VIRUS-L Digest Thursday, 9 Feb 1995 Volume 8 : Issue 12 Today's Topics: WWW server for known virusses re: NY Times article; mainframe viruses; virus paraoia Re:About Memory Scanning Re: dir | more shows 2 extra files (PC) Re: About memory scanning (PC) Epbr (boot sector virus) (PC) Re: Stoned 4 (PC) Stoned.NoInt.A protection (PC) Re: Heard of the SPRAYER virus? Help me!!!! (PC) Monkey 2 Virus detected Neeeeed! HELP! (PC) Re: AntiEXE virus (PC) Re:About Memory Scanning (PC) NVP Trojan horse (Mac) Ripper virus HELP (PC) re: "daboys" virus...HELP!!! (PC) CPAV & Vi-Spy Testing (PC) Re: VET queries (PC) Cleaning Form A (PC) Re: GENB Queries (PC) AV scanner recommendations (PC) Re: Stoned virus in memory (PC) Re: new virus: v-sign (PC) LittleRed Virus (PC) AntiCMOS Need info (PC) Help Virus ?ZUIK1372 (PC) Antiviral Toolkit Pro ver. 2.1 available (PC) Re: InVircible review in Virus Bulletin - part 1 of 2 (PC) Scanners and virus underground (PC) VIRUS-L is a moderated, digested mail forum for discussing computer virus issues; comp.virus is a gatewayed and non-digested USENET counterpart. Discussions are not limited to any one hardware/software platform - diversity is welcomed. Contributions should be relevant, concise, polite, etc. (The complete set of posting guidelines is available by FTP on CORSA.UCR.EDU (IP number 138.23.166.133) or upon request.) Please sign submissions with your real name; anonymous postings will not be accepted. Information on accessing anti-virus, documentation, and back-issue archives is distributed periodically on the list. A FAQ (Frequently Asked Questions) document and all of the back-issues are available by anonymous FTP on CORSA.UCR.EDU. Administrative mail (e.g., comments, suggestions, beer recipes) should be sent to me at: krvw@ASSIST.MIL. All submissions should be sent to: VIRUS-L@Lehigh.edu. Ken van Wyk ---------------------------------------------------------------------- Date: Wed, 08 Feb 95 15:56:03 -0500 From: jansam@knoware.nl (Jan Samson) Subject: WWW server for known virusses Does anybody know of a WWW server where you can get info about knowing virusses and how to get rid of them... ------------------------------ Date: Wed, 08 Feb 95 15:59:08 -0500 From: "David M. Chess" Subject: re: NY Times article; mainframe viruses; virus paraoia > From: Rick Bryan > Specifically, the Company cited an article from the 1/22/95 NY > Times relating a "new way for Internet hackers to take control > over another's computer. . .. Suppposedly this was perpetrated > on the mainframe of a Virus/Computer Security firm in Cali. > Can anyone tell me what the real story was on this? The specific attack that got the Times coverage had nothing whatever to do with viruses. Some person or persons unknown used an ancient (first described in a paper published in 1985) weakness in (certain implementations of) the TCP/IP suite to masquerade as one (trusted) computer, while talking to another. It's been known for nearly a decade, it's been exploited before, etc, etc. Now that it's gotten into the Times, maybe it'll actually be fixed! *8) The specific attack can be made to go away by spiffing up the "random" part of a random number used in TCP/IP handshaking (a mere modification to the operating system kernal); other similar attacks can also be defended against by setting up your corporate firewall to be a bit paranoid about packets coming from places they have no business being. [Moderator's note: Exactly! Specifically, any internal to internal packet should NEVER arrive at an _external_ router port; if that happens, you either have a router loop or a would-be intruder - neither one of which is desirable!] If you can find postings to alt.security and similar newsgroups for the last few weeks, there's lots of talk, including a detailed posting from the victim of the attack (not a virus/security "company", rather a security guru-type). > And, if the Company is generally right re: protecting both > LAN'd PC's and the mainframe systems from viruses, etc., which > of course is entirely proper, isn't it rather easy to set up > standards for the use of TSR virus programs, and other ways to > realistically safeguard Company assets, as opposed to the > policy of NEVER EVER hook up to a BBS, etc? Again, the specific attack had nothing to do with viruses directly. It is, however, a reminder that there are Bad Folks out there attacking whatever holes they can find. Your company needs to decide on its policies based on its assessment of what the world is like. We recommend, of course, that for anti-virus policies they contact a company that does such things for a living, rather than trying to do it all by themselves. See 800 numbers below! *8) - - -- - David M. Chess | IBM AntiVirus Products and Services High Integrity Computing Lab | U.S. retail: 800-551-3579 IBM Watson Research | Site licenses: 800-742-2493 ------------------------------ Date: Wed, 08 Feb 95 20:20:05 -0500 From: Iolo Davidson Subject: Re:About Memory Scanning casas@netcom.com "Robert C. Casas Ph.D." writes: > A piggybacker is a memory resident fast infector. I have always just called that a fast infector. There is nothing special about them that rates the "piggyback" name. In particular, they do not especially "piggyback" on anti-virus scanners. They will do the same thing on any program that opens a lot of files, such as a backup utility. They spread rapidly even without such help. That is why they are called "fast infectors". > The problem is the _purpose_ of scanning memory, Vesselin. If the > piggybacker is a new and unknown one then the algorithmic scanner > wouldn't know what to look for, would it. :-) This doesn't have anything to do with *memory* scanning. Scanning *memory* does not open a lot of files, so it does not trigger a lot of infections by a fast infector. It is true that scanners cannot detect viruses they do not know about, either in memory or in files, but this fact does not mean that memory scanning is not useful and necessary. If you don't scan memory, then the scanner might start opening files with a fast infector WHICH IT KNOWS HOW TO FIND already in memory, and some files may thereby be infected before the scanner finds any of the infected files. Also, stealth viruses WHICH THE SCANNER KNOWS HOW TO FIND may be able to hide their infections in files from the scanner if they are already in memory. So you look at the memory first, for viruses that you KNOW HOW TO FIND. Now tell me why that is a bad idea? > >> If the scanner doesn't possess identification strings for the virus > >> it will be missed and the scan process will spread the virus. > > > Correct. > > We agree, then. :-) Scanners can be used by a virus to infect an > entire system if the scanner does not have a scan string to detect the > virus in memory and defend against it's operation. You state this so > easily. Yet, it *** is *** the glaring weakness in all algorithmically > based scanners. :-) But this has nothing to do with the advisability of scanning memory for those viruses WHICH THE SCANNER KNOWS HOW TO FIND. The same thing will happen if the user decides to do a backup instead of a scan. Or will happen eventually just as a result of using the computer normally. This is not a weakness of scanning per se, as you imply by saying the virus "uses the scanner". What the virus uses is the DOS interrupt 21h file open function. > > But if the scanner does not bother to scan the memory at all, > > then it will miss the virus there much more often, no? > > Why do you believe this is so necessary when there are dangers in > using a scanner in a memory infected environment? Because without it the scanner will have unnecessary problems with viruses WHICH IT KNOWS HOW TO FIND. > We agree that if a scanner does not have a scan string for the > virus, then it might be dangerous to scan. No, I don't agree. If you have a virus you can't detect, you are in trouble, but that does not mean you should not try to detect the much larger numbers of viruses which you can detect. An undetected fast infector virus will spread through all your files eventually with or without a scanner being used, through normal computer use. Anything that opens a lot of files, like a scanner or a back-up utility, will only make it happen a little sooner. In any case, this is not an issue about scanning MEMORY, but about scanning in general. > If the scanner is using > algorithmic methods then it will only detect known piggybackers > in memory. What if the piggybacker is "unknown" to the scanner? What is > the value in scanning memory as compared with the potential risks of > scanning at all in this situation? You can argue the point about scanners and new viruses, certainly. This is a known problem for scanning, in the nature of things. But it is not an argument against scanning memory for those viruses (the vast majority) WHICH THE SCANNER KNOWS HOW TO FIND. > Frans Veldman made this point and suggested a possible solution for > algorithmically based scanning methods. Scan the files on your system > after a clean boot from a write protected floppy. This was a reasonable > solution addressing the limitations of algorithmically based scanning > methods. This approach won't solve the problem if the affecting virus is > new, but still, what is the value of scanning memory after a clean boot? This has become an absolute necessity since the advent of EXEbug, because EXEbug can defeat a clean floppy boot. The clean floppy boot can no longer be relied upon. Memory scanning is the only way to be sure the computer is not infected by EXEbug. I hope everyone has got that now. And the technique used by EXEbug will certainly be used again by other virus writers. Aside from EXEbug, there is also the much older problem that not all users understand the point of the clean boot, or how to be sure that their boot floppy really is clean. Memory scanning takes care of both mistakes and utter carelessness in this regard. > >> Since viruses are currently being written and released more quickly > >> than algorithmically based scanner updates end-user's are putting > >> themselves at risk with such scanners. The better anti-virus producers are able to keep up quite well, and usually get the detection into their products before the customers come up against the virus in the wild, for all but a very few instances. > No, you are wrong on this point. Even very good scanner's such as > F-Prot and AVP are helpless against unknown piggybackers. Detecting > piggybackers effectively ( i.e., new ones, too ) is a generic process. > "Scanning memory" for a virus string is not sufficient. This is a scanning issue, not a MEMORY scanning issue. Next you will say that since scanner cannot recognise unknown viruses in files, it is useless for thenm to scan files for the viruses they do recognise. > It requires a set of generic > methods to reliably and effectively detect piggybackers. There are no such methods. WHEN they are developed, you will have a good argument for giving up scanners. > Show me the comprehensive scanner that can reliably detect unknown > piggybackers and I will change my opinion. :-) Show me a generic anti-virus that has never missed a new virus, and never given a false alarm on an innocent file. > Algorithmically scanning memory effectively, paving the way for safe file > scanning,however, is a separate issue. This is the issue I wished to discuss. > Perhaps my earlier post was unclear on this point. As is the current one. > Vesselin, if I thought there was a virus resident in my system the last > thing I would do is execute programs. If I was using an algorithmic > scanner to protect my system ( which I don't ) I would first boot from > a clean, write protected floppy. Then, I would scan the system. And you would be fooled by EXEbug if your scanner did not look for it in memory. > Let me take up _your_ issue for a moment. Let's concede that a > "known-virus" scanner should be able to detect the viruses it "knows" > when such viruses are memory resident. This is all well and good. But it > doesn't address the real issue. What if the virus in memory is unknown > to the scanner? Then it won't be found in files or boot sectors either. No one is arguing that scanners will find viruses released in the future. But this is not a reason to say that they should not look for those viruses that they are able to find, whether in memory or in files. > The point is that algorithmic scanners are more safely > used after a clean boot. This is the only way to avoid their > vulnerability to unknown piggybackers. Doesn't work reliably in the field, because of naive users and EXEbug. > After a clean boot, at worst, > they won't detect the virus that affected the files, but, this way, > they won't spread the virus all over the disk through piggybacking. Of course they will, and probably already have, through normal use of their computer. They are not called "fast infectors" for nothing. > I think it is better to be safe and useless than risky and very > sorry. :-) Missing a possible new virus once in a blue moon is not as big a problem as missing the all the known, prevalent ones all the time. Nor do I accept that there is a reliable generic or heuristic method for finding all "unknown" viruses. Additionally these methods have a bad problem of their own with false alarms. > You understand the risk yet you insist that memory scanning > should be performed. Why? To defeat the many known viruses against which it is very effective. > By insisting that memory should be scanned you are encouraging > user's to execute program's in a "risky" environment. I fail to > see the value in this. They are going to execute programs anyway. There is no greater risk running a scanner than in running other computer software. The scanner can protect them against many more viruses than it could possibly miss. > The real danger is not from a "known-virus." It is, much more often than it is from an unknown virus. Known viruses are at the top of the virus prevalence lists. All viruses rapidly become "known" viruses in any case. You seem to think that as soon as they are "known" they are no longer dangerous or damaging. > Performing a clean boot and scanning the _files_ > on a system from a write protected floppy is only > prudent. Sure. But not enough in itself. Naive users often cannot do it right for one reason or another (some don't even own a boot floppy), and EXEbug can defeat it anyway. > That was Frans Veldman's point and it is a sensible way to deal > with the limitations of algorithmically based AV products. If you > follow this approach you avoid the following dangers. > > If it is an aggressive memory resident virus that infects and damages > files on execution ( Junkie.A ) then scanning memory is worthless. The > scanner wouldn't even be able to execute. I have tried it with F-Prot. > You would just infect it. Yes, clean booting avoids this, and so does running the scanner from a write protected floppy, which is also advised by most AV suppliers. But in any case, good scanners can tell that they have been infected, report this as a probable virus symptom, and advise that the user clean boot. > If it is an unknown and stealthy piggybacker then you will > infect your system and not even know it. If you have such a virus, then your system is already infected. Very likely many or most files are already infected. Maybe ALL infectable files are already infected. Certainly they will be eventually, as a result of normal use, if the virus is not dealt with. > But, you may believe your system is > clean. The infection can then spread to other machines or through a > network while you blithely consider your system "clean." This will also happen if you DON'T run the scanner. And I am still waiting for a reason why failing to scan MEMORY will improve the situation. > If the virus is less the perfectly stealthy and destructive, you will > know your system is infected. But, you won't know that you just spread > the infection across all of the files scanned. You may then repeatedly > scan your system causing even more damage to the files scanned. This will happen anyway, in normal use. You keep making the same points again and again. I am pleased to be able to demolish them again and again. Mere repetition will not establish error as fact. > > Oh, yes, I almost forgot. You promised us "many reasons not to > > scan memory for viruses". So far you have not delivered even one > > such reason that is valid. > > I hope I have mentioned a few.:-) Nope, still waiting. You have gone on about scanning itself having a problem with new viruses. We all know that, and all the scanner producers have update programs to combat the problem. Nowhere have you given any reason why scanning MEMORY is a bad idea. > I want to repeat. I agree that memory needs to be > tested for the presence of viruses. I just don't think > algorithmic scanning is the way to do it. Do it some other way then. If it works, I am sure it will sell. It will have to work very well to outsell the current products which do work very well and have feature that heuristic scanners cannot match, like virus identification (not just detection) and removal. - -- TO CHANGE THAT YOU GOTTA USE SHAVING JOB THE REAL MCCOY TO JOY Burma Shave ------------------------------ Date: Wed, 08 Feb 95 08:49:31 -0500 From: Kenneth Albanowski Subject: Re: dir | more shows 2 extra files (PC) On Tue, 7 Feb 1995, Iolo Davidson wrote: > knielson@joule.elee.calpoly.edu "Kristoffer Carl Nielson" writes: > > > Anyone know of a virus that shows itself when dir is piped > > through more? When I do this, two extra files show up -- > > they are 8 seemingly random letters with no extension. > > This is not a virus, just the two temporary files that the MORE > utility creates, then deletes when it is through. > > [Moderator's note: Aren't the temporary files in fact created by > MS-DOS (due to its inability to multi-task piped processes) when using > an i/o pipe, not by the more command per se?] Almost right. The temporary files are created by COMMAND.COM (the shell) to simulate pipes when it is asked to pipe the one program to another. MS-DOS has no internal support for pipes whatsoever. [Moderator's note: Thanks for the correction!] - -- Kenneth Albanowski (kjahds@kjahds.com, CIS: 70705,126) ------------------------------ Date: Wed, 08 Feb 95 09:46:08 -0500 From: icking@sunick.gmd.de (Werner Icking) Subject: Re: About memory scanning (PC) Imho "memory scanning" is an important feature for a scanner. What I do not like is that a scanner may not be convinced to continue if a virus is found in memory. If I know that the virus is found e.g. in the memory of a disk-cache then the scanner should offer to continue. It should not be a Y/N- question but a question which requires each time another answer: Hit [F3] to continue. Otherwise it is too likely that the standard usage is with the /nomem-parameter which leads to the opposite effect as wanted. Werner - -- Werner Icking Werner.Icking@gmd.de (+49 2241) 14-2443 __o GMD - Gesellschaft fuer Mathematik und Datenverarbeitung mbH _`\<,_ Schloss Birlinghoven, D-53754 Sankt Augustin, Germany (_)/ (_) "Der Dativ ist dem Genitiv sein Tod." ~~~~~~~~~~~~~~~ ------------------------------ Date: Wed, 08 Feb 95 10:06:04 -0500 From: Ken De Cruyenaere 204-474-8340 Subject: Epbr (boot sector virus) (PC) We have encountered the 'Epbr' virus, as identified by F-PROT 2.16 and I am looking for more information on it. We seem to have it under control now (touch wood). Anyone know where it is from, what, if anything, it is designed to do ? Ken D. - --------------------------------------------------------------------- Ken De Cruyenaere - Computer Security Coordinator - Computer Services University of Manitoba - Winnipeg, Manitoba, Canada, R3T 2N2 KDC@CCM.UManitoba.CA Voice:(204)474-8340 FAX:(204)275-5420 -OR- kdc@cc.umanitoba.ca ------------------------------ Date: Wed, 08 Feb 95 10:11:21 -0500 From: ryeomans@gpu3.srv.ualberta.ca (R.W.Yeomans) Subject: Re: Stoned 4 (PC) Sam Weller (sam_weller@sunshine.net) wrote: > Microsoft msav tells me I have Stoned 4 in by boot sector > but will not clean it. > The version of mcAffee that I have does not recognise this at all. > I am getting some erratic memory problems and trouble with my A drive > but haven't lost any data yet. > Can someone advise me what to do F-Prot's newest release, v2.16, should be able to recognise and elliminate the virus, if it exists. - -- | begin 644 o.002 MF&\A#0I([N+N) | Richard W. Yeomans | W,@PFCN(#+O9"!M[G-SX&?N(*TG=NX@;>! | University of Alberta | D[B"?;^(@;9@@ M!K[B"MPB"M :[\+NXNYSPJWO9RX-" | ryeomans@gpu.srv.ualberta.ca | @T*+4]M[ZV`XF_O#0H` ` end | yeomans@frodo.mece.ualberta.ca ------------------------------ Date: Wed, 08 Feb 95 11:09:42 -0500 From: "David Peterson" Subject: Stoned.NoInt.A protection (PC) My branch of Ohio State University recently has been infected with the NoInt virus in the general computer lab. I have cleaned almost every IBM in the lab several times, with MSAV and the January 1995 version of F-Prot. My question is, is there an easy way to prevent people from booting on a floppy, except for about 4 staff members. I have checked the CMOS, and does not support forced boot on C. We need a solution that the average student will not realize, so that they do not get confused, and one that is secure. Also, if possible, cheap. My apologies if this has been discussed a lot, but there are way to many back issues to check. Private replies are preferred, but to the digest is ok. David Peterson peterson.145@magnus.acs.ohio-state.edu The Ohio State University ------------------------------ Date: Wed, 08 Feb 95 12:06:19 -0500 From: Mikko Hypponen Subject: Re: Heard of the SPRAYER virus? Help me!!!! (PC) Travis Cook (travis.cook@m.cc.utah.edu) wrote: > My computer is sorely affected with the SPRAYER virus. > McAffee (the lasted version on Simtel) found Sprayer, but was unable > to remove it. Clean.exe didn't recognize it. I'm quite suprised that this virus is already in the wild in the USA. This virus (known also as the Finnish_Sprayer) was found in Finland little over a year ago and is pretty common over here. Here's a desciption of it: Name: Finnish Sprayer Origin: Finland Type: Resident, MBR, FBR Finnish Sprayer was found in Finland in November 1993, and it quickly became very widespread in the southern parts of Finland. The virus will only infect hard drives when an attempt to boot from an infected diskette is made. Once the virus has infected the hard drive, all non-protected floppies used in the machine will be infected. The virus contains the following unencrypted text: "Tks to B.B, Z-VirX ..... [Aija]". Finnish Sprayer is two sectors long, and it stores the original boot sector and it's own code to the last sectors of the active partition. The virus activates on the 25th of March. At this date it will overwrite most sectors of the active partition with random data, change the screen background to grey, and display the following text: FINNISH_SPRAYER.1. Send your painting +358-0-xxxxxxx (FAX), [Aija] This text is not visible in the virus code, since it has been encrypted with a XOR 50h operation. Finnish Sprayer will not infect the hard disk if the active partitions file system is not DOS. This means that PC's running for example OS/2, DR-DOS with HD password protection, Windows NT or some UNIX variant will not be infected. Virus uses stealth routines, so it cannot be found from hard disks MBR when it is active in memory. F-PROT detects if Finnish Sprayer is resident, and will advise you to boot from a clean diskette. > How can I get this thing off my Boot sector without reformatting. F-PROT is able to disinfect this virus. - -- Mikko Hermanni Hypp=F6nen // mikko.hypponen@datafellows.fi Data Fellows Ltd's F-PROT Professional Support: f-prot@datafellows.fi Computer virus information available via WWW; http://www.datafellows.fi ------------------------------ Date: Wed, 08 Feb 95 12:26:38 -0500 From: i8757479@wsunix.wsu.edu Subject: Monkey 2 Virus detected Neeeeed! HELP! (PC) I have detected the Monkey 2 virus on my thinkpad 360 and need help removing this pesty virus. I would also want to know what the virus does specifically. Brad Hummel Washington State University Pullman Wa ------------------------------ Date: Wed, 08 Feb 95 12:30:58 -0500 From: Mikko Hypponen Subject: Re: AntiEXE virus (PC) S Widlake (swidlake@rl.ac.uk) wrote: > This is the AntiEXE info. taken from F-Prot Version 2.16... > There are a few tiny errors that I'll point out along the way. Thanks for pointing this out again - the virus description that you were referring to was (due to an error) describing another virus, and not the common AntiExe virus. > FYI - Data Fellows & Frisk "know" about this little error which first > came about in version 2.15 . > HEY FRISK - fix the ANTIEXE info. screen - someone has "broken" it. This was actually corrected already some time ago, but the corrected description was never included in the shareware version of F-PROT. It will be included in the next version. - -- Mikko Hermanni Hypp=F6nen // mikko.hypponen@datafellows.fi Data Fellows Ltd's F-PROT Professional Support: f-prot@datafellows.fi Computer virus information available via WWW; http://www.datafellows.fi ------------------------------ Date: Wed, 08 Feb 95 12:46:53 -0500 From: Mikko Hypponen Subject: Re:About Memory Scanning (PC) I do not want to start arguing about the other points raised about memory scanning, but wanted to clear this one thing up: Robert C. Casas Ph.D. (casas@netcom.com) wrote: > If it is an aggressive memory resident virus that infects and damages > files on execution ( Junkie.A ) then scanning memory is worthless. The > scanner wouldn't even be able to execute. I have tried it with F-Prot. > You would just infect it. Did you really try this? I did. F-PROT didn't get infected; it executed fine and detected that the virus was resident in memory. Why? Simple - Junkie.A infects boot sectors and COM files, and F-PROT is an EXE file. - -- Mikko Hermanni Hypp=F6nen // mikko.hypponen@datafellows.fi Data Fellows Ltd's F-PROT Professional Support: f-prot@datafellows.fi Computer virus information available via WWW; http://www.datafellows.fi ------------------------------ Date: Wed, 08 Feb 95 14:07:17 -0500 From: powlesla@acs.ucalgary.ca (Jim Powlesland) Subject: NVP Trojan horse (Mac) According to MacWeek 01.23.95 (p. 3): "A practical joke run amok has resurfaced as a Trojan horse on the Mac, according to Symantec Corp. The NVP Trojan horse, which can affect any Mac running System 7, installs itself by modifying an active System file. Once installed, NVP disables the vowel keys on the user's keyboard. According to Cupertino, Calif.-based Symantec, the Trojan horse is based on an extension called NVwls (No Vowels), which was designed and distributed as a joke. Symantec said the NVwls name and icon were changed to that of another utility by someone other than the developer who created the original extension. [rest of article deleted]" - -- Jim Powlesland | OFFICE: 403-220-7937 Micro Services, UCS | MESSAGE: 403-220-6201 University of Calgary | FAX: 403-282-9199 Calgary, Alberta CANADA T2N 1N4 | URL: http://www.ucalgary.ca/~powlesla ------------------------------ Date: Wed, 08 Feb 95 14:39:59 -0500 From: russ@PrimeNet.Com (Russell Gore) Subject: Ripper virus HELP (PC) I have ran several virus scanners and they both come up with the Ripper virus when it does the memory scan, around 574k. How do I take care of this virus, several other computers are also infected that I know of. Thanks Russell - -- ***************************************************************************** Russell Gore WL7AG || Internet: russ@primenet.com 8902 N 19th Ave apt2031 || Packet: WL7AG@K7BUC.AZ.USA.NA Phoenix, AZ 85021 || Compuserve: 72377,2075 ***************************************************************************** Student at DeVry Institute of Technology in Phoenix, Arizona ------------------------------ Date: Wed, 08 Feb 95 16:10:28 -0500 From: "David M. Chess" Subject: re: "daboys" virus...HELP!!! (PC) From: mikemccu@ix.netcom.com (David Michael McCutcheon) > Has anyone heard of a virus called "daboys"? I know that it is a boot > sector virus, and my IBM AntiVirus v2.0B detects it. However, I'm > having difficulty cleaning the hard disk. 2.0B? I'd forgotten we released that level. Anyway, DABOYS is a rather unusual boot infector. It doesn't save the original boot record anywhere; instead, it does a quick check to see if the boot record is the Usual DOS Boot Record, and if it is, it installs itself in the error-handling routines (and patches a jump to itself near the start). So the original boot record isn't anywhere in particular to be restored; the best way to recover from it is to boot the system from a clean DOS diskette with the same level of DOS as your hard disk, and use SYS to reconstruct the DOS boot record. The virus has no particular payload or other effects. This is all assuming, of course, that you have exactly the same level of the virus that I've analyzed. But in any case the SYSing should be a safe thing to do... - - -- - David M. Chess For Best Results, High Integrity Computing Lab Consume Before Above Date IBM Watson Research ------------------------------ Date: Wed, 08 Feb 95 16:14:54 -0500 From: Rochelle Altman Subject: CPAV & Vi-Spy Testing (PC) rmts@interport.net recently posted some questions which arose when he tested CPAV and Vi-Spy against the "Collection" CD. 1. The log file produced by Vi-Spy contains binary information and is designed to be read using the VIREPORT utility which is included in the Vi-Spy package. This utility will also (optionally) write out an ASCII copy of the log. If you attempted to read the log with a regular text editor/viewer, it would quite possibly appear to be corrupt. May we ask rmts to try reading the log using our VIREPORT utility? 3. His comment regarding "correctly identifying homegrown" viruses requires a certain amount of explanation: There is no such thing as a "correct" virus name. Each AV product vendor who has identified a virus, names it as best he can. If a virus is prevalent in the wild, all the AV vendors soon become aware of its existence and typically identify it with a number of names so the user can understand that the same virus is being referenced by the various vendors. If the virus has been reviewed and (in effect) named by a publication such as VB, most vendors will again attempt to conform their naming accordingly.If this is entirely new and the virus contains text data (encrypted or not) the virus is generally named according to the text it puts out. If not, some feature of the code is used for naming the virus. In any case, it is unclear what might be meant by a "correct" virus name for a newly identified virus. For: R G Software Systems, Inc 6900 Camelback Road Suite #630 Scottsdale, AZ 85251 ............................................. ------------------------------ Date: Wed, 08 Feb 95 16:54:31 -0500 From: scottk@jolt.mpx.com.au (Scott Keegan) Subject: Re: VET queries (PC) A.Appleyard (A.APPLEYARD@fs2.mt.umist.ac.uk) wrote: : (a) What is the email address of the people who write & maintain VET? riordan@tmxmelb.mhs.oz.au : (b) That PC's hard disk is C:, and at the time it had no floppies in. Why then : did it say it found an infected file on `a:'??? I would think that you've got something getting screwed up there. You're also several versions of the software behind, we're up to version 8.1. You're first plan should be to get the latest version. : (c) How do I get it to clean infected files rather than deleting them? You could use the U switch which renames the files. If you don't specify any switches it will default to fix mode. Cheers, Scott. - -- +------------------------+---------------------------------+ | Scott Keegan | OH NO...I know what you want... | | scottk@jolt.mpx.com.au | You coveteth my ice-cream bar! | +------------------------+---------------------------------+ ------------------------------ Date: Wed, 08 Feb 95 17:37:40 -0500 From: schmidtls@norand.com (Layne Schmidt) Subject: Cleaning Form A (PC) Can anyone tell me if there is a way to clean a system infected with the Form A virus? The current rev. level of McAffee doesn't seem to be able to do this. More specifically, is there a way, short of a low level format of the infected drive, to save the data on the drive? It appears that FDISK /MBR repairs the Master Boot Record but the default boot sector is another matter. Thanks, Layne ------------------------------ Date: Wed, 08 Feb 95 18:11:33 -0500 From: jmccarty@spd.dsccc.com (Mike McCarty) Subject: Re: GENB Queries (PC) Ho T S wrote: )I did a scan with the latest version of McAfee's scan and it showed tht I )had a GENB virus in the boot sector or something like that. It also )stated that there is no "cure" for it at present. Can anyone help by )telling me how to reformat such that it goes? I tried fdisk-ing but it )doesn't work. I figure a low level format would have to be done. How do )I do that? ) )Thanks There is no GENB virus. That is McAfee's way of telling you it thinks there is a virus in the Boot Record, but it does not recognize which one. GENeric Boot virus. FDISK works with the Master Boot Record, not the Boot Record. They are different things. A low level format will not help. You need to replace the Boot Record. The original Boot Record has almost surely been saved off somewhere else on disc. If you want me to help you, you could get a copy of the Boot Record and send it to me. I can figure out where the original is, and tell you how to put it back. If you want help, but don't know how to get your Boot Record off your disc, then send me e-mail at: jmccarty@spd.dsccc.com and I will do what I can. Mike - ---- char *p="char *p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);} ------------------------------ Date: Wed, 08 Feb 95 18:25:25 -0500 From: wblair@rmii.com (William Blair) Subject: AV scanner recommendations (PC) I work for a US govenment agency that uses (locally) the McAfee and MS-DOS AV scanners. I am trying to convince our computer security people to start using F-Prot and/or Thunderbyte which I believe are better programs. I would appreciate it if you could give your comments on the McAfee scanner vs. F-Prot and Thunderbyte. Real world experience dealing with the superiority of one scanner vs. the other would be the most valuable input, but any comments will be appreciated. I will present your inputs to the right people within my organization. - -- ------------------------------ Date: Wed, 08 Feb 95 18:30:45 -0500 From: jmccarty@spd.dsccc.com (Mike McCarty) Subject: Re: Stoned virus in memory (PC) Catherine Maxcy Chow wrote: )A stoned virus search string is found in the partition table of my computer, )I do not know how to get rid of it, I tried several scanning sofeware, they )seems not able to remove the virus from the memory. It also said that the )boot sector is infected. Please let me know how to get rid of it! I was bitten by a variant of the same virus STONED.AZUSA. At the time my infection occurred, there was nothing which would clean it, so I disassembled it and wrote my own cleaner. If you want help from me, send me a copy of your infected boot sector, and I will help you out. Your original boot sector has been saved somewhere else on disc, and the original copy is overwritten by the virus. I can figure out where it is, and tell you how to put it back where it belongs. If you don't know how to get me a copy of your boot sector, contact me as: jmccarty@spd.dsccc.com and I'll give you some help. Mike - ---- char *p="char *p=%c%s%c;main(){printf(p,34,p,34);}";main(){printf(p,34,p,34);} ------------------------------ Date: Thu, 09 Feb 95 00:24:42 +0000 From: karpens@bilbo.ncssm.edu (------Simon------) Subject: Re: new virus: v-sign (PC) tfbtom@richmond.infi.net (tom blackburn) writes: From: tfbtom@richmond.infi.net (tom blackburn) Newsgroups: comp.virus Date: 7 Feb 1995 11:49:16 -0000 one of our technicians has discovered a "virus" called v-sign. Only detected by McAfee Has anyone encountered this bug and know a way to remove it? I recently removed this from about six computers (NOT my own). F-prot will detect and remove this virus with no problem. Try ftp://oak.oakland.edu/pub/msdos/virus/fp-xxx.zip Simon - -- ******************************************************************************* * Simon Karpen karpens@ncssm-server.ncssm.edu * * also karpens@opus.ncssm.edu more reliable, checked less often * * flames to /dev/null Linux: choice of the GNU generation * * #include I don't speak for NCSSM * ******************************************************************************* ------------------------------ Date: Wed, 08 Feb 95 23:55:24 -0500 From: "slr0n@cc.usu.edu"@cc.usu.edu Subject: LittleRed Virus (PC) Anyone know anything about the "LittleRed" virus? How does it spread, etc. ------------------------------ Date: Thu, 09 Feb 95 01:16:59 -0500 From: ghey@beta.tricity.wsu.edu (Gale M. Hey) Subject: AntiCMOS Need info (PC) Hello! I have seen a few posts mentioning AntiCMOS A&B, but none that actually describe what they are or what they do. If someone could please e-mail me with a description and/or where to get additional information, I'd really appreciate it! TIA! Gale ------------------------------ Date: Thu, 09 Feb 95 09:02:06 -0500 From: jkulpa@ibm.net Subject: Help Virus ?ZUIK1372 (PC) Recently I used IBM AntiVirus on a machine and it detected a 'possible' virus called Ziuk1372. We had found over 100 occurences of a file called SMARTCHK.CPS, in directories containing executables and/or DLLs. Has anyone seen this before. I really would like more information on it since I've never seen any virus like this before. Any info. would be greatly appreciated. ------------------------------ Date: Wed, 08 Feb 95 14:08:04 +0300 From: eugene Subject: Antiviral Toolkit Pro ver. 2.1 available (PC) Hello all! AVP 2.1 shareware version is available on Anonymous ftp sites: ftp.netcom.com:/pub/kapeer/*.* io.com:/pub/usr/pmonti/avp/*.* ftp.informatik.uni-hamburg.de:/pub/virus/progs/avp*.* ftp.sunet.se:/pub/pc/antivirus/avp/*.* oak.oakland.edu:/pub/msdos/virus/avp*.* (and mirrored sites) BBS: Metropolitan Network BBS (Switzerland): +41 (0)31 348-1331 (2400-28800bps V.34/V.FC/HST) +41 (0)31 348-1333 " +41 (0)31 348-0422 " Regards, Eugene - --- - -- Eugene Kaspersky, KAMI, Moscow, Russia - -- eugene@kamis.msk.su +7 (095)278-9412 ------------------------------ Date: Wed, 08 Feb 95 16:34:43 -0500 From: emd@access3.digex.net (EMD Enterprises) Subject: Re: InVircible review in Virus Bulletin - part 1 of 2 (PC) I am Enrico DePaolis and I am the President of EMD Enterprises. I am writing this note to corroborate the experience of Zvi Netiv, author of InVircible, with the Virus Bulletin magazine. I feel the following information about Virus Bulletin Magazine needs to be brought to the attention of the readers of this newsgroup and to the anti-virus community in general. If you are one of those who hold this "prestigious" magazine in high esteem, or you are an anti-virus product manufacturer yourself and feel thrilled when Virus Bulletin agrees to review your product (as we at EMD Enterprises and Zvi Netiv felt initially), please read on. VIRUS BULLETIN IS OWNED BY THE SAME INDIVIDUAL(S) WHO OWN SOPHOS, A U.K. COMPANY WHICH SELLS SWEEP, A SCANNER BASED ANTI-VIRUS PRODUCT marketed primarily to Corporate Buyers in the U.K. In fact, the two companies (Sophos and Virus Bulletin) have the same street address. This immediately suggests a serious conflict of interest. It is all the more galling since Virus Bulletin proclaims itself to be an unbiased publication, and proudly states that it does not carry any advertisement to ensure editorial objectivity! (Readers of the NCSA Forum in CompuServe may be familiar with the editor of Virus Bulletin, Richard (Dicky) Ford who is a frequent visitor to the Forum, offering sagely advice on virus related issues). Our anti-virus product, EMD Armor Plus, was reviewed by PC Plus magazine in their December, 1994 issue. It received a score of 5 out of 5 stars and was given the PC-Plus Recommended status. Earlier Computer Reseller News featured EMD Armor Plus in a news story in its May 23, 1994 issue, proclaiming that EMD Enterprises was "taking a radically different approach to fighting the plague of viruses". So, not knowing the connection between Sophos and Virus Bulletin, we were thrilled when Virus Bulletin decided to do a review of EMD Armor Plus. However, as we found out, our product was trashed by the magazine reviewer, Dr. Keith Jackson. Like the InVircible review, the review of EMD Armor Plus was done in a most biased and opinionated manner. Indeed, our experience with Virus Bulletin was remarkably similar to what Zvi describes. Without going into the technical details of the review, I will discuss the major shortcomings of the review process. (a) The reviewer allowed his opinion of the product to be influenced by his personal beliefs, and made no secret of it. He is obviously heavily biased towards scanner based anti-virus products. He judges the quality of all anti-virus products simply by the quality of its virus scanner. EMD Armor Plus, like InVircible, is not a scanner based product. Like InVircible it provides a generic solution. Although it comes with a scan and clean program we never claim that it is the strongest part of the product. EMD Armor Plus really depends upon an activity monitor that works at the BIOS level to stop a virus before it can cause any damage. Since it looks for VIRUS LIKE ACTIVITIES, AND NOT A SPECIFIC VIRUS, it can protect the computer against unknown and future viruses, and does not need to be updated frequently. We created EMD Armor Plus because we felt that there is a need for a generic solution to the problem of computer viruses. By using the scanner based approach, anti-virus product vendors are forced to play a catch-up game and stay a step behind virus writers all the time. Users, in turn, have to constantly keep their scanners up-to-date, and have to keep on paying the vendors for the updates. The reviewer, however, refused to test the activity monitoring part of the product thoroughly, claiming that "It is very difficult to test such behaviour monitor features thoroughly," even though he admitted that "those that I tried did respond as claimed, and did not suffer too much from false positive reactions". (b) EMD Armor Plus comes with numerous other features in addition to its anti-virus features such as multi-level password based access control, hard disk utilities etc. (One neat aspect of EMD Armor Plus is the unique combination of anti-virus and security features in one package). The reviewer did not bother to test most of these features, and in fact dismissed the entire security features as unimportant in just a couple of lines. Moreover, he did not hesitate to make negative comments about some of the hard disk utility features without bothering to test any of these. Most of his comments were a result of faulty understanding of the product features. In one case he commented upon a feature WHICH WAS NOT EVEN INCLUDED with the unit he tested. (This is a utility that we sell separately). Overall, it seemed to us that the reviewer simply tested the features that were EASIEST FOR HIM TO TEST, NOT THE ONES THAT SHOULD HAVE BEEN TESTED. He was incredibly judgmental, but he did not take time to understand the product, nor read the User's Manual. (c) The most infuriating aspect of the review was the reviewer's condescending and dismissive tone. I guess if you have read Zvi's original post, you have got a flavor of it. (d) The reviewer was picky and petty in several places - examples of this are his comments on the lack of an index in the manual, look and feel of the product etc. (e) In several places the reviewer gave information about our product which was blatantly incorrect. In a few instances he suggested, not too subtly, that we were making false claims. Again, this was due to a lack of comprehension on the part of the reviewer, and we strongly deny the accusation that we are lying. (f) A most galling aspect of the review was Virus Bulletin's refusal to work with us throughout the review process. The reviewer did not bother to check with us even once during the review, not even regarding the aspects of the product he did not understand. Virus Bulletin did send us a draft of the review before its publication. When we pointed out several inaccuracies in a letter to Richard Ford, the Editor of Virus Bulletin, he replied to us saying that Virus Bulletin would not make any more than token changes before publication. Instead he suggested that we write a rebuttal that he would consider publishing in the following issue. By that time we had learned about Virus Bulletin's connection with Sophos, and we were simply not interested in working with them any more. When we pointed out to Richard Ford that the version reviewed was one of the earliest versions, and that we now had a newer version with an improved scanner, a manual with an index etc., he showed no interest in reviewing the latest offering. More than the flawed review of our product, we feel that the real issue here is the questionable objectivity of Virus Bulletin. No doubt Virus Bulletin editors will loudly proclaim their independence from Sophos management. But in reality how can they be relied upon to do an objective review of a product which is in direct competition with the product from their owner's company? In the past Virus Bulletin did rate some scanner based products well, for example it generally gives good grades to F-Prot. It is possibly because F-Prot is too well known, or it could be because its author Fridrik Skulason was (and possibly still is) the Technical Editor of Virus Bulletin. It seems that the magazine reserves its contempt and ridicule for smaller companies which dare to take a different approach to the virus problem and thus create a potential challenge to the monopoly of scanner based solution providers. Enrico DePaolis EMD Enterprises Phone: (410) 583-1575 606 Baltimore Avenue FAX: (410) 583-1537 Suite 205 CompuServe: 70473,3260 Towson, MD 21204-4053 Internet: emd@access.digex.net Fax-back: (410) 583-1575 ext. 4 (select document 1015 for EMD Armor Plus) ------------------------------ Date: Thu, 09 Feb 95 05:05:38 -0500 From: Zvi Netiv Subject: Scanners and virus underground (PC) To a message from Frans Veldman, > Date: Tue, 07 Feb 95 07:29:55 -0500 > From: "Frans Veldman" > Subject: Re: InVircible review in Virus Bulletin > Zvi Netiv writes: > Subject: InVircible review in Virus Bulletin - part 1 of 2 (PC) ZN> Their motive was simple: To kill InVircible as a ZN> viable competitor to their own conceptually outdated product before ZN> it became a real threat to the established and entrenched AV ZN> industry, and probably to the very existence and need for a ZN> publication like the Bulletin. FV> Oh, YES! We are deeply afraid for your product. Hahahahahaha... Cheap shot Veldnam. :-( FV> BTW, does the name 'FireCracker' mean anything to you? I can't see what is the connection between FireCracker and my rebuttal to the Bulletin's review. The only reason Veldman could bring the name is to imply as if there is something not kosher, as if 'Firecracker' was some sort of skeleton that would jump every minute out of the closet. :-) So let's open the box, and look what is in there really. ;) FireCracker, is Trip Lewis' nickname as the former mail node for NuKE in the US. Trip is no more with NuKE. I quoted on Fidonet one of Trip's messages, the same as a burglar's recommendation would serve to advertise a safe box. :-) ZN> Here is what a NuKE member says about debugging IV: :-) FC> .. the software is not bullshit. I have been trying to reverse FC> engineer it for a while with little or no accomplishment to speak FC> of. The hard part is getting debug to trace through the f****n FC> .exe that runs it all... If there is a will there is a way. FC> Anyway its good software.... And here is what Frans Veldman is referring to, cross-posted from NuKEnet to Virus-Info by Peter Hatch. Origin: Edge of Reality BBS, Thunderbyte Support, Australia. The Edge of Reality BBS is also the Australian NuKE's nodes, as I am told, and as supported from its incoming and outgoing mail. There is nothing odd, nor unethical in this, since Veldman's product (like all scanners) depends on a constant feed of the new viruses. InVircible does NOT, and this is what probably upset Frans. PH> * In a message originally to All, Zvi Netiv said: PH> Such praise by FireCracker would be impressive PH> IF HE WAS NOT A PAID SALES AGENT FOR INVIRCIBLE! PH> Tell me, Mr Netiv, PH> WHY SHOULD I OR ANYONE ELSE BE IMPRESSED BY PRAISE OF INVIRCIBLE BY PH> A VIRUS WRITER WHO IS ON YOUR PAYROLL ? PH> Tell me, Mr Netiv, PH> WHERE ARE YOUR ETHICS ? Peter Hatch, the origin of the above is a fervent and loud supporter of Thunderbyte and of Frans Veldman. Six months ago, Peter Hatch attributed a dropper to my name, attempting to discredit me, and uploaded it to the Thunderbyte support BBS in Australia. Unfortunately (or maybe deliberately) the package was admitted for downloading to all, due to a "mistake" of its sysop, Rod Fewster. Peter Hatch later pretended as if he hatched the fabricated dropper package directly from the UK (or from Germany). He claimed that the dropper was related to me by an European underground that was "spreading propaganda against Zvi Netiv". It was obviously a childish cover-up (BTW, Peter Hatch is about 45 of age, and also uses aliases such as Dietrich Borchardt and Krokodil). :-) The name NuKE is familiar to those that read the book from George Smith "The Virus Creation Labs". The underground are bunches of aged children, playing with fantasies of nuking cyberspace with viruses. Some of them are capable of writing a virus, much more are unable to, and all they do is discussing about, and exchanging samples among themselves. The Edge of Reality is one of the active BBSs on NuKEnet, and serves as a node in the provision of virus samples to ESaSS, the producer of Thunderbyte. InVircible is a generic antivirus product, and it does not need a constant flux of new virus samples, nor did I need many of them for the development of IV. Just a few archetypes of the major families and occasional samples implementing a new virus technology is all that was needed to make InVircible an extremely effective antiviral tool. This is why NetZ Computing, or I, were never members of CARO, or the NCSA, nor subscribed to the Virus Bulletin. :-) These organizations, neither the undergrounds had nothing to offer us, we didn't need their virus collections, and it was stupid from Veldman to imply a symbiotic affiliation between us and the underground. The one entangled with the undergrounds in a Gordic Knot is Veldman himself. I wished that Veldman wouldn't bring the issue, in a self-degrading attempt to discredit me, and hence my product. I was under the impression that Veldman was wiser than that. Zvi Netiv, author InVircible NetZ Computing ------------------------------ End of VIRUS-L Digest [Volume 8 Issue 12] *****************************************