so it is always possible for the
virus to be in memory.

In that particular case, for a CRC checker which is what was being discussed,
there are definite cases (the "Stealth" viruses) where the virus can get around
the CRC checker simply because if the virus is in memory it disinfects the
infected programs as they are read into memory.  The CRC checker, since it is
performing file reads, reads the DOS buffers to check the program, so the
program it sees isn't infected and isn't the same as what is actually on the
disk.  In the case of viruses that infect on file open, running an anti-viral
product against all the programs on a system with the virus active in memory
can very well result in all the programs becoming infected.

I'm not against CRC checkers, I use one all the time on several of my systems.
These systems all have master boot diskettes with clean system files, the CRC
checker, and the log of all the expected crc values to be returned.  Most
people simply do not have that type of diskette setup for their systems since
they feel they'll never be infected with a virus.  In fact, the probability
that a person will be infected with a virus is fairly low, though it does
change depending on the person's computing habits and how often they exchange
diskettes and/or programs with others.

I was trying to point out that NONE of the current anti-virals will absolutely
protect a user from getting a virus....all the techniques currently used by
anti-viral products can be circumvented by some of the newer, more
technologically advanced viruses.  Not to point that out would be like burying
one's head in the sand, especially when the discussion has to do with someone
thinkin of writing a new anti-viral who needs to know what can currently be
circumvented.  It is easier to fix the design before the program is written
then to fix it later after the hole is found....

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 4967 *Virus Info*
09-10-90 16:55:00 (Read 5 Times)
From: CHARLES HANNUM
  To: JERRY MASEFIELD
Subj: REPLY TO MSG# 4748 (RE: PKZ120.ZIP)
 >>  >Didn't someone say that because someone had already hacked an earlier
 >>  >version of PKZIP that 120 would be the next scheduled release?
 >>  >Anybody have any info?
 >>
 >> Yes.  Phil Katz said it.

 > No, Phil Katz said there WOULDN'T be a 120 release because of the
 > same reason. This would eliminate any confusions between the real
 > and phony versions.  Also, Katz is offering a reward for any info
 > leading to the arrest of the perpetrator of this hacking.

Err, <retracting foot from mouth> I must have misread the original note...

--- ZMailQ 1.12 (QuickBBS)
 * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0)




Msg#: 4968 *Virus Info*
09-10-90 17:54:00 (Read 5 Times)
From: CHARLES HANNUM
  To: WHOM IT MAY CONCERN
Subj: LHARC 1.14B(ETA)
The 'b' is actually a beta, which makes me think he released it for testing
and it got loose, but is not yet an "official" release.

At any rate, I NEED AN ANSWER!!  I have "LHarc 1.14b(eta)", and I really need
a definitive answer.  IS IT REAL OR NOT?

--- ZMailQ 1.12 (QuickBBS)
 * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0)




Msg#: 4969 *Virus Info*
09-10-90 23:13:00 (Read 4 Times)
From: PHILLIP LAIRD
  To: DUANE BROWN
Subj: REPLY TO MSG# 4278 (RE: SECURING YOUR UPLOADS)
** Quoting Duane Brown to Phillip Laird **
 >
 >That's easy to fix the problem about del *.* -- just do
 >
 >echo y | del *.*
 >
 >then the Y gets placed in there automatically...no keyfake,
 >nothing!
 >
 >---
 > * Origin: End of the Line. Stafford, Va. [phone]. (1:274/16)
** End of Quote **

Thanx....  Using the pipe redirection will do just that like you say.  I use
the KEYFAKE Program for a reason with KEY.DAT in the program I just finished
that will check for bugs in uploads.  It calls the routine externally from the
Execute file.

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 4970 *Virus Info*
09-10-90 23:21:00 (Read 6 Times)
From: PHILLIP LAIRD
  To: ALAN DAWSON
Subj: REPLY TO MSG# 4545 (RE: SCAN WEIRDNESS)
** Quoting Alan Dawson to Phillip Laird **
 >
 >This is absolutely correct, of course, and EXACTLY what's recommended
 >
 >in the doc. I was just curious whether others had had the experience.
 >
 >I do do some experimenting with viruses and anti-virus stuff,
 >because
 >Bangkok's a "virus capital" (dumb dealers plus a whole raft
 >of
 >pirates) and because I'm involved in a commercial anti-virus
 >project.
 >--- Opus-CBCS 1.13
 > * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand
 >(3:608/9.0)
** End of Quote **





I totally agree that most people do not read the docs.  I work for a University
in South East Texas.  Some of the Micros have been plagued with viruses.  I
have setup a routine for the Labs to Scan the Floppies coming in with SCAN.
This has just taken Place.  Next thing I know, the clerk decides to run SCAN
From her hard drive on her desktop!  Then Alameda hit her!  The SCAN Program
has gone over good at the University.  We are getting an order ready for a Site
License Agreement with MCafee and Associates.  I do a little research on some
of the strains.  However this BBS keeps me busy after work!

Weird thing about CLEAN.EXE the program to remove the Viruses.  I am using
Clean Version 66 and sometimes the program will scan the file numerous times
before the virus is eventually removed.  I guess the Marker is trying to move
around in the file?  Anybody know?

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 4971 *Virus Info*
09-09-90 10:59:00 (Read 5 Times)
From: MIKE BADER
  To: MARC SHEWRING
Subj: INFORMATION
Several anti-virus programs use signature files.
IBM (yech) for one, but VirHUNT by DDI alos
uses a file for signatures and goes into
quite a bit of detail in their manual.
I'll look up a better address and phone.

Mike

--- FD 1.99c
 * Origin: P-1 BBS ][ [phone] Ferndale, MI (HST) (1:120/45)




Msg#: 4972 *Virus Info*
09-06-90 20:56:00 (Read 8 Times)
From: CY WELCH
  To: DEREK BILLINGSLEY
Subj: REPLY TO MSG# 3817 (POSSIBLE VIRUS?)
In a message to All <01 Sep 90 11:34:00> Derek Billingsley wrote:

 DB> This just hit me today - I am not sure if it is some kind of system
 DB> error or a potential virus.

 DB> Last night (September first) and before gave me no indication of any
 DB> virus being present on my system. It is now september 1st and now,
 DB> whenever a file is written to disk (I noticed the text files first,
 DB> but a downloaded zip'd file was also garbled...) it took out about
 DB> 10 bytes from the beginning of each line...

 DB> When I realized this may be set to occur on this date, I set my DATE
 DB> back a night and everything worked fine... I made a sample text file
 DB> with a known pattern of characters -- any date past september 1st
 DB> 1990 leaves the file altered as mentioned above. Any date previous
 DB> is written unharmed...

 DB> SCANV56 reports only that the SCAN program is damaged - no disk
 DB> presence of the source is evident.

 DB> Has anyone heard of something like this happening?

Can't say I have heard of that but it sure sounds like a virus.  I would
recommend getting a copy of scan v64 and see what it says.  It might even be
something new.


--- XRS! 3.41+
 * Origin: Former QuickBBS Beta Team Member (99:9402/122.1) (Quick 1:125/122.1)




Msg#: 4973 *Virus Info*
08-14-90 18:15:00 (Read 5 Times)
From: JAMES BLEACHER
  To: DOUG BAGGETT
Subj: REPLY TO MSG# 2904 (ANTI VIRUS VIRUSES)
 * Replying to a message originally to Patricia Hoffman
 DB>well..here is a question..where exactly did viruses
 DB>originate anyway..was it in this country or others?
 DB>Doug

According to want I've read Dr. Fred Cohen at MIT developed the first virus
back in 1964 or so. This was to prove that code could actually replicate and
spread throughout a mainframe. My question is why on earth would he want to do
that in the first place?
---
 * Origin: "Hey! Why's my COMMAND.COM larger than normal?" (1:151/801)




Msg#: 4974 *Virus Info*
08-14-90 18:23:00 (Read 5 Times)
From: JAMES BLEACHER
  To: PAUL FERGUSON
Subj: REPLY AND ADDENDUM TO MSG 145
 * Replying to a message originally to Alan Dawson
 PF>You can always be sure of an uninfected SCAN IF you download
 PF>from the
 PF>authors' BBS....The program itself will terminate upon
 PF>detection and
 PF>has safeguards written into it to protect against such
 PF>occurances....Of
 PF>course, there are ways for an unsuspecting user (You know
 PF>who) to
 PF>infect the programs themselves and then re-archive
 PF>unwittingly a
 PF>viral Scan that will never know (depending upon the

WRONG! Scan checks itself upon startup and will give you a message to the
effect of:

FILE DAMAGED! "C:\SCAN.EXE"

But will continue to operate. If you see that message then you're in big
trouble. Viruses like the Dark Avenger will use scan's file checking (since it
opens all the files it's checking) to spread itself all over your floppy/hard
drive. Unless you've got a totally new virus that scan can't detect you don't
have anything to worry about if it's already infected when you get it. (Except
that it's probably detecting the virus all over your drive because it just
helped put it there!)
---
 * Origin: "Hey! Why's my COMMAND.COM larger than normal?" (1:151/801)




Msg#: 4975 *Virus Info*
09-10-90 18:02:00 (Read 6 Times)
From: JAMES BLEACHER
  To: DEREK BILLINGSLEY
Subj: REPLY TO MSG# 4972 (POSSIBLE VIRUS?)
 DB>SCANV56 reports only that the SCAN program is damaged - no
 DB>disk presence of the source is evident.
 DB>
 DB>Has anyone heard of something like this happening?

Well, first of all you've got an old version of scan. Try downloading scanv66b
from someone. I have it if you can't locate it elsewhere. Second if scan ever
reports being damaged there's a 99% chance that you've got a virus! Better
check into it quick! Hope you don't find that you have one but it sure sounds
like you do!
---
 * Origin: "Hey! Why's my COMMAND.COM larger than normal?" (1:151/801)




Msg#: 5238 *Virus Info*
09-10-90 15:11:00 (Read 6 Times)
From: JOE MORLAN
  To: JONO MOORE
Subj: REPLY TO MSG# 4028 (RE: LHARC114?)
  I have learned from other sources that the latest official release of LHARC
is LH113D.  The 'new' LHARC114 is said to be another unauthorized hack.  It
evidently is NOT a virus.  Yoshi has been quoted as stating on GENIE that the
next official release will be ver. 2.0.  I hope this helps.

--- Telegard v2.5i Standard
 * Origin: Telegard BBS (000-000-0000) (1:161/88.0)




Msg#: 5239 *Virus Info*
09-10-90 15:12:00 (Read 6 Times)
From: JOE MORLAN
  To: HERB BROWN
Subj: REPLY TO MSG# 5238 (RE: LHARC114?)
Exactly.  LHARC v1.14b is not a real release.  Just another unauthorized hack.

--- Telegard v2.5i Standard
 * Origin: Telegard BBS (000-000-0000) (1:161/88.0)




Msg#: 5240 *Virus Info*
09-07-90 20:35:00 (Read 6 Times)
From: CHRIS BARRETT
  To: SIMON FOSTER
Subj: RE: MYSTERY VIRUS??
Could I ask wy the buffers would be causing the Boot Block to be altered.

I have since removed the val checks using ScanV66B and put some new ones on
using ScanV66B.

Could it be possible that someone has altered a bit of the code and as ScanV66
uses a string (or is it hex search) it doesn't find it?

eg In the Virus it originaly said "Your disk is stoned' and the person
converted it to say 'Your disk is now stoned'. If ScanV66 happens to look for
the original string to my knowlegde the virus would not be recognized.

Chris.
--- TBBS v2.1/NM
 * Origin: 1990 MultiLine Perth Western Australia - 09-370-3333 - (690/654)




Msg#: 5241 *Virus Info*
09-12-90 22:11:00 (Read 6 Times)
From: PHILLIP LAIRD
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 4751 (RE: LET ME REPHRASE THAT.....)
** Quoting Patricia Hoffman to Herb Brown **
 >If you are booting from an uninfected diskette when powering
 >on the computer, you wouldn't ever find a virus in memory.
 > However, if you are performing a warm reboot from a floppy,
 >you could have a virus in memory still.  The real point here
 >was that most people do not run scan or other anti-viral utilities
 >after powering on and booting from a floppy, so it is always
 >possible for the virus to be in memory.
** End of Quote **

THat is exactly the way I have found some of the Virii I researched as being.
If the virus is present in memory, then it is possible the the file will
infect, however, if the Scan Diskette is write protected and the diskette is
bootable, Like oyu say.  It is BEST to cut the power to the system and then
re-boot the system.  However, if you wanted to go a step further, it is
possible to clear all volatile RAM if you want to do a warm boot.  The Warm
Boot can result in infection, since the ram is not cleared.  The various
hardware interrupts are still performed and cotrol passed to Command.com, but
the System files are still present in memory, along with a virus possibly.  Too
many people are now taking the virus issue too lightly.  It can effect you,
take precaution and use the Floppy to boot up on with a Write Protect on the
Diskette.  Then scan the drive from there.

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 5242 *Virus Info*
09-12-90 22:16:00 (Read 6 Times)
From: PHILLIP LAIRD
  To: PATRICIA HOFFMAN
Subj: RE: JERUSALEM B AND CLEANP64.Z
** Quoting Patricia Hoffman to Phillip Laird **
 > PL> I cleaned 17 infected files today with clean version 64.
 > I have a good
 > PL> question.  While the program removes the file, some where
 >removed the
 > PL> first time around, others were scanned several times before
 >the virus
 > PL> was actually removed.  Can you tell me why?
 >
 >The programs that were scanned several times probably were
 >infected multiple times with Jerusalem virus.  A lot of the
 >variants of Jerusalem B will infect .EXE files repeatedly,
 >eventually the program will get too large to fit into memory.
 > On files that are infected multiple times with Jerusalem,
 >you'll see a message come up for each infection as it is removed.
 >
 >
 >That is my guess as to what you observed...
 >
 >Patti
 >
** End of Quote **

That is exactly what I had suspected.  I assumed the file was re-infected
several times as the size of the Original WP.EXE files that were infected once
was for example 112K, and the ones that were infected several times was around
173K.  Some of the programs were non functional after clean ws performed on the
file.  We just delte the file and re-copy it when that happens.  The only safe
way to do it I have found is to go ahead anuse scans' /D option and delete the
file and re-copy it.

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 5887 *Virus Info*
09-14-90 14:05:00 (Read 5 Times)
From: MIKE MCCUNE
  To: PATRICK TOULME
Subj: MOTHER FISH
Everybody was talking about the Mother Fish a few weeks ago. Now that it has
been out for mor than a week, nobody is saying anything about it. What's the
deal with this virus?


--- Opus-CBCS 1.13
 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0)




Msg#: 6048 *Virus Info*
09-14-90 07:05:00 (Read 4 Times)
From: JOE MORLAN
  To: CHARLES HANNUM
Subj: REPLY TO MSG# 4968 (RE: LHARC 1.14B(ETA))
  According to folks posting on the technical echo, Yoshi has stated on Genie
that the next official release after LHarc 1.13c will be LHarc 2.xx.  Beta
versions of LHarc 2.0 are said to have been released in Japan.  It is illogical
that 114b would be a valid release.  The main change is the same as the known
unauthorized hack, ICE.

 There are a few people on that echo that seem to believe that the release is
"real" based mostly on the source where the file had been posted.  It seems
clear to me that it is just another unauthorized hack.

--- Telegard v2.5i Standard
 * Origin: The Twilight Zone (415)-352-0433 (1:161/88.0)




Msg#: 6659 *Virus Info*
09-15-90 08:13:00 (Read 4 Times)
From: RICHARD HECK
  To: ALL
Subj: CLEAN UP
I think that the newest version of cleanup was alot better then the version
before it.
Oh and watch out for that Sunday Virus.




--- outGATE v2.10
 # Origin: SIGnet International GateHost (8:7501/103)
 * Origin: Network Echogate (1:129/34)




Msg#: 6660 *Virus Info*
09-16-90 11:28:00 (Read 5 Times)
From: SATYR DAZE
  To: CHRIS BARRETT
Subj: REPLY TO MSG# 5240 (RE: MYSTERY VIRUS??)

Sorry to butt in ..... you aparently have been infected by the Stoner-Marijauna
Virus , quite a few people here in florida myself included have seen this
little beauty.

After disinfecting yourself the damaged caused by the virus is unaltered.
 Backup your harddrive and reformat it, after restoring it.  Delete and redo
Autoexec.bat and Config.sys they have both also been altered.

Your Hardrive should now be back to snuff .... but before i forget run a
utility to mark and lock out bad sectors the Virus may have caused.  These
unfortunaly are not always recoverable.


G'Day .......................     The Satyr Daze
--- TBBS v2.1/NM
 * Origin: Eclectic Multi-BBS System / Miami FL [phone]  (1:135/2)




Msg#: 6661 *Virus Info*
09-16-90 11:39:00 (Read 4 Times)
From: SATYR DAZE
  To: GARY MOYER
Subj: REPLY TO MSG# 4546 (RE: VIRUS SCANNERS....)
Well you can  Download a Virus scanner from a reputable BBS -- one that
actually checks all of it's files for viruses --- or go out and purchase a
Virus Scanner.  Most of the downloadable stuffis by Mcaffe Associates, You can
purchase Virucide (commercial version) which checks and disinfects your files,
also by Mcaffe Associates for about $30.00. Not a bad buy when you consider the
consequences of not having a good scanner.

Just make sure that after Downloading a file, unarc-unzip-unwhatever it, But
under no circumstance activate it --- run it --.  Run the scanner, if the file
checks clean go ahead and run it then.  If it dosn't the program will warn you
and disinfect it.  The reason you must open the file (unzip) is because
scanners can't look into an archived file.

                                          The Satyr Daze
--- TBBS v2.1/NM
 * Origin: Eclectic Multi-BBS System / Miami FL [phone]  (1:135/2)




Msg#: 6662 *Virus Info*
09-16-90 13:40:00 (Read 4 Times)
From: SATYR DAZE
  To: CHARLES HANNUM
Subj: REPLY TO MSG# 4973 (RE: ANTI VIRUS VIRUSES)
Actually the Honor of creating Viruses Belongs to John Conway, he was trying to
develop software that emulated living organisms.  He developed the first "Game
of Life".  As he created these new programs they became more and more complex
having intricate enviroments that the elements would have to over come in order
to survive.

But these were never allowed to get beyond that scope, Virus programs where
never destructive untill the "Core Wars".  Opposing Programmers would create
self-replicating programms that when they encountered other self-replicaters
would try to devour them.  Incidently it was called "Core Wars" because the
game itself took place in Core Memory .  These young Programmers were actually
quite small in number and never publicly discussed what they were doing.  If
any blame is to be attached it should be to Ken THompson who went public with
the process in 1983..... at that point it was "Discovered" by university
students who began creatingthe real nasties ..... Today many strains are just
variation of their original work.

Just a little History...............

                                              The Satyr Daze
--- TBBS v2.1/NM
 * Origin: Eclectic Multi-BBS System / Miami FL [phone]  (1:135/2)




Msg#: 6663 *Virus Info*
09-14-90 19:31:00 (Read 5 Times)
From: RAJU DARYANANI
  To: ALL
Subj: NETWARE BYPASSING JERUSALEM VIRUS
Does anyone have any details on the CERT announcement that it has
isolated a version of the Jerusalem virus that can bypass Novell
Netware's file protection settings and infect files ?  Anyone know
of actual infections, how common it is and whether McAfee's SCAN detect
this virus ?

Raju

--- via Silver Xpress V2.24 [NR]


--- QM v1.00
 * Origin: TAIC Maximus - DVNet Asia, PEP/V.32 High Speed PathFinder
(3:700/1.0)




Msg#: 6664 *Virus Info*
09-16-90 00:41:00 (Read 4 Times)
From: ALAN DAWSON
  To: PHILLIP LAIRD
Subj: REPLY TO MSG# 4970 (RE: SCAN WEIRDNESS)
 PL> been plagued with viruses.  I have setup a routine for the Labs
 PL> to Scan the Floppies coming in with SCAN.  This has just taken
 PL> Place.  Next thing I know, the clerk decides to run SCAN From
 PL> her hard drive on her desktop!  Then Alameda hit her!  The SCAN

The next "killer-ap" should be the anti-stupidity program. If ever it
needed to be proved that "a little knowledge is a dangerous thing,"
computer users prove it to their techies daily!

 PL> Weird thing about CLEAN.EXE the program to remove the Viruses.
 PL> I am using Clean Version 66 and sometimes the program will scan
 PL> the file numerous times before the virus is eventually removed.

I really don't like the whole idea of a "popular" virus remover. (A
specific cure for a specific virus on one site is different.) Any
yo-yo with PC-Tools or Norton can make a "new" virus and this makes
the possible results from a removal program very iffy. I really
believe in brute-force removal i.e. DEL VIRUS.COM, and re-install.
It's safer that way, and certain (after you check the floppies, of
course).
   - From Thailand, a warm country in more ways than one.





--- Opus-CBCS 1.13
 * Origin: PCBBS -- WOC'n in the Land of Smiles -- Thailand (3:608/9.0)




Msg#: 7165 *Virus Info*
08-31-90 20:15:00 (Read 4 Times)
From: CHRIS BARRETT
  To: ALL
Subj: BOOKS ON VIRUSES
Could someone tell me somenames of books on Viruses and their authors.
As I am in Australia getting hold of them may be a problem though.

Hope you can help...
Chris..
--- TBBS v2.1/NM
 * Origin: 1990 MultiLine Perth Western Australia - 09-370-3333 - (690/654)




Msg#: 7166 *Virus Info*
08-31-90 20:21:00 (Read 5 Times)
From: CHRIS BARRETT
  To: ALL
Subj: REPLY TO MSG# 6660 (MYSTERY VIRUS??)
At my school we have some XT's with 2 360K FDD each. Lately we have noticed
that some of the students disks are being over written by the program disk they
were using. Eg some people have found the Turbo pascal files on their data
disks.

I brought in a copy of ScanV66 and placed a validation check on the program
disks (Not the data disks). Scanning showed no viruses (well known ones
anyway). But when we scanned them a week later we found some had had their Boot
Blocks altered.

In some cases the files on the data disk are just renamed to one on the program
disk. Eg we listed "TURBO.EXE" and found it to contain a students pascal source
code.

Could someone shed some light please..
I have told the teacher it is most likely home grown and he is sh*tting
himself.

Chris.
--- TBBS v2.1/NM
 * Origin: 1990 MultiLine Perth Western Australia - 09-370-3333 - (690/654)




Msg#: 7167 *Virus Info*
09-01-90 18:28:00 (Read 4 Times)
From: DOUG EMMETT
  To: PHILLIP LAIRD
Subj: REPLY TO MSG# 6664 (RE: SCAN WEIRDNESS)
For the new boy would you mind explaining how to write protect Scan.Exe on the
C: drive-Thanks


--- Opus-CBCS 1.13
 * Origin: The U.S.A. Connection-*HN-NZ*-([phone]) (3:772/260.0)




Msg#: 7168 *Virus Info*
09-02-90 14:18:00 (Read 4 Times)
From: WARREN ANDERSON
  To: MIKE DURKIN
Subj: REPLY TO MSG# 2475 (INTERNET WORM)
Hi, No I have never come across the book. I would appreciate it if you could
provide a copy of the password list (just in case I can't get hold of a copy of
the book). Thanks again.
Regards
\/\/ /\/\ Anderson

--- Telegard v2.5 Standard
 * Origin: InfoBoard BBS - Auckland - New Zealand (3:772/140.0)




Msg#: 7169 *Virus Info*
09-04-90 06:12:00 (Read 4 Times)
From: PAUL FERGUSON
  To: YASHA KIDA
Subj: REPLY TO MSG. 134
Right on, Yasha......I couldn't have said it better myself.....This
town (DC) seems to have a real problem concerning this. That's OK,
though, as you have said, we shall see who they come running to when
the going gets rough.....

    -Paul


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 7170 *Virus Info*
09-05-90 12:50:00 (Read 4 Times)
From: MICHAEL ADAMS
  To: RICK THOMA
Subj: RE: PKZ120.EXE
Rick .. I had one uploaded to my Board called "PKZ120.exe".  The File looks
Authentic.  Even went to the point of -AV and the Pkware registeration number
on the last line after self extraction.  If it were not for the file
"Warning.txt" put out by "Pkware" I'd still be using it. Really went through
alot of trouble authenticating it!

Michael Adams
Baud Horizons
[phone]

--- Maximus-CBCS v1.00
 * Origin: The Southern Star - SDS/SDN/PDN - 504-885-5928 - (1:396/1)




Msg#: 7171 *Virus Info*
09-05-90 16:06:00 (Read 4 Times)
From: LONNIE DENISON
  To: ALL
Subj: HEY
  Just letting you know that I have joined my board (The Maze) to this echo..
hope we can contribute some info here!

  Lonnie Denison

--- Telegard v2.5i Standard
 * Origin: => The Maze <=  916-391-6118  "Would ya Believe" (1:203/60.0)




Msg#: 7172 *Virus Info*
09-05-90 18:28:00 (Read 4 Times)
From: PHILLIP LAIRD
  To: KEVIN HIGGINS
Subj: REPLY TO MSG# 4969 (RE: SECURING YOUR UPLOADS)
Kevin, nice batch file for testing files for virrii.  I am now Alpha testing my
new program that will work with TAG at present.  I have the Key fake program if
it will help you!  That file will enter the "Y or N" Question when the batch
file comes to Are you sure? Y or N.  Meaning you had the batch file to delete
all programs in the temp check directory.  I plan on a new realease of the
program to several BBSES that will work to help all Sysops keep out the Virii.
If you want Keyfake Program, just Tell me, and I will netmail it to you...  I
had a run in with Jerusalem B [jeru] today at Lamar University.  Seems the
Chemistry Department stockroom manager had already infected 17 files on his
hard drive.  Clean removed the virus.

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 7173 *Virus Info*
09-05-90 18:30:00 (Read 5 Times)
From: PHILLIP LAIRD
  To: PATRICIA HOFFMAN
Subj: REPLY TO MSG# 4750 (JERUSALEM B AND CLEANP64.ZIP)
Patti:

I cleaned 17 infected files today with clean version 64.  I have a good
question.  While the program removes the file, some where removed the first
time around, others were scanned several times before the virus was actually
removed.  Can you tell me why?

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 7174 *Virus Info*
09-05-90 18:32:00 (Read 4 Times)
From: PHILLIP LAIRD
  To: RICK THOMA
Subj: REPLY TO MSG# 4967 (RE: PKZ120.ZIP)
Didn't someone say that because someone had already hacked an earlier version
of PKZIP that 120 would be the next scheduled release?  Anybody have any info?

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 7175 *Virus Info*
09-05-90 18:37:00 (Read 4 Times)
From: PHILLIP LAIRD
  To: ALL
Subj: PROCOMM 3.10
Beware, there is a version of Procomm.zip going around in our area here in
Texas which boasts Procomm 3.10.  After consulting with my friend at Datastorn
Technologies, he called my BBS and downloaded the file.  I had a user complain
that the file hung and said "NUKE" at the lower left of his terminal.
Datastorm Technologies stated that this version doesn't exist, I.E.... the
latest was 2.4.3.  The same user told me that the file one night then put a
message on his screen that stated "Does this IBM PC or Compatible have more
than one drive? Y or N "  He immediately turned off the computer and didn't
answer the question.  Althought we scanned this program and found no virus, we
disassembled it and also didn't find anything suspicious either.  Be careful,
it might be a time bomb.  If you know of this program, let me know at 1:19/49.
I would like to keep tabs on it.

--- TAGMAIL v2.20
 * Origin: DATAMANIAC'S HIDEOUT BBS 409-842-0218/BEAUMONT,TX (1:19/49)




Msg#: 7176 *Virus Info*
09-04-90 16:04:00 (Read 4 Times)
From: MIKE MCCUNE
  To: TALLEY RAGAN
Subj: REPLY TO MSG# 4030 (RE: REMOVING JOSHI)
I have posted a new version that checks for the virus before
trying to remove it (now that I have a working copy of the
virus). It will not damage the partition table on uninfected
hard disks...<MM>.


--- KramMail v3.15
 * Origin: The Slowboat BBS (404-578-1691) Atlanta, GA (1:133/311.0)




Msg#: 7177 *Virus Info*
09-04-90 13:31:00 (Read 4 Times)
From: PAUL FERGUSON
  To: KEN DORSHIMER
Subj: REPLY TO MSG# 5241 (LET ME REPHRASE THAT.....)
Ken-

    This is a continuation of msg.# 156 (I dropped the
keyboard....Looong day, you know).....

    Actually, I really should have said "virtually preconceived".
From what I can gather on the topic (I don't yet have a copy of 4096),
they actually redirect CRC/Checksum interrogators to a "snapshot" of
the original file as it appeared before infection.(Someone, I'm sure,
will correct me if I'm wrong or at least add enlightenment.)
The infected file, in the case of 4096, has in reality grown by 4096
bytes and would more than likely hang the system, therefore, which
would lead me to believe that running the CRC check without the virus
TSR would allow you to identify the actual infected files. Also, it
seems like the only way to catch it TSR is to trace the interrupt
vectors (although everyone seems to have a little bit of differing
ideas on this '->)
     Until I can get my hands on this little fellow, I guess that I'll
just follow the more logical explanations from the sources with
credibilty and make a judgement from that! Sounds credible. But, as I'v
said before-    I sure would like to see it.

      I've been following several different message base threads on
this particular virus, with input from users at the basic levels to BBS
SysOps to the AntiViral research community.......I must say, it gets
overwhelming at times to keep objective. *:)

     -Paul


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 7178 *Virus Info*
09-05-90 09:20:00 (Read 4 Times)
From: PAUL FERGUSON
  To: EVERYONE
Subj: DETAILED INFO ON 4096...
The description in VSUM (August 15 release) of the 4096 virus has
gotten my usual curiousity arouser, along with a plethora of discussion
on this particular virus within many message conferences and viral
echos......Since I have not had the opportunity, yet, to obtain a
sample to personally examine, I must post a few questions to the field:


  1.) Would someone like to elaborateon the structure of "Phases" that
       the CVIA uses to catorgorize viruses? Please?    ;-)

  2.) I seem to remember mention (No, I don't have my copy of VSUM in
front of my now) of the virus (4096) containing it's own boot sector.
Could someone enlighten me on this , also?

  3.) And, under what ? circumstances does the 'FRODO LIVES' msg.
appear and when does it not?


No offense, Patti, but I did think that on a couple of these points
that the VSUM doc was kinda sketchy (I know that is ALOT of work to
compile that baby and continually update, etc.!).
     Perhaps with a little more detail, I will have settled my
curiousity and returned to other problems at hand...

                                          -Paul

Patti- Any luck with last U/L?    ,-)


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 7179 *Virus Info*
09-05-90 20:34:00 (Read 5 Times)
From: PATRICIA HOFFMAN
  To: SEAN SOMERS
Subj: REPLY TO MSG# 4544 (RE: REMAPPING...)
 SS> Off topic here, anybody out there encounter the French Revoloution
 SS> virus? I was the first out here to discover it. What it does is nuke
 SS> your HD while displaying an anti Western/English speaking Canadians.

Haven't seen or heard of that one before.... What does it infect?  .COM, .EXE,
overlays, boot sectors, only floppies?  If you want to send me a copy of it,
I'd be happy to take a look at it as well as pass it along to John McAfee's
group.  Snail mail address is:

        Patricia M. Hoffman
        1556 Halford Avenue #127
        Santa Clara, CA  95051

It can also be sent in a .ZIP file to my system, though be sure you don't route
it thru anyone, or directly uploaded here to a suspect area that is secured.

Not off-topic at all, that is what this conference is for....

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 7180 *Virus Info*
09-05-90 20:01:00 (Read 5 Times)
From: PATRICIA HOFFMAN
  To: PAUL FERGUSON
Subj: REPLY TO MSG# 7178 (DETAILED INFO ON 4096...)
 PF>   1.) Would someone like to elaborateon the structure of "Phases" that
 PF>        the CVIA uses to catorgorize viruses? Please?    ;-)
 PF>

VSUM doesn't necessarily use the McAfee or CVIA categorization techniques to
classify viruses.  VSUM's categorization is a bit finer than McAfee's since in
many cases he can group things together for detection/removal purposes.
However, in describing them they don't make much sense that way.  I haven't
seen a copy of the CVIA categorization in some time, but I believe they
classified by:

        boot sector infector
        parasitic file infector
        overwriting file infector

Partition table infectors were (I think) thrown in with boot sector infectors
since at the time the only partition table infector was Stoned, which also
infected floppy boot sectors.  They also classified by memory resident or
non-resident.

Generally, VSUM classified by memory resident/non-resident, what it infects,
file length change, symptoms, and other characteristics, as well as what virus
the new entry is based on if applicable.  In the case of memory resident
viruses, there is a code to indicate how or where it is memory resident.

McAfee and I had a loooonnnnnggggg discussion on classification and naming
awhile back, and "agreed we could disagree" since how he uses the names in Scan
isn't workable for VSUM, and using the VSUM naming in Scan would not serve his
purposes since he needs to group variants in many cases.  If possible, though,
we try to use the same names.  If VSUM differs, the name that will be indicated
by Scan is indicated as an alias.  McAfee's current classification methods as
indicated in VIRLIST.TXT which comes out with Scan also differs from the CVIA
classifications, and is fairly close to VSUM.

 PF>   2.) I seem to remember mention (No, I don't have my copy of VSUM in
 PF> front of my now) of the virus (4096) containing it's own boot sector.
 PF> Could someone enlighten me on this , also?
 PF>

Yes, it includes a boot sector, though do to an error in the virus, the
included boot sector isn't ever written to the hard disk or floppy boot sector.
This boot sector is where the "FRODO LIVES" message is....

 PF>   3.) And, under what ? circumstances does the 'FRODO LIVES' msg.
 PF> appear and when does it not?
 PF>

Normally, due to a bug in the virus, the message is never displayed.  If one
copies the boot sector from within the 4096 virus to a floppy diskette as
sector 0, and boots from it, the message will appear.

Of course, the above bugs may be fixed in a later version of the virus....but
the versions I've seen hang on September 22 when they were meant to activate
the Frodo Lives message.

 PF>
 PF> No offense, Patti, but I did think that on a couple of these points
 PF> that the VSUM doc was kinda sketchy (I know that is ALOT of work to
 PF> compile that baby and continually update, etc.!).
 PF>      Perhaps with a little more detail, I will have settled my
 PF> curiousity and returned to other problems at hand...
 PF>

No problem....A lot of time what makes perfect sense to me doesn't make sense
to others :-).  There is always this question with VSUM on where to draw the
line on the descriptions.

 PF> Patti- Any luck with last U/L?    ,-)
 PF>

Not yet....I'm busy working on analysing a new virus right now, and it is going
to take awhile....will probably be a Whale of a tale when I get done....and I
don't want to say anything prematurely on it.

Patti


--- QM v1.00
 * Origin: Excalibur/Virus_Info - Sunnyvale CA - 408-244-0813 (1:204/869.0)




Msg#: 7181 *Virus Info*
09-06-90 11:33:00 (Read 4 Times)
From: TONY JOHNSON
  To: ALL
Subj: REPLY TO MSG# 3029 (CORE WARS)
Core Wars was a simulation system, it was not per se' a breeding ground for the
type of viri that you see today attacking systems and PCs.  The programs tested
were called viri in the way they attacked and behaved while operating
within the Core Wars environment.  I believe the "arena" used for the "viruses"
was an 8K memory grid, and that the programs/"viri" were limited to that area.

While those programs were not the same thing as what we see today chewing up
our beloved computers, I can say that Core Wars was an extremely enlightening
experience that had the programmers thinking about how a similiar type of
situation could apply to the actual computing world.


--- QM v1.00
 * Origin: The 286 Express (504-282-5817) (1:396/30.0)




Msg#: 7182 *Virus Info*
09-06-90 13:09:00 (Read 5 Times)
From: CHARLES HANNUM
  To: CHRIS BARRETT
Subj: REPLY TO MSG# 7166 (RE: MYSTERY VIRUS??)
 >At my school we have some XT's with 2 360K FDD each. Lately we have
 >noticed that some of the students disks are being over written by the
 >program disk they were using. Eg some people have found the Turbo
 >pascal files on their data disks.

This could happen (and has) if you are using disk caching software.  That would

be a good place to look first.

--- ZMailQ 1.12 (QuickBBS)
 * Origin: The Allied Group BBS *HST* Buffett's Buddy (1:268/108.0)