V.I.R.U.S. Monthly - September, 1993
 
A monthly digest of virus and related news, V.I.R.U.S. Monthly is prepared by
the Vancouver Institute for Research into User Security from the V.I.R.U.S.
Weekly BBS feed and newsletter.  For those without online service feeds, both
V.I.R.U.S. Weekly and Monthly are available in hardcopy.  For more information
contact Robert Slade or CyberStore.
copyright 1993, Robert M. Slade
 
 
NEW ANTIVIRALS
 
F-Prot 2.09D (MS-DOS)
An update release D of version 2.09 of F-Prot has been fairly generally
distributed.  Version 2.10 should be out within a week or two.
 
Integrity Master 2.01 (MS-DOS)
IM-201 has been seen on a number of boards, including the VirNet file
distribution system.  No word yet from Wolfgang as to the features, but he had
promised some major changes in the 2.xx level.
 
TBFence and TBAV 6.05 (MS-DOS)
Very close together, Thunderbyte has released version 6.05 of the utilities
package, and a new program called TBFence.  TBFence provides "group
encryption", which allows a group of computers to use a set of disks, while not
being able to read disks from outside the group.  Disks passed outside the
group are likewise unreadable by other computers.  There is no word as to
whether TBFence is included in TBAV 6.05: indications are that it isn't.
 
DISKSECURE II (MS-DOS)
Padgett Peterson has finally released version two of his excellent DISKSECURE
boot protection program, the first general release since 1990.  DISKSECURE
provides protection and detection of boot sector infectors.  In most cases
recovery is automatic, but the program also provides for manual recovery of the
disk which can help iwht non-viral problems as well.  In addition to a general
strengthening of the program, it can now protect Novell servers.
 
VSUM 308 (MS-DOS)
The latest version of the Hoffman Summary List is making the rounds of the
nets.
 
VID 2.20 (MS-DOS)
The Cairo Labs people have announced another version of the Virus Information
Door.  Seems they must be serious about it, but until they get some better
distribution Patty still hasn't got much competition here.
 
F-Prot 2.10 delay (MS-DOS)
F-Prot version 2.10 was to have been out by now, but frisk just sent word that
he is off to the Virus Bulletin conference an then on to (a well deserved)
vacation.  Possibly the release of 2.09D has delayed things.
 
DISKSECURE bug fix (MS-DOS)
Padgett blames lack of sleep and an oddity in some original IBM ATs for a minor
bug in DISKSECURE which has necessitated a DS231B release.
 
SCAN suite 108 (MS-DOS/OS/2)
Version 108 of the McAfee Associates programs are doing the rounds.  These
replace the somewhat bug laden 107 version which was released before final
testing a few weeks ago.  Code, release, test -- code, release,test ...
 
VSHIELD 108 (MS-DOS)
Some new features have been added to McAfee's VSHIELD resident scanning
program.  The abortive 107 version had added new EMS and Windows compatibility
features, and the 108 version has added new switches that enable (and also
disable) checking of the boot sectors when new floppy disks are accessed.
 
SuperVisor forthcoming (Amiga)
Safe Hex International is promoting what they say is a new type of antiviral
for the Amiga.  (At one point the announcement mistakenly calls it a "BBS
killer"  :-)  They are broadcasting announcements in the Fidonet virus echoes
asking for virus samples in order to expand its scope.  Careful, guys.  That's
against the rules ...
 
BFF 2.17 (MS-DOS/Fido)
Bad File Finder is an oddball but intriguing little piece of work.  Apparently
using material from Lee Jackson's "Hack Report", it will scan your drive for
"hacks".  Presumably these are the hacked, trojaned, infected, pirate and
invalid files that the Hack Report lists.  It also provides for "calling"
F-Prot, SCAN and Thunderbyte Scan to check for viri.  BFF can be run on a BBS,
and the results can be automatically sent by netmail.
 
Norton Antivirus 3.0 (MS-DOS)
Another release from the Symantec/Norton people.  This appears to be the first
time it incorporates the technology they bought along with Certus.  Almost a
year later.  Hmmm.
 
Thunderbyte 6.07 (MS-DOS)
What happened to 6.06?  Oh well.  The new version of TBScan corrects a
"feature" which did *not* always scan all files when "all files" were
specified.  It also now scans the master boot record of a second physical hard
drive because of the prevalence of portable drives.  The weakness that allowed
TBClean to activate certain viral programs has been fixed.  Thunderbyte is now
using PGP technology for security of distribution.
 
Don't use SCAN2000 (MS-DOS)
There is a report of a supposed McAfee version called SCAN2000 doing the
rounds.  There has been no word yet form McAfee Associates about any change in
numbering, and it's a good bet that this is a trojan.
 
NEW VIRAL PROGRAMS
 
SPLIT in BREAKARJ.LZH (MS-DOS)
A file called BREAKARJ is doing the rounds in Germany, purporting to be able to
split up large ARJ compressed files into smaller pieces.  The file contains the
Split virus, a 250 byte COM infector.  A signature scan string is 9CFC 8DB6
DF01 BF00 01B9 0200.
 
YB-1 (MS-DOS)
A 426 byte direct action COM infector has been found.  It infects COM files up
to 29696 bytes long.  The text strings "! YB-1 &  Handsome Dick Manitoba / K
hntark", "*.COM" and "????????COM?" are found unecrypted in infected files.
 
Predator (MS-DOS)
Bill Lambdin reports several variants of the Predator virus, which he is
calling a "partially stealth" COM infector.  Signature strings are:
B4 42 33 C9 99 E8 5F 00 C3 2E 8F 06 A2 04 07 1F
B8 00 43 50 E8 5C 01 58 72 CC 2E 88 0E 7E 04 F6
B8 00 57 E8 2A 01 80 FE C8 73 77 80 C6 C8 89 16
B4 40 BA 16 04 B9 03 00 E8 AE 00 2E F6 06 2B 04
Bill reports some evidence that one variant may have multipartite properties.
 
Miscellaneous (MS-DOS)
Bill also gives some brief reports on:
Pinky Ghost, non resident companion infector
B4 2A CD 21 80 FA 02 75 0B 3C 04 75 07 B4 09 BA
Smile, claims multipartite properties
B4 2A E8 84 00 80 C6 03 80 FE 0C 76 04 41 80 EE
Varicell, stealth file infector
B8 00 43 E8 3B 03 73 03 E9 45 01 2E 88 0E A6 06
 
CRUNCH21.COM (MS-DOS)
Following on the heels of the KOH virus (reported here two weeks ago), is the
CRUNCH21 program, which has been distributed through the Fidonet virus related
echoes.  The person posting it seemed to indicate that this was a "version two"
after an original release at some previous time.  The program *appears* to be a
virus which will compress and decompress executables on the fly. When an
infected program is invoked, it queries the reader as to whether or not it
should "go resident".
 
Moose (MS-DOS)
Reported from Sweden, there are a number of variants of this virus, all bearing
the text "Moose" in the infective code.  The virus appears to be a simple
direct action infector, which will attach to uninfected files in the current
directory or, if none exist, recursively search the parent directory up to the
root.  Moose is destructive, in that it randomly changes code in program files. 
Both COM and EXE files are affected, and sometimes SYS files are converted to
COM format with the text "This, and much more, from the Moose crashing corp" in
the code.  Some files also contain could which appears to be part of CPAV.EXE.
 
SATANBUG (MS-DOS)
Although the Satanbug virus has been known for a while, the Computer Incident
Advisory Capability (CIAC) of the US federal government has apparently been
alarmed by recent reports of it.  This virus is memory resident and
polymorphic, and attacks COM, EXE, SYS and OVL files.  LAN drivers have
reportedly been damaged by the infection: likely this is due to a programming
error in the handling of the files.  Infected files grow in length from three
to five kilobytes and the file creation date is increased by one hundred years.
 
Varicella-II (MS-DOS)
Normally I wouldn't report a virus reported by a virus writing group.  This
one, however, has an interesting interaction with the Thunderbyte Utilities. 
Because of the way that Thunderbyte attempts to execute a suspect virus under
"control", checking a file infected with Varicella-II will activate the virus,
and alow it to spread on the system.
 
Bluebox (Amiga)
A somewhat incoherent report has been received of an Amiga "virus" identified
only by the archive it was originally found in: BLUEBOX.LZH.  This program
"infects" the icon.library file on Amigas.  According to the report, it watches
the serial port for a chance to transmit itself (possibly with another file?)
 
1463 (MS-DOS)
A report from France of a virus which adds 1463 bytes to COM and EXE files. 
(That last is somewhat suspect; infections of EXE files tend to vary in
length.)  No word on effects, but an initial search string is "81 F9 21 4D 75
03 E9 DC 04".
 
Cruncher recidivus (MS-DOS)
The Cruncher virus (cf CRUNCH21.COM) reported here last week has undergone some
further testing.  The researcher states that the compression works very well
... but the compressed files no longer execute.  The infective code of the
virus is a nearly unaltered copy of the Coffeeshop virus, and even current
versions of F-Prot will identify it that way.
 
CONFERENCES AND COURSES
 
ISSS '93 - No seminar
Well, I still might see you at ISSS '93, but my seminar has been pulled due to
low registration.  An unfortunately common occurrence these days: at least two
"training" companies have pulled virus seminars from their offerings ...
 
CSI's 20th
The Computer Security Institute's computer security conference will be held
November 8-10th in Anaheim, California.  Of four virus sessions, only one is by
a known reputable researcher.  However, a full day seminar by Tom Duff should
be of interest to all.  Ray Kaplan and Padgett Peterson will be giving sessions
and Bill Murray is conference chair so it should be good overall.  Contact CSI
in San Francisco.
 
RESEARCH
 
CPAV and boot sectors (MS-DOS)
Central Point has admitted a bug in its detection of boot sector infectors.  In
a situation where there are two physical hard disks on the system, one of the
disks may become infected while not normally posing a threat for further
infection.  CPAV uses two different means of examining boot sectors, and the
detection and disinfection programs are not the same.  Therefore, CPAV may
alert you to the presence of a common virus but be "unable" to clean it.  No
word is available on whether this affects MSAV as well. Details are available
from the Central Point Faxback system.
 
NetWare LOGIN insecurity (MS-DOS/NetWare)
A problem has been found with NetWare 4, supposedly the "secure" version of
NetWare.  It involves the LOGIN.EXE file.  As usual with proprietary systems,
no other details are being released.  A fix, in the form of a SETLOG.EXE
program, are available from Novell and first.org.
 
Parent killing bug?  (MS-DOS 6.0)
There is an as yet unconfirmed report of a bug in MS-DOS 6.0 which may cause it
to delete files in the parent directory when deleting all files (with the "*.*"
wildcard) in a subdirectory.  According to the report, Microsoft is denying the
bug exists ... but has a "fix".
 
REBOOT.COM triggers NAV
A great many systems people keep handy a five byte program which will reboot
MS-DOS computers.  This is often used in batch files to change a set of TSR
configurations by simply copying in a new CONFIG.SYS and then automatically
rebooting.  Apparently, though, the Norton product uses this scan string as a
check for suspect viral programs.  It also doesn't appear to perform any
"sanity checking", such as for program size ... 
 
GOSSIP
 
Large use of bandwidth department
Michael Paris is an avowed "Pro-Virus" person.  Still, he had agreed to abide
by the rules of the Fidonet VIRUS_INFO echo/discussion area, and has stuck to
that over the past six weeks.  His contributions, while not exactly
overwhelming insights, have been moderate and on topic for the most part. 
However, he seems to be single handedly responsible for the fact that
VIRUS_INFO carrying twice the traffic of VIRUS.  "Open channel D" (for
"Dialogue" ...)
 
M'aidez!
The life of a Fidonet moderator is not an easy one.  Just ask Paul Ferguson,
moderator of the VIRUS_INFO echo.  Subject to verbal abuse via both public and
private messages, he manfully (can I say that without being sexist?) strives to
keep peace, order and good information flowing on the echo.  A while back,
because of a new job, it looked as if he would have to give up the job.  He
managed to keep it, but with another new job, he is looking for someone to help
carry the load.  Support your local (or remote) moderator ...
 
==============                      
Vancouver      ROBERTS@decus.ca    | "Do you get guns with your 
Institute for  Robert_Slade@sfu.ca |  gun magazines?  No.
Research into  rslade@cue.bc.ca    |  Do you get viruses with your 
User           p1@CyberStore.ca    |  virus magazines?  Yes."
Security       Canada V7K 2G6      |               - Kevin Marcus