VIRUS-L Digest Thursday, 5 Apr 1990 Volume 3 : Issue 70 Today's Topics: Where can i find MDISK?? (PC) PKZ110EU.EXE - Katz's ZIP archive package v1.10, export vers. Re: =VIR (Mac) Should "Viruses" be callecd "vampires"? Thanks-Virus paper VirusX and Hard Drives Virus in Text Files virus hamming? Dates: day/month/year (Europe) v. month/day/year (USA) Viruses which kill other viruses VIRUS-L is a moderated, digested mail forum for discussing computer virus issues; comp.virus is a non-digested Usenet counterpart. Discussions are not limited to any one hardware/software platform - diversity is welcomed. Contributions should be relevant, concise, polite, etc. Please sign submissions with your real name. Send contributions to VIRUS-L@IBM1.CC.LEHIGH.EDU (that's equivalent to LEHIIBM1.BITNET for BITNET folks). Information on accessing anti-virus, documentation, and back-issue archives is distributed periodically on the list. Administrative mail (comments, suggestions, and so forth) should be sent to me at: krvw@CERT.SEI.CMU.EDU. Ken van Wyk --------------------------------------------------------------------------- Date: 04 Apr 90 10:14:32 +0000 From: ajbanck@praxis.cs.ruu.nl (Arent Banck) Subject: Where can i find MDISK?? (PC) In the documentation of scanv60, I read that I needed the program MDISK (OR M-DISK, another problem for Havel). Where can I find this program? I can use FTP, and I can deuuencode it if you mail it to me. (I have A.T. computer using MS-DOS). ------------------------------ Date: Mon, 02 Apr 90 15:35:00 -0600 From: Keith Petersen Subject: PKZ110EU.EXE - Katz's ZIP archive package v1.10, export vers. The latest export version of Phil Katz's ZIP/UNZIP has been uploaded to SIMTEL20. Because of the laws restricting exporting encryption technology from the USA and Canada, and because of the International nature of the Internet, SIMTEL20 has elected to offer the export version which does not offer certain file encryption features. NOTE: Type B is Binary Directory PD1: Filename Type Length Date Description ============================================== PKZ110EU.EXE B 140116 900402 Katz's ZIP archive package v1.10, export vers. Keith - -- Keith Petersen Maintainer of SIMTEL20's MSDOS, MISC & CP/M archives [IP address 26.2.0.74] Internet: w8sdz@WSMR-SIMTEL20.Army.Mil, w8sdz@brl.mil BITNET: w8sdz@NDSUVM1 Uucp: {ames,decwrl,harvard,rutgers,ucbvax,uunet}!wsmr-simtel20.army.mil!w8sdz ------------------------------ Date: Wed, 04 Apr 90 14:15:09 -0400 From: Joe McMahon Subject: Re: =VIR (Mac) The "not-equals"VIR resource which you mentioned before comes from good old Interferon. Nothing to worry about. You do have something to worry about, though, if that's your only tool for finding viruses! --- Joe M. ------------------------------ Date: Wed, 04 Apr 90 14:51:03 -0400 From: Peter Jones Subject: Should "Viruses" be callecd "vampires"? On Tue, 03 Apr 90 13:57:00, in VIRUS-L Digest Wednesday, 4 Apr 1990 Volume 3 : Issue 68, david paul hoyt said: >Subject: RE: Death of a virus > > Perhaps my real point should be this > > Computer viruses are not the same thing as biological viruses. My feeling is that "viruses" should have been called "vampires", for they change other programs into programs like themselves. But I suppose it's too late to turn back now. "Let your flippers do the walking" :-) Peter Jones (514)-987-3542 Internet:Peter Jones ? Internet:Peter Jones ? UUCP: ...psuvax1!uqam.bitnet!maint ------------------------------ Date: 04 Apr 90 19:10:06 +0000 From: rwillis@hubcap.clemson.edu (Richard "Crash" Willis) Subject: Thanks-Virus paper I would like to thank all the people who sent me material for my Internet Worm paper and to appologize for not replying by e-mail to everyone, but my mail server apparently did not like some addresses. Anyway, to everyone who requested that I forward material to them, please respond if you still need info (sorry I've taken so long to get back) and tell me if you just want everything sent to you, or material on a certain topic. Again, I appologize for the lateness of this post, and thank everyone for their help. -Richard rwillis@hubcap.clemson.edu ------------------------------ Date: Wed, 04 Apr 90 15:41:00 -0400 From: The Mad Doctor Subject: VirusX and Hard Drives >Date: 03 Apr 90 21:47:57 +0000 >From: xrtnt@amarna.gsfc.nasa.gov (Nigel Tzeng) >Subject: Request for Anit-Viral Software (Amiga) > >I am looking for an anti-viral program like the Macintosh Vaccine/GateKeeper >programs for the Amiga. I am also looking for an anti-viral program that will >check my hard drive for viruses on programs that I download directly to it. > >I am currently running the most recent version of VirusX but it does not seem >to scan my hard drive. So far I am hoping that the large FTP archives are >clean and merely backing up regularly. I know this isn't particuarly safe but >I really do not want to recopy everything to a floppy so that VirusX will look >at it. Do I have VirusX misconfigured? The disk checked count does not >indicate that it is checking hd0:. VirusX will not check hard drives...however, Steve Tibbet has included in the archived file a program called "kv", which will check a file for any of the known types of viri. It should have been in the zooed (or lharced) file you got VirusX with. ------------------------------ Date: 04 Apr 90 15:57:50 -0500 From: "Dr. Ruth Mazo Karras" Subject: Virus in Text Files I have heard of a concern that text files (consisting of plain ASCII text) may contain viruses. I had thought that only executable files such as *.com or *.exe files were subject to viruses. Which view is right? Is there risk in moving a text file from a mainframe to a PC? Chris Karras RKARRAS@PENNSAS.UPENN.EDU or RKARRAS@PENNSAS.BITNET ------------------------------ Date: Wed, 04 Apr 90 17:20:33 +0000 From: mike Subject: virus hamming? hello all, a few issues back it was mentioned that some viruses are using hamming techniques to guard against anti-virus programs. could someone give me some more info about this, such as which viruses do this, where i could get articles about viruses that do this. thanks in advance. mike lunny ulunny@setonvm.bitnet ------------------------------ Date: Thu, 05 Apr 90 10:11:40 -0000 From: Anthony Appleyard Subject: Dates: day/month/year (Europe) v. month/day/year (USA) In Virus-L v3 #68 in "MIBSRV files updated (PC)", James Ford wrote: These files were downloaded directly from Homebase BBS on 3/1/90 at 11:30pm. The files they replace (SHEZ51.ZIP and VSUM9002.ZIP) will remain until 3/5ish/90 in case requests for them are pending at BITFTP.". As he wrote in USA, presumably the dates are in the order 'month/day/year' and mean "1 March 1990" and "5ish March 1990". But in European convention, dates are written in the order 'day/month/year', and '3/1/90' means "3 Jan 1990". As Virus-L is distributed to very many people outside USA, I feel that it would be best if users wrote dates with the month in letters ('Jan', 'Feb', etc), to avoid this ambiguity. {A.Appleyard} (email: APPLEYARD@UK.AC.UMIST), Thu, 05 Apr 90 10:03:48 BST ------------------------------ Date: Thu, 05 Apr 90 11:19:44 -0000 From: Anthony Appleyard Subject: Viruses which kill other viruses Ref the articles listed in this extract from the Virus-L vol3 index:- SUBJECT ISSUE [Idea for WDEF Inoculation] spread a virus that kills other viruses 33 Not such a good idea [WDEF, WDEF, WDEF] 34 I <> want a virus, even for it to kill other viruses!!! 36 Attempted antivirus virus? Original nVIR deleted system file, so someone wrote new nVIR which killed old nVIR [Re: Mac Virus Harmlessness] 36 Best not try it [Re: Idea for WDEF Innoculation] 38 Good idea! [Re: Idea for WDEF Innoculation] 38 ............................................................................ Has someone already written something like this? Klaus Brunnstein 's document AMIGAVIR.A89 is said to contain the classifications of 24 viruses including these:- 12) NORTH STAR I Antivirus-Virus (NORTH STAR Virus Strain) =U= 13) NORTH STAR II Antivirus-Virus (NORTH STAR Virus Strain) =U= 19) System Z 3.0 Antivirus-Virus (System Z Virus Strain) =U= 20) System Z 4.0 Antivirus-Virus (System Z Virus Strain) =U= 21) System Z 5.0 Antivirus-Virus (System Z Virus Strain) =+= What are they? What do they do? {A.Appleyard} (email: APPLEYARD@UK.AC.UMIST), Thu, 05 Apr 90 11:06:44 BST ------------------------------ End of VIRUS-L Digest ********************* Downloaded From P-80 International Information Systems 304-744-2253