Hacker 2/HACKER2.mdf/virus/virusl2/virusl2.235

Text File | 1995-01-03 | 22KB | 484 lines

VIRUS-L Digest   Wednesday,  8 Nov 1989    Volume 2 : Issue 235

VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a non-digested Usenet counterpart.
Discussions are not limited to any one hardware/software platform -
diversity is welcomed.  Contributions should be relevant, concise,
polite, etc., and sent to [e-mail] (that's
LEHIIBM1.BITNET for BITNET folks).  Information on accessing
anti-virus, document, and back-issue archives is distributed
periodically on the list.  Administrative mail (comments, suggestions,
and so forth) should be sent to me at: [e-mail].
 - Ken van Wyk

Today's Topics:

Re: SCANV42 and ASHAR Virus (Mac...really PC)
Re: Use of the term "SNEAK"
Re: Where are the Sophisticated Viruses?
Macwight Virus (?)
Reviewing a Virus Article
Virus List (MAC)
TROJAN Horse by the name of NORTSTOP (PC)
Previously reported BootChek problems (PC)
Re: Virus source available in Toronto
Re: Where are the Sophisticated Viruses?
need disinfection info for BRAIN virus (PC)
WARNING: Brain virus infection (PC)
Re: Virus List - Notes (Mac)
excerpts from risks-l digest

---------------------------------------------------------------------------

Date:    Tue, 07 Nov 89 07:38:30 -0500
From:    [e-mail] (David Gursky)
Subject: Re: SCANV42 and ASHAR Virus (Mac...really PC)

SCANV42 and the Ashar virus have nothing to do with the Mac :)

[Ed. An embarassed moderator stands corrected.  :-)]

------------------------------

Date:    Tue, 07 Nov 89 07:44:31 -0500
From:    [e-mail] (David Gursky)
Subject: Re: Use of the term "SNEAK"

In Virus-L V2 #234, <polari![e-mail]>,
[e-mail] (robert)
[Robert Riebman] speculates that Robert Woodhead's Virex application
takes a more conservative approach than Interferon, and does not worry
about identifying new viruses, under the generic term "Sneak".

While I do no use Virex, it is my understanding that it does try the
same trick as Interferon, and identify suspicious code as a "sneak"
virus.

As also stated previously, there is no virus known as "sneak" per se.
This is a term Woodhead alone uses to discuess new viruses that his
applications are not familiar with.

------------------------------

Date:    07 Nov 89 00:00:00 +0000
From:    "David.M..Chess" <[e-mail]>
Subject: Re: Where are the Sophisticated Viruses?

In reply to a posting of mine, [e-mail] (jim frost) writes

> Sigh.  We're lucky that no very competent programmer has tried to
> write a virus, all right.

and goes on to give examples of some nasty things that future
viruses/worms might do.  His item is interesting and welcome;
I'm not clear, though, in what sense it's a reply to mine, or
what the "sigh" means.   In the posting that Mr. Frost is
quoting from, I was just replying to the original assertion
that current tools would not be able to detect a virus that
bypassed the operating system to talk directly to the hardware,
by pointing out that one class of tool that's common today
would not be fooled by that approach.  I certainly didn't
mean to suggest that there aren't *other* clever things
that viruses could do, but haven't yet done.

DC

------------------------------

Date:    Tue, 07 Nov 89 10:06:33 -0500
From:    "Gregory E. Gilbert" <[e-mail]>
Subject: Macwight Virus (?)

Is there such a beast?  Shuld I add it to the current list I have of
KNOWN viruses?  There is plenty of room now that I have deleted
"SNEAK" and "San Jose" from the list.  Thanks for the clarification.

P. S.  If anyone has a history of Macwight, if it exists, please forward
me a copy. Thanks again.

Gregory E. Gilbert
Computer Services Division
University of South Carolina
Columbia, South Carolina   USA   29208
[phone]
Acknowledge-To: <C0195@UNIVSCVM>

------------------------------

Date:    Tue, 07 Nov 89 10:13:28 -0500
From:    "Gregory E. Gilbert" <[e-mail]>
Subject: Reviewing a Virus Article

I apologize for posting this request again.

I am writing an article for our computing newsletter and if anyone
would care to review it (if OK with Ken I can post it when finished) I
would welcome the critiques.  The only catch is that I must have the
reviews back NO LATER THAN 13 November.  If interested please send me
your address.

Gregory E. Gilbert
Computer Services Division
University of South Carolina
Columbia, South Carolina   USA   29208
[phone]
FAX:  [phone]
Acknowledge-To: <C0195@UNIVSCVM>

------------------------------

Date:    Tue, 07 Nov 89 11:45:17 -0500
From:    Jason <[e-mail]>
Subject: Virus List (MAC)

I try to keep up with the Macintosh virus arena, but I've never heard
of the Dukakis virus.  Could someone please summerize some information
on what it is, where it started, and what it does?

Thank you,

=From the desk of: *=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
*  Jason D. Blue                          =  User Services                  *
=  User Support Center Specialist         *  The MITRE Corporation          =
*  [e-mail]                 =  703-883-7999                   *
=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=
Disclaimer:    The views expressed above are my own and do not reflect the
        position of my employer.

------------------------------

Date:    Tue, 07 Nov 89 12:33:07 -0500
From:    [e-mail]
Subject: TROJAN Horse by the name of NORTSTOP (PC)

From: Mr. J. Vavrina,   Intel & Sec Div, Automation Branch
Subject: TROJAN Horse by the name of NORTSTOP (PC)
I received this message via Ham Radio.

Path: K4NGC!W3IWI!WA4ONG!WB0TAX!WA2PVV
Date: 05 Nov 89 03:06:20 Z
From: WA2PVV@WA2PVV
To: KA4USE
Subject: Found This On My System

There is a file going around called either NORTSTOP.ZIP or NORTSHOT.ZIP
which, by it's (sparse) documentation and the copyright inside the EXE
file, claims to be from Norton Computing.  Because of the sparse and
unprofessionally presented docs, I looked within the EXE file and found:

  The Norton Public Domain Virus Utility,  PD Edition 5.50,  (C)1989
  Peter Norton

     Your System has been infected with a Christmas virus!  Selected
     files were just eliminated!  Without these files, you might as well
     use your computer as a damn, boat anchor!  If you do NOT own a
     boat, you may want to replace the files which were just erased.
     Try to determine which files they were.  HARDY  HA! HA! HA! HOW DO
     YOU FEEL NOW; YOU IDIOT?   MERRY CHRISTMAS AND HAPPY NEW YEAR!

===================
PKUNZIP reports:

 1065  Implode    650  39%  10-04-89  12:26  9778978d --w  READ-ME.NOW
38907  Implode  30156  23%  10-02-89  11:57  c333dec0 --w  NORTSHOT.EXE
- -----          ------  ---                                 -------
39972           30806  23%                                       2

I spoke with Craig and Tony from Norton Computing and it sure ain't
their's.  I DID run McAfee's SCANV on it, and it came up empty, so
either SCANV simply can't recognize it, or it's a prank, but either way,
it has no business being in circulation.  Be on the look out!

     To: ALL
   From: TONY MCNAMARA
   Subj: Trojan Horse

    We at Peter Norton Computing would like to bring to your attention
an unauthorized trojan horse named NortStop.ZIP or NortShot.ZIP (these
files are the same).  This file was NOT produced with the knowledge or
permission of PNCI.

    This file is not a virus (it does not infect files).  Instead, it
is a trojan horse (it must be run explicitly to cause any damage).
When run, it lists the directory and claims the system is virus-free.
Between December 24th and December 31st, however, it will erase files
in several directories based on their extensions.

    These files can be recognized by their sizes (NortStop.ZIP is
31744 bytes, NortStop.EXE is 38907 bytes), or by doing a text search
for the strings "NORTSHOT.EXE" in the ZIP, "Norton Public" in the EXE.

    If you find or hear of these files, please contact us immediately
through Tony McNamara, 213/319-2076 (voice), TMCNAMARA 381-9188 (MCI),
or CompuServe (72477,2504).

    Again, these files are in no way associated with PNCI.  Please
help us track down and eliminate these files.

    Thank you,

        Peter Norton


************** From the Desk of Mr. James M. Vavrina **************
*            Comm 703-355-0010/0011  AV 345-0010-0011             *
*                  DDN [e-mail]                  *
*******************************************************************

------------------------------

Date:    Mon, 06 Nov 89 13:19:08 -0500
From:    Arthur Gutowski <[e-mail]>
Subject: Previously reported BootChek problems (PC)

Regarding a previous couple of postings about problems with BootChek,
it appears that the problem is not a bug.  Evidently, Jeff has indeed
been hit by a virus or system problem of some kind.  After re-SYSing
the hard drive (from a clean system), and reinstalling BootChek, Jeff
says things are back to normal.  Since from the information I've obtained,
it doesn't seem to be bug-related, we (McConachie Associates--sorry John,
but it does have a ring to it) are looking at the other possibilities
(maybe a virus? or a system quirk?).  More info to come later.

I perhaps jumped the gun crying "bug", but hey, my experience as a programmer
has taught me to there is only one valid assumption about computing:
It's my fault.  Murphy's Law works in strange ways...

Arthur J. Gutowski,
Co-Author of BootChek
and
+--------------------------------------------------------------------+
| Antiviral Group / Tech Support / WSU University Computing Center   |
| 5925 Woodward; Detroit MI  48202; PH#: [phone]              |
| Bitnet: AGUTOWS@WAYNEST1   Internet: [e-mail]       |
+====================================================================+
| Rules to live by, #153:                                            |
|   Never get caught on the wrong side of a Doppler shift.           |
+--------------------------------------------------------------------+

- ------- End of Forwarded Message

------------------------------

Date:    07 Nov 89 20:01:02 +0000
From:    [e-mail] (Kelly Goen)
Subject: Re: Virus source available in Toronto

Sorry about the fact you got hurt personally out there in the
hinterlands...  I should have classified my statement even further...
the published "CURRENT" sources are not really that much of a threat
to a person experienced in counter- measures against viruses(READ Safe
Computing Practices...) and like it or not until more effective
protection is put into the silicon itself.. the watchword of the
future is be prepared carry computer condoms!!While any virus can be
deadly to the unprepared every one of the current day viruses that the
CVIA and other organizations and individuals has had the chance to
analysize... has been of the short fuse variety... this makes them
relatively easy to detect...  much greater damage can be done to the
security of an organization or a country by using viral techniques to
put covert data channels into place... these and other tricks will be
the next generation of virii...as far as the present day ... we will
always see relatively primitive virii being produced from published
\sources... as the publication usually lags the industry by as much as
several months it gives vendors who are in tune to this problem
several man months of r+d Time for new nostrums... I agree that while
some damage is done by sources but robert morrises type doesnt work
from published sources...  they usually have the skills necessary to
bypass that!!About the only sophisticated technique i have seen was in
traceback....all else was just standard dos/bios System programming
skills needed to implement...the biggest leg up to a budding virii
developer are the tsr programming packs with source and various
articles and tools on reverse code engineering...so sorry to poke
holes in your favorite theorys but we havent seen or detected any more
than annoyance viruses from published sources ghost viruses not
withstanding...(again I will reiterate for the computer \user
unwilling to make the commitment in time and energy to become
knowledgeable about safe computer practices these viruses can indeed
be deadly but enough sources have been released at this point that the
genie really cant be put back in the bottle(I too wish it hadnt
happened... but it did and now we have to learn to live with and treat
the problem... just like aids in the bay area... one is either
knowledgeable or one will be eventually dead!!) same for computers one
will either be knowledgeable or...  some idiot there will release a
virus and throw ones data in the bit bucket...  As far as the
unsophisticated user who wants to protect well thats what CVIA is
there for...
           cheers
           kelly
p.s. sorry guy but I dont take a hand wringing approach to the problem
of published sources...mostly every thing I have seen so far is on a
relatively primitive level... i.e. no 1-way decryption... no shadow
allocation systems...  no memory residence being done by techniques
which totally bypass dos and any existing antiviral products...no PSP
backtracing and use of obsolete ways into dos!!in other words nothing
much more than present day leading edge tools can protect against!!it
could easily be a far far worse situation if various government
"black" organiztions and/or terrorists and/or Corporate IE (Industrial
Espionage) types were to fund underground virus developement for
unknown neferious goals ....

------------------------------

Date:    07 Nov 89 20:26:46 +0000
From:    [e-mail] (Kelly Goen)
Subject: Re: Where are the Sophisticated Viruses?

Jesus you mean someone else out there can think for himself...as far
as what you said 100% concurrence...it would turn most even tech types
pale to see what a "guru" could put together... fortunately most to
date have been of the relatively non-malicious variety...(gurus that
is) I work locally here in Silly-Con valley as a Network nerd and
various wizard on\ a extremely broad swath of tech areas... anti-viral
lab work is a VERY large part of that... I am running 386/pcdos only
in protected mode with several layers of antiviral products... my
write lines on my drive interfaces have to be explicitly and manually
enabled...VM/8086 partitions are used to block direct access to REAL
Memory or IO PORTS (And I even feel nervous telling the entire
readership of this newsgroup that much) I also encrypt my disks... I
cant endorse any products publicly but certain products are a definite
step above others...also incrementally backup in the background at
extremely frequent intervals AND even I can be HIT
Sucessfully..........!!!  my net seems to be 99% sucessful so far but
knock on wood!!!
          cheers
          kelly


------------------------------

Date:    Tue, 07 Nov 89 17:09:00 -0600
From:    [e-mail]
Subject: need disinfection info for BRAIN virus (PC)

In using Viruscan (version 4.8) the scan found PAKISTANI/BRAIN/ASHAR
virus on a number of student diskettes.  I check the Homebase BBS and
didn't find a disinfection program for these strains.  Can anyone
suggest a disinfection program and if there's one on the network that I
can get?  Is running a disinfection program the solution to this/these
viri??

Thanks....
Neta Counts

------------------------------

Date:    Tue, 07 Nov 89 19:06:28 -0600
From:    [e-mail] (Vince Laurent - work id)
Subject: WARNING: Brain virus infection (PC)

Our Computer Centers have been blessed with the return of (c)Brain. We
also have recorded cases of the Jerusalem B virus. Both of these have
been found by the VIRUSCAN program that was given to our Computing
Information Center.  I have a VACCINE program for (c)Brain but is
there one for the other virus and if so where do I get it or can
someone send it to me? Thanks in advance...

                        ---------------------------------------------
                        | Vincent J. Laurent                        |
                        | Computing Information Center &            |
                        |             Computer Learning Center 1    |
                        | Southern Illinois University - Carbondale |
                        | CA6692@SIUCVMB                            |
                        ---------------------------------------------

------------------------------

Date:    Tue, 07 Nov 89 16:31:22 +0000
From:    biar![e-mail] (Robert J Woodhead),
         [e-mail] (Robert J Woodhead)
Subject: Re: Virus List - Notes (Mac)


[e-mail] (Joe McMahon) writes:

>This was simply a convenient name for a particular virus-like code
>pattern that Bob Woodhead's "Interferon" program looked for - for
>those who are interested, an immediate branch out of CODE 0 to some
>other CODE segment.  There is no specific virus called SNEAK, and
>there never has been.

No, what you are describing is the infamous Interferon Anomaly 104.
The infection strategy I described as ``sneak'' was changing the
type of a common System folder file to INIT.  This check was too
rigorous and gave false positives when System 6.0 came out because
in 6.0 some of the file types changed.

You are right : there is no such thing as SNEAK.  And Interferon is
obsolete now; use Disinfectant or (plug, plug) Virex.

- --
Robert J Woodhead, Biar Games, Inc.   !uunet!biar!trebor | [e-mail]
Announcing TEMPORAL EXPRESS.  For only $999,999.95 (per page), your message
will be carefully stored, then sent back in time as soon as technologically
possible.  TEMEX - when it absolutely, postively has to be there yesterday!


------------------------------

Date:    Tue, 07 Nov 89 22:58:00 -0500
From:    [e-mail]
Subject: excerpts from risks-l digest

Following are two excerpts from RISKS-L digest.  Enjoy, Cl.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Claude Bersano-Hayes     HAYES @ URVAX                 (Vanilla BITNET)
University of Richmond   [e-mail]     (Bitnet or Internet)
Richmond, VA  23173      ...!psuvax1!urvax.bitnet!hayes          (UUCP)

 --- begin forwarded message ---

RISKS-LIST: RISKS-FORUM Digest  Tuesday 7 November 1989   Volume 9 : Issue 39

        FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS
   ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Contents:
* Computer Viruses Attack China (Yoshio Oyanagi)
* First Virus Attack on Macs in Japan (Yoshio Oyanagi)

Date: Mon, 6 Nov 89 12:15:25+0900
From: Yoshio Oyanagi <[e-mail]>
Subject: Computer Viruses Attack China

     Ministry of Public Safety of People's Republic of China found this
summer that one tenth of the computers in China had been contaminated by
three types of computer virus:  "Small Ball", "Marijuana" and "Shell", China
Daily reported.  The most serious damage was found in the National
Statistical System, in which "Small Ball" spread in 21 provinces.
In Wuhan University, viruses were found in *ALL* personal computers.
     In China, three hundred thousand computers (including PC's) are
in operation.  Due to premature law system the reproduction of
software is not regulated, so that computer viruses can easily be
propagated.  Ministry of Public Safety now provides "vaccines" against
them.  Fortunately, those viruses did not give fatal damage to data.
                                   Yoshio Oyanagi, University of Tsukuba, JAPAN

 ------------------------------

Date: Tue, 7 Nov 89 17:07:09+0900
From: Yoshio Oyanagi <[e-mail]>
Subject: First Virus Attack on Macs in Japan

First Virus Attack on Macs in Japan

     Six Macs in University of Tokyo, Japan, were found to have caught
viruses, newspapers and radio reported.  Since this September, Prof. K. Tamaki,
Ocean Research Institute, University of Tokyo, has noticed malfunctions on the
screen.  In October, he applied vaccines "Interferon" and "Virus Clinic" to
find his four Mac's were contaminated by computer viruses, "N Virus" type A and
type B.  He then found ten softwares were also infected by viruses.  A Mac of
J. Kasahara, Earthquake Research Institute, University of Tokyo, was also found
to be contaminated by N Virus and Score Virus.  Those are the first reports of
real viruses in Japan.

     Later it was reported that four Mac's in Geological Survey of Japan, in
Tsukuba, were infected by N Virus Type A.  This virus was sent from U. S.
together with an editor.
                                        Yoshio Oyanagi, University of Tsukuba

------------------------------

End of VIRUS-L Digest
*********************
Downloaded From P-80 International Information Systems 304-744-2253