VIRUS-L Digest Thursday, 16 Feb 1989 Volume 2 : Issue 49 Today's Topics: Info on virus reported in Comm. of the ACM? Virus-Group Request for info about Atari viruses. Appleshare Network Security Another Anonymous FTP host for VIRUS-L archives --------------------------------------------------------------------------- Date: Wed, 15 Feb 89 01:11 EDT From: Subject: Info on virus reported in Comm. of the ACM? Does anyone know anymore information about the virus reported in the February 1989 volume 32 number 2 page 274 issue of the Communications of the ACM? According to the article: "A hardware-induced computer virus could potentially affect 25 million microcomputers, according to a recent discovery by researchers at NOVA University and ErrorNot Corporation. The researchers say the viruse is the result of faulty programming in the microcode of a device used in computers. Research indicates this viruse causes data corruption, and its random pattern of attack with small data destruction makes is difficult to identify. The virus's dormancy period varies from weeks or months to even years." The article then proceeds to give an address at NOVA where you can send five dollars and receive a report of their findings (TR-881101-1). Does anyone know anything about this? It is news to me and the article offers no insight. Mark James Burge MJBURGE@OWUCOMCN ------------------------------ Date: Wed, 15 Feb 89 17:01:46 +0100 From: dewal@unido.bitnet Subject: Virus-Group University of Dortmund Department of Computer Science Software Technology Laboratory Sanjay Dewal Postbox 500 500 D-4600 Dortmund 50 W.Germany Hallo, in the readnews comp.os.vms I read that there exists a group especially on the subject of Virus. Is it possible to get more information of this group? Could I get into this group in order to get the informations passed around as well? I am a system manager myself. Therefore I'm interested in news on Viruses. Thanks in advance. Bye Sanjay Dewal (dewal@unido.uucp or dewal@exunido.uucp) ------------------------------ Date: Wed, 15 Feb 89 01:11 EST From: "Scott P Leslie" Subject: Request for info about Atari viruses. Hello, Could someone please send me information concerning viruses on the Atari ST computers. I just started using PD software so I would like to have knowlegde of possible infections to my system. - -- Thanks, Scott P. Leslie (UNCSPL@UNC) ------------------------------ Date: Wed, 15 Feb 89 10:21 EST From: Roberta Russell Subject: Appleshare Network Security I manage a Macintosh network running AppleShare 2.0 FileServer and PrintServer. Users on the network have the option of downloading server software or using their own. All printing jobs, regardless of software, are spooled to the server. I am the only person enabled to write to the server. Yesterday, while doing backups, I noticed three new document files in the system folder: (creator) (type) 0Aldus1.2Prep 36k asps lspt 0Aldus1.2PrepS 6k asps lspt 0Aldus1.2Prep 0k asps lsqt The files were in a new print queue folder called Q_0aserWriter II_* together with the usual queue and log files for the LaserWriter. They appear to have been created by the server software, but how and why is a mystery to me. PageMaker is not a program on the server. Someone obviously has used an outdated (and probably pirated) copy to do some printing. I called Aldus to find out how a their prep file and dictionary could be copied to a write-protected server. They had no idea. Since there is now a virus (INIT 29) that attaches itself to documents, I am understandably nervous about unknown files lying around on the server. If anyone knows how these files are created and, most important, how I can keep them off, please let me know. Many thanks. Robin Russell///Oberlin College Computing Center///prussell@oberlin ------------------------------ Date: Wed, 15 Feb 89 15:19:45 est From: ubu!luken@lehi3b15.csee.lehigh.edu Subject: Another Anonymous FTP host for VIRUS-L archives Thanks to Vijay Subramaniam, we now have another anonymous FTP host for the VIRUS-L archives, lll-winken.llnl.gov. The difference between that site and ibm1.cc.lehigh.edu is that lll-winken.llnl.gov is a UNIX based machine that is connected to the NSFNET backbone, thus providing fast reliable FTP service to Internet users. Also, binary files will be stored there as binary files, not in uuencoded format, and the VIRUS-L digests will be stored individually (by number), not in weekly logs. Finally, all the files will be stored hierarchically in subdirectories. The directories are as follows: virus-l - base directory for VIRUS-L related files virus-l/archives - base directory for archive files virus-l/archives/1988 virus-l/archives/1989 ... - each subdir contains digests for that year. virus-l/src - base directory for programs virus-l/src/pc virus-l/src/mac virus-l/src/misc ... - each subdir contains programs for indicated machine. virus-l/docs - directory for virus related documents, like the Internet Worm reports. It will take a few days to get all the files there, so please be patient. Comments, suggestions, etc., are welcomed. Ken ------------------------------ End of VIRUS-L Digest ********************* Downloaded From P-80 International Information Systems 304-744-2253