V.I.R.U.S. Weekly - December 17, 1993 V.I.R.U.S. Weekly - December 17, 1993 A weekly digest of virus and related news, V.I.R.U.S. Weekly BBS feed and newsletter is prepared by the Vancouver Institute for Research into User Security. For those without online service feeds, both V.I.R.U.S. Weekly and Monthly are available in hardcopy. For more information contact Robert Slade or CyberStore. copyright 1993, Robert M. Slade Other columns this week: Table of Contents: 20 2.1 Assume you're wrong 21 InocuLAN by Cheynne NEW ANTIVIRALS EMD in beta (MS-DOS) EMD Enterprises of Baltimore, MD have posted a message on GEnie asking for beta testers of a new product said to be a combination of a scanner and a hardware restricting device. Integrity Master 2.11a (MS-DOS) Integrity Master has been upgraded with the addition of 300 new programs in the scanner portion. It now displays a one line summary of each virus detected along with the full one or two page detailed description. The full description can optionally be disabled for those scanning heavily infected systems. Thunderbyte Utilites 6.09 (MS-DOS) TBAV609 is now making the rounds. This version has an associated Windows version. Like the "processor optimized" files, the Windows program is distributed in a separate archive. TPE 1.4 tests (MS-DOS) From the Netherlands comes a report of some tests of various popular scanners against viri augmented with the Trident Polymorphic Engine. A somewhat surprising winner is Eugene Kaspersky's new AVP, the only program to detect the whole one thousand variants used in the test. Thunderbyte came in second at about 75%. (Please note that the only "real" test of polymorphic detection is against all possible variants, in this case much higher than the 1000 files used.) Polymorphic tests (MS-DOS) The same Dutch group has released another test of viral programs using MtE, Commander Bomber and various TPE versions. Again AVP came in first, missing only 9 of some six thousand assorted files. With advanced scanning on it did not miss any. SCAN showed unexpected overall strength given its weakness against some MtE infections. SCAN 109 check (MS-DOS) For those concerned about the possible infection in some distributions of SCAN 109 (see also "1984" this issue), the following PKZIP data is presented for the valid file: Length Method Size Date Time CRC-32 Attr Name 155729 Stored 155729 08-11-93 06:55 bc31ecdd --w- SCAN.EXE The infected archive is also said to have had the AV codes stripped off. Crisscan (MS-DOS) Michael Paris of CRIS, who has been reporting most of the new viri seen here in recent weeks, has announced the initial development of a new scanner. His posting is not completely clear, but it seems to promise a heuristic mode which would automatically add new and undetected signatures, based upon a sufficiently large number of infections, as well as change detection functions. NEW VIRAL PROGRAMS BENOIT (MS-DOS) Apparently this memory resident virus infects only EXE files, but a dropper COM file may also be found. Written by the ARCV group in England, it can be detected by F-Prot as a variant of ARCV. May also be known as Mandelbrot. A signature is 5E81EE06008D841F00508DBC1F00. Whale/McAfee (MS-DOS) This EXE infector is not related to Whale, nor to McAfee. The name comes from a misspelled message which displays when an infected file is run. There is no stealth or ploymorphism and the virus adds 1125 bytes to infected files. A reported signature is BB2A02BE18002E81?346464B. Chromosome Glitch 3.0 (MS-DOS) A memory resident COM infector which adds 385 bytes to infected files. A reported signature is 5D81ED03011E06B8EFDDCD2181FB. Blood Rage (MS-DOS) Reportedly a direct action COM infector, this is detectable by the heuristics is both F-Prot and Thunderbyte. The following text string is found in the code: "THE WORLD WiLL NEVER FORGETT US! -Beta Boys- Blood Rage (c)1992 The BetaBoys". Demo-Exe (MS-DOS) A direct action EXE infector that adds 334 bytes to files. Three files will be infected when an infected file is run. The text "Demo-Exe Virus Admiral Bailey [YAM]" is reported to be in the virus code, and a signature is said to be 5D81ED03011E060E0E1F078DB653. Handy (MS-DOS) According to a very sketchy report, this may be a COM infector with a bug that will cause it to try and attach to other file types with problematic results. A signatureis reported as 8CC00500108EC0BE0001BF0000B9. Iron Maiden (MS-DOS) A COM and EXE infector that adds 636 bytes to two files in the current directory and then attempts to infect two files in the root directory of the C: drive. On a system without a hard drive this will lock the machine. A reported signature is 8CC6060B01C3EBF8B8D9C8D9BADF. Binary Fission v1.0 (MS-DOS) A memory resident COM and EXE infector which increases file size by 517 bytes. A reported signature is BD?2B83D3DCD21353E3DBB4D5A. Phasor (MS-DOS) This virus is said to become memory resident at offset 1E0h in the interrupt table. It will add 230 bytes to COM files. A reported signature is BD?233FF8EC7BFE00126803DBD. 1984 recidivus (MS-DOS) I may have been had, but it pays to err on the side of caution. There have been requests for further info about the reported 1984 virus. One report lists it as multipartite and with an infective length of 1979 bytes on files. A signature suitable for F-Prot is reported as "33 C0 8E D8 BE ?? ?? FF 34 FF 74 02 C7 04". However, the virus is also, according to one report, capable of infecting the system even if only read. (For the uninitiated, this is a good sign of a fake.) The reports, though, are coming from sources that have been reliable in the past and Thunderbyte 6.09 now detects a "Nuke1984". Firefly (MS-DOS) A COM infector with an extremely complicated payload and infection process. The infective length is 1106 bytes and the virus is encrypted with a variable XOR function. After having been active in memory for some time the virus will toggle keyboard indicator LEDs and the keyboard SHIFT function. A reported signature is "BB ?? ?? B9 10 01 81 37 ?? ?? 81 77 02 ?? ?? 83 C3 04 E2 F2". Addams Family group (MS-DOS) A set of direct action COM infectors, eight in all. While the programs infect only on execution, they also go resident in memory and may be a failed experiment replcated eight times. The six "men" in the family are reported to be detected by "BB 12 01 FF 27 2A 2E 43 4F 4D 00 2D 3D 41", the two "women" are Wendy "BB 12 01 FF 27 2A 2E 43 4F 4D 00 4D 63 41" and Morticia "BB 12 01 FF 27 2A 2E 43 4F 4D 00 2D 3D 90". ============= Vancouver ROBERTS@decus.ca | Life is Institute for Robert_Slade@sfu.ca | unpredictable: Research into rslade@cue.bc.ca | eat dessert User p1@CyberStore.ca | first. Security Canada V7K 2G6 |