Handbook of Infosec Terms 2.0/Handbook_of_Infosec_Terms_Version_2.0_ISSO.iso/text/virusl/vl04_047.txt

Internet Message Format | 1996-09-04 | 20.9 KB

From:       Kenneth R. van Wyk (The Moderator) <[e-mail]>
Errors-To: [e-mail]
To:       [e-mail]
Path:      cert.sei.cmu.edu!krvw
Subject:   VIRUS-L Digest V4 #47
Reply-To:  [e-mail]
--------
VIRUS-L Digest   Monday, 25 Mar 1991    Volume 4 : Issue 47

Today's Topics:

Re: Standardized virus signatures (PC)
Hardware failures & viruses (PC)
Update VCS virus warning
IBM VIRSCAN version (PC)
Virus naming
Mutation of Stoned (PC)
Mac Viruses vs. PC Viruses: Coding Comparison
STONED Problems (PC)
Re: Alternatives to floppy-booting
Bloody (PC)
FPROT vs SCAN (PC)
PKLITE and hidden virus (PC)
Source for F-DISINF (Stoned) (PC)
Re: PKLITE and hidden virus (PC)
Info on virus products wanted - PD and commercial
Has anyone heard of Central Point Anti-Virus? (PC)

VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a non-digested Usenet counterpart.
Discussions are not limited to any one hardware/software platform -
diversity is welcomed.  Contributions should be relevant, concise,
polite, etc.  Please sign submissions with your real name.  Send
contributions to [e-mail] (that's equivalent to
VIRUS-L at LEHIIBM1 for you BITNET folks).  Information on accessing
anti-virus, documentation, and back-issue archives is distributed
periodically on the list.  Administrative mail (comments, suggestions,
and so forth) should be sent to me at: [e-mail].

   Ken van Wyk

---------------------------------------------------------------------------

Date:    Thu, 21 Mar 91 16:12:02 +0300
From:    [e-mail] (Eldar A. Musaev)
Subject: Re: Standardized virus signatures (PC)

The scanners have an unpleasant feature. If someone changes the
signature of the virus, it (virus) becames unfamiliar to scanner. So
the publication of signatures leads to the new versions with new
signatures etc.  Though it is a good question what is better, this
emergency or the self-restrictions in communications ...

Eldar A. Musaev            lomi.spb.su![e-mail]
researcher, Ph.D., Mathem.Inst., Acad. of Sci., Leningrad

------------------------------

Date:    Thu, 21 Mar 91 16:12:30 +0300
From:    [e-mail] (Eldar A. Musaev)
Subject: Hardware failures & viruses (PC)

Approx. a week ago I was invited to a computer to find a virus.
Accidental symbols were appearing on the screen every minute or two
ones. The original reason was NOT connected with any virus and lay in
the incompatability between time characteristics of video RAM and
processor plus(?) magnetic anomalies in the athmosphere.  I am very
often disturbed by users who takes hardware failures for a virus. And
some time a hardware problems managed someone to note the presense of
a virus. I think the similar situation was in the case noted by Adam
M. Gaffin last month.  What could we do to help users to distinct
viruses and failures ?  Except scanners, of course.

Eldar A. Musaev            lomi.spb.su![e-mail]
researcher, Ph.D., Mathem.Inst., Acad. of Sci., Leningrad

------------------------------

Date:    21 Mar 91 12:24:00 +0100
From:    Klaus Brunnstein <[e-mail]>
Subject: Update VCS virus warning

Original-From: [e-mail] (Matthias Jaenichen)
               "Virus-Test-Center University of Hamburg"

!!!!!!!!!!!!!!!!!!!!!! Update Update Update Update !!!!!!!!!!!!!!!!!!!!!!!!!
Virus: "VCS-1.0" (Virus Construction Set Virus 1.0)

As we resently found out, the virus uses a self encryption-method.
The string at 50h and the two filenames are encrypted.

The ***updated search pattern*** is:
    "E8 14 00 8a a4 2f 05 8d bc"

Plain text can not be found.

BtW: meanwhile, we received a copy from abroad where it was uploaded
from tbe BBS; moreover, several people have informed us, at Hannover
fair, about this incidebnt. We therefore assume that the virus may
spread further. More information (esp. Virus Catalog entry) will be
available after completion of reverse engineering; information will be
passed to Virus-L. Klaus Brunnstein

!!!!!!!!!!!!!!!!!!!!!!!! Update Update Update !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
- ----------------------------------------------------------------------------
Best wishes form Hamburg                             \\    // /==#==\  /==\
Matthias Jaenichen                                    \\  //     #    /
VTC-Hamburg                                            \\//      #    #
e-mail: [e-mail]      \/      _#_    \==/
- ----------------------------------------------------------------------------

------------------------------

Date:    21 Mar 91 14:17:05 -0500
From:    "David.M.Chess" <[e-mail]>
Subject: IBM VIRSCAN version (PC)

[e-mail] (Rob Slade) writes:

>[e-mail] (David K. Mickle) writes:
>
>> I got my copy through our PC vendor, Microage of Beverly Hills.  They
>> obtained it at my request from their IBM rep who downloaded it from an
>> IBM internal service.  The version number 1.51 is correct.
>
>My understanding is that, until March 8th, the correct "public" version
>of IBM's VIRSCAN product was 1.3, 1.51 being a corresponding "internal"
>product.  However, I believe version 2.00.01 is now available for both
>internal and public use.

Quite right.  David's vendor's IBM rep apparently downloaded the
internal version (at that time numbered 1.51) instead of the product
version (at that time numbered, on a different track, 1.3).  The
now-converged numbering should have (finally!)  fixed this sort of
thing!  So we should soon be able to stop taking up space on VIRUS-L
with it...  *8)

DC

------------------------------

Date:    21 Mar 91 14:21:38 -0500
From:    "David.M.Chess" <[e-mail]>
Subject: Virus naming

The trouble with hash codes, or dates, or anything else semi-automatic
is that, when there get to be enough of them, the names start to
become useless.  At IBM, we tried to use number-names whenever
possible early on, but the disadvantages became apparent after not too
long.  If there's a 453 and a 435 virus, for instance, it's Real Hard
to remember which is which!  The same would apply to a #AR657XXL and
#AR567LXL, or a PC Smith 910004 and PC Smith 910014.

Our current rather tentative approach is to use a
generally-non-numeric stem for each virus family, and then tack on a
number or similar object to pin down exactly which object we're
discussing.  So we talk about the "Flip-2343" and the "Flip-2153" (if
I've remembered the numbers right).  The first part helps the human
remember which virus in general this is, and the second part pins it
down.  If it is desirable to have a distinct number of some kind for
each virus (and it might well be at some point), I'd suggest having a
technically- redundant-but-in-fact-very-very-helpful-to-us-
finite-humans human name for each one (or at least each strain) as
well.

DC

------------------------------

Date:    21 Mar 91 15:01:52 -0500
From:    "David.M.Chess" <[e-mail]>
Subject: Mutation of Stoned (PC)

Pat Ralston <[e-mail]> writes:

>We have found a mutation of the Stoned or Stoned II virus.  McAfee's
>VIRUSCAN version 74B reports Stoned, but ONLY on FLOPPY disks.
>Version 74B cannot find Stoned on the hard disk.  However, when using
>Norton Disk Editor we find the following message in the Partition
>Table" "Your PC is now Stoned!  LEGALISE".  Please note that Legalise
>is NOT spelled with a Z as in other versions and is in all uppercase
>letters.

Now I'm taking an unusual (for me) risk here, as I'm at home with the
tail end of a nasty cold, and can't verify it, but I'm Pretty Sure
that the standard normal everyday Stoned virus spells the word with an
"S" ("LEGALISE").  There are also many cases in which the word
"MARIJUANA" has been overwritten (probably, I am told, by hard disk
controllers that keep some data in an "unused" part of the master boot
record, and overwrite that word in the process).  So my guess would be
that you have the normal vanilla Stoned virus, and 74B just isn't
seeing it on the hard disk for some reason (have you tried 75 yet?).
DC

------------------------------

Date:    21 Mar 91 15:08:10 -0500
From:    "David.M.Chess" <[e-mail]>
Subject: Mac Viruses vs. PC Viruses: Coding Comparison

A few nits on Jonathan E. Oberg ([e-mail])'s basically
sound posting:

> PC viruses primarily attack the partition tables and boot sectors of a
> disk.

I'm not sure what this "primarily" means.  There are in fact more
file-infectors than there are boot-infectors for PC-DOS.

>PC viruses trap interupts, perform their task and then (hopefully)
>call the original interrupt.  Thus pc viruses can only activiate on
>BIOS calls.

No.  The typical file-infecting virus traps INT 21 calls, which are
DOS, not BIOS, calls.  Boot-infectors do typically trap BIOS calls.
But of course a virus doesn't *have* to trap any calls at all; the
Vienna-648 virus, which was reasonably widespread at one time, was a
non-resident virus that didn't trap anything.

>4. A PC virus is typically only a few dozen bytes long.

The typical file infector is 1000 or so bytes long; a typical short
one is a few hundred bytes, a typical long one is a few thousand.
Boot infector lengths are similar.  I know of only one virus that's
really "a few dozen bytes" (45, I think it is), but it's very unusual.

DC

------------------------------

Date:    Thu, 21 Mar 91 16:44:18 -0500
From:    Padgett Peterson <[e-mail]>
Subject: STONED Problems (PC)

   Recently a number of people have mentioned STONED infections
trashing hard disks & think that the following is why.

  Today, nearly every partitioning software aligns the partitions on
even track boundarys for simplicity. Since the Partition Table resides
on track (cyl) 0 head 0 sector 1, the balance of this track is usually
left alone and the first partion starts on the next track. However,
this is just convension and not a requirement. In fact FDISK 1.00
which came with DOS 2.x began the first partition on track 0 head 0
sector 2 and has no "hidden" sectors.

   Since DOS version 3.0 came out in 1984, the later convension has
been followed and Norton's DI usually reports 17 "hidden" sectors (all
of track 0 head 0).

   STONED does not bother to check and just copies the original
partition table code to track 0 head 0 sector 7. No problem if this is
a "hidden" sector but disastrous (to DOS) if not. THIS IS REPAIRABLE.

   DOS keep two copies of the FAT (which STONED just overwrote) and
several utilities exist (Norton Disk Doctor is one) that will copy #2
onto #1 if some utility (like CHKDSK/F) hasn't corrupted the second
copy. It can also be fixed manually by someone with a bit of
experience.

   Consequently, I suspect that those experiencing FAT-type problems
had the misfortune to have a drive that was partitioned using "old"
software and then became infected with STONED.

                            Padgett

------------------------------

Date:    Fri, 22 Mar 91 16:28:00 +0700
From:    "Jeroen W. Pluimers" <[e-mail]>
Subject: Re: Alternatives to floppy-booting

In VIRUS-L volume 4, issue 46, Rob Mason says:

> Our MINIX-OS class is presently using floppies to boot the system
> (v1.2) on AT-clones. We would like to eliminate all booting from
> floppies by recabling the drives. This is needed to prevent the spread
> of the stoned virus on the C: partition (Minix is on the D:
> partition).
>
> I see at least two solution strategies: either start up MINIX as a
> process under DOS (as NYU Ultra does), or have MINIX booting directly
> off the D: partition. The second method requires us to put MINIX boot
> sectors on the D: partition and provide some "user transparent"
> switch-active-partition software that is accessible from either
> partition. Perhaps a .logoff file on the MINIX side could access the
> switch program directly, since we run DOS most of the time.

You could get the <MSDOS.SYSUTIL>ANYBOOT.ZIP file from SIMTEL20.  It
modyfies the master-boot record on your PC so that it can boot from
multiple paritions. I did not yet try the program, but from the
sources and the documentation, it seems it would work OK.

On boot, it allows you to choose (by means of functions keys) to
choose which parition will boot.

Another way would be to remove the cabling from the floppies or tell
the CMOS RAM (if you have an AT or higher, but I suppose thats
required for minix) that no floppie drives exist.

<MSDOS.DSKUTL>FDFRM16A.ZIP contains a program that allows un-bootable
diskettes to boot directly from the hard-disk. Maybe that also works
for you.

Hope this helps,

Jeroen W. Pluimers - Gorlaeus Laboratories, Leiden University

------------------------------

Date:    Fri, 22 Mar 91 17:20:18 +0700
From:    [e-mail] (Morton Swimmer)
Subject: Bloody (PC)

The "Bloody" virus has just hit Germany. (The virus was described
before.)  It was reported to us at our information stand at the CeBit
1991 by a firm from Darmstadt.
    It is fairly stupid, or so it seems, as it doesn't even
maintain a minimal boot record. It therefore creates all sorts of
wierd mistakes and causes floppy disks to become unusable.

Cheers, Morton

------------------------------

Date:    Fri, 22 Mar 91 11:46:24 -0600
From:    Mark Parr <[e-mail]>
Subject: FPROT vs SCAN (PC)

>I am looking for some info regarding FPROT114 vs. SCANV75.  What are
>the advantages disadvantages of each. I would also like some info on
>FPROT114 vs. NETSCAN75. Please respond directly to me. Thanks in
>advance.

>Jeff
>usgjej@gsuvm1
>[e-mail]

I've just started using FPROT in order to determine what I want to
use as virus-protection:  Scan/McAfee products or FPROT.

I've not used FPROT enough to give you an "experienced" comparison,
but there is one major plus in FPROT's favor: F-DRIVER.SYS

I like the "security" that both VSHIELD and F-DRIVER provide against
know viruses.  However, VSHIELD slows the system down (at least mine --
an XT clone) a considerable amount.  I'm tempted to CTRL-BREAK out of
it before gets loaded.  Since F-DRIVER is loaded in CONFIG.SYS, I can't
do that now. :)   Furthermore, programs seem to load faster using
F-DRIVER.  (The problem with VSHIELD's speed probably was related to
me using the /SWAP switch.)

Still, both are quality products.....

- ----------
"Women:  Can't live with 'em.  Can't shoot 'em."
                               Steven Wright
- ----------

               |-- [e-mail]  --  [e-mail]
   Mark Parr --|-- University of Alabama in Tuscaloosa
               |-- (Understanding computers begins with Time-Life books.)

------------------------------

Date:    Fri, 22 Mar 91 17:22:06 -0800
From:    [e-mail] (Rob Slade)
Subject: PKLITE and hidden virus (PC)

[e-mail] (Jim Pinson) writes:

> Lately I have been using PKLITE to compress executables, and wonder if
> any Virus scanners are capable of looking within the compressed files.

None of the products I have received so far will "scan" into files
compressed with other than LZEXE.  I have seen some "front end" utilities
which will "use" SCAN and PKUNZIP (if you have them in your "path") to
scan .ZIP files.


=============
Vancouver          [e-mail]   | You realize, of
Institute for      [e-mail] | course, that these
Research into      (SUZY) INtegrity         | new facts do not
User               Canada V7K 2G6           | coincide with my
Security                                    | preconceived ideas

------------------------------

Date:    Fri, 22 Mar 91 18:04:29 -0800
From:    [e-mail] (Rob Slade)
Subject: Source for F-DISINF (Stoned) (PC)

[e-mail] writes:

> Does anyone know of a source for "F-DISINF" or other antiviral program
> for use against the STONED virus?  The virus has apparently gotten
> into my Partition Table.

F-DISINF is part of the FPROT package.  The author, Fridrik Skulason, is
available at "[e-mail]".  The file FPROT114.ZIP is available on
SIMTEL, cert and other servers, and should be getting better distribution
now on local BBSes.


=============
Vancouver          [e-mail]   | You realize, of
Institute for      [e-mail] | course, that these
Research into      (SUZY) INtegrity         | new facts do not
User               Canada V7K 2G6           | coincide with my
Security                                    | preconceived ideas

------------------------------

Date:    Fri, 22 Mar 91 17:56:35 -0800
From:    [e-mail] (Rob Slade)
Subject: Re: PKLITE and hidden virus (PC)

[e-mail] (Morgan Schweers) writes:

>     As a general policy, do you think that it would be better to warn
> users that a file is PKLITE'ed and unscanable or to simply ignore it?
> Another problem is that PKWare is planning on coming out with a
> 'professional' version of the program which includes an encryption
> portion that can not be -X'ed.

In INtegrity, I have been asked many times to make all files
"self-extracting".  I have consistently refused on the grounds that
self-extracting files are an undesirable and unnecessary security risk.


=============
Vancouver          [e-mail]   | You realize, of
Institute for      [e-mail] | course, that these
Research into      (SUZY) INtegrity         | new facts do not
User               Canada V7K 2G6           | coincide with my
Security                                    | preconceived ideas

------------------------------

Date:    Fri, 22 Mar 91 17:33:08 -0800
From:    [e-mail] (Rob Slade)
Subject: Info on virus products wanted - PD and commercial

[e-mail] (William Clare Stewart) writes:

> ( The commercial products I've seen require licensing, which I doubt
> the school would spring for, and I'd rather not see them ripping off
> code which is presumably what got them in this trouble.  Do any of the
> commercial products allow schools to use them free?)

I have received one "freeware" (copyright, but no charge for use) package
from Holland, Thunderbyte Scan.  It has three components, a scanner
(TBSCAN), a TSR scanner (TBSCANX) and a disk boot recovery utility
(TBRESC).  Thus, although it does not have a "disinfect" function, it
will indentify files infected with viri so that they can be replaced with
originals, and it will allow floppy boot sectors to be replaced.

I have also seen a program distributed as VC3-2.ZIP, which contains
version 3.2 of a program called "Victor Charlie", of which version 4.0
will apparently be commercial.  This appears to be "change detection"
software.

Aside from that, I recommend FPROT as the cheapest and best "value for
cost" of all the antiviral products yet reviewed.  frisks "licenses" for
educational use are $1 per computer per year as of version 1.14.


=============
Vancouver          [e-mail]   | You realize, of
Institute for      [e-mail] | course, that these
Research into      (SUZY) INtegrity         | new facts do not
User               Canada V7K 2G6           | coincide with my
Security                                    | preconceived ideas

------------------------------

Date:    Fri, 22 Mar 91 17:17:18 -0800
From:    [e-mail] (Rob Slade)
Subject: Has anyone heard of Central Point Anti-Virus? (PC)

[e-mail] writes:

> Has anyone ever heard of a PC product called ANTI-VIRUS put out by
> Central Point Software of Beaverton, Oregon?  I just got a glossy ad
>
> I checked thru some past Virus-L digests, and found two reviews of
> products called Antivirus: one in digest V4-23 for a product by
> Techmar Computer Products and one in digest V4-42 for a product by

"Antivirus" is an understandably common name for antiviral products.
(Another is "Vaccine".)  Neither of the reviews that you have mentioned
is of the Central Point product, nor is the review of Norton Antivirus
which is somewhere in the pipeline.

The Central Point program is very new, and I have not yet received a
copy, although I have written to the company.

Ken should have eight reviews (of mine, anyway) on file at cert by now.


=============
Vancouver          [e-mail]   | You realize, of
Institute for      [e-mail] | course, that these
Research into      (SUZY) INtegrity         | new facts do not
User               Canada V7K 2G6           | coincide with my
Security                                    | preconceived ideas

------------------------------

End of VIRUS-L Digest [Volume 4 Issue 47]
*****************************************