Return-Path: XPUM04@prime-a.central-services.umist.ac.uk Received: from G.SEI.CMU.EDU by ubu.cert.sei.cmu.edu (5.61/2.3) id AA13729; Fri, 1 Jun 90 11:15:35 -0400 Received: from SEI.CMU.EDU by g.sei.cmu.edu (5.61/2.5) id AA20330; Fri, 1 Jun 90 11:15:32 -0400 Received: from nsfnet-relay.ac.uk by sei.cmu.edu (5.61/2.3) id AA29527; Fri, 1 Jun 90 11:15:11 -0400 Received: from sun.nsfnet-relay.ac.uk by vax.NSFnet-Relay.AC.UK via Janet with NIFTP id aa22838; 1 Jun 90 15:54 BST From: Anthony Appleyard To: KRVW <@NSFnet-Relay.AC.UK:KRVW@sei.cmu.edu> Date: Fri, 01 Jun 90 16:04:56 BST Message-Id: <$TGTWCZCFFBQC at UMPA> Subject: Virus-L vol 0 issue #0426 Virus-L Digest Tue, 26 Apr 88 Volume 0 : Issue #0426 Today's Topics Nettiquite Re: Nettiquite Gimme Cookie Nettiquette ** no subject, date = Tue, 26 Apr 88 02:38:17 EDT Speaking Virus types Fuddy-duddies unite RE: Fuddy-duddies unite RE: Speaking Re: Nettiquite Macintosh viruses RE: Speaking RE: Speaking ** no subject, date = Tue, 26 Apr 88 21:29:34 EDT Re: Nettiquite -------------------- Date: Tue, 26 Apr 88 01:02:36 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: -=*REB*=- Subject: Nettiquite > -rg- > > PS anyone want to hire me? FLAME ON! Do you *really* think that this is appropriate here? I thought this was a list for virus DISCUSSION. Not an employment agency. Let's face it, it's not terribly difficult to write a virus. Unfortunately, your pastime is not unique. But let's not discuss THIS forever. I think we can safely let the employment subject die off... FLAME OFF! Richard Baum [Boy, this list's first real flame :-) :-) :-) ] _______________________________________________________________ / From: -=*REB*=- ", /FoneNet: (0010 0001 0101) 1000 0110 0111-1000 0100 0011 0011 BCD ", /InterNet: kREBaum@Vax1.CC.Lehigh.EDU BitNet: RB00@Lehigh.Bitnet ", / SlowNet: 508 E 4th St. (positively) Suite #1, Bethlehem, PA 18015 ", !----------------------------------------------------------------------! ! The Brent Z*ne! ! "----------------------------------------------------------------------" -------------------- Date: Tue, 26 Apr 88 01:13:00 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Roger Gonzalez Subject: Re: Nettiquite In-Reply-To: Your message of Tue 26 Apr 88 01:02:36 EDT Perhaps I should have said *Wistful tone of voice* Anyone want to hire me? It was a joke... I really don't think that one bloody line was worth a flame. Please humbly excuse me for imposing on your excellencies. I know that some people find viruses simple, but obviously some people don't, or this list wouldn't have been created. If you find them so simple, why don't you just get rid of them all yourself? I've never had any problems. Once again, try to find it deep within your superior skull to forgive me for my incredibly offensive postscript. -------------------- Date: Tue, 26 Apr 88 01:37:33 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: msmith@topaz.rutgers.edu Subject: Gimme Cookie In-Reply-To: <8804260529.AA29569@topaz.rutgers.edu> (USERABFY@clvm.bitnet) This is the famous "Gimme Cookie" story as I heard it about 6 years ago. At the Los Alamos Labs, there was a computer. Someone decided to play a pratical joke, or a hacker placed it there. One day, Appearing on all users consoles: GIMME COOKIE typing anything but "Cookie" did nothing but get the prompt back. When you typed "COOKIE", everything ran fine again. Then, it went dormant for a while. Later: GIMME COOKIE GIMME COOKIE To which you had to answer "COOKIE COOKIE" or it would stay there. Then, a shorter time later: GIMME COOKIE GIMME COOKIE GIMME COOKIE This continued until the number of Cookies was large and the time between prompts very short. As I heard, they had to kill the ROM to get rid of this thing, it was so strong. Mark - -- Mark Smith (alias Smitty) "Be careful when looking into the distance, RPO 1604, CN 5063 that you do not miss what is right under your nose." New Brunswick, NJ 08903 {backbone}!rutgers!topaz.rutgers.edu!msmith msmith@topaz.rutgers.edu -------------------- Date: Tue, 26 Apr 88 01:40:57 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: -=*REB*=- Subject: Nettiquette Okay, *whistful tone of voice* :-) Sorry to flame, but other lists have in the past degenerated into employment agencies... I wanted to avoid this. (Anyone remember when the VAX list turned into a "do we digest or not" discussion for a month or so? - don't answer that!) REB _______________________________________________________________ / From: -=*REB*=- ", /FoneNet: (0010 0001 0101) 1000 0110 0111-1000 0100 0011 0011 BCD ", /InterNet: kREBaum@Vax1.CC.Lehigh.EDU BitNet: RB00@Lehigh.Bitnet ", / SlowNet: 508 E 4th St. (positively) Suite #1, Bethlehem, PA 18015 ", !----------------------------------------------------------------------! ! The Brent Z*ne! ! "----------------------------------------------------------------------" -------------------- Date: Tue, 26 Apr 88 02:38:17 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Loren K Keim -- Lehigh University Richard (excuse me, REB), No, the problem with other lists generally has not been that they become places for people to place job offers. Some people have, and that is very helpful to the individual looking for the job. Rather what has ruined many lists is that they become taught with people complaining about small parts of other people's letters not belonging in the list. Instead of your last two letters (one I believe cut up Arnold Gill for thinking that two programs were public domain, and the second to complain about a le sentence in a very interesting letter from Roger Gonzalez), you might try to add something useful to this list if you are capable of such thought. I found Roger's comments to be very interesting. Realize that several "PacMan" viruses have been found floating around, as well as one I recall that sent random characters to the screen at certain intervals. Incidently, the LaSalle talk will be given on the 28th. I will upload information when I can locate it. I will be there, although I won't be speaking. Loren .----------------------------------------------------------------------------. | Loren K Keim | |----------------------------------------------------------------------------| | Lehigh Valley Innovative Technologies: Software / Hardware (215) 865-4253 | 4253 | | Century 21 Loren Keim: Com / Ind / Res (215) 395-0393 | 0393 | | Keim Enterprises: Consulting / Programming (215) 865- 3904 | 3904 | | Lehigh University: Consulting / Programming | |----------------------------------------------------------------------------| | The Virus Busters: Loren Keim, Chris Bracy, Joe Sieczkowski, Mitch Ludwig | |____________________________________________________________________________| -------------------- Date: Tue, 26 Apr 88 02:53:55 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Loren K Keim -- Lehigh University Subject: Speaking Well Folks, I am quite surprized at the number of personal letters I received over this list over the last day. Comments should probably be sent to the list directly, instead of sending them just to me. Because such a large number of users asked me if we do speeches, I will reply to that question here on the list. I, along with Chris Bracy and Joe Sieczkowski, have been to a few conventions in the last couple weeks to speak about, or help discuss viruses in general, ways of avoiding them, their implications, and so on. If you are interested in having us speak, yes it is possible, please send me your name, your groups name, a phone number I can call and where you are located, and we'll see what we can do. I'm glad to see such overwhelming responses over this list, because viruses are such a serious problem at this point in time. Again, general comments should probably go to the list, and not just to me, although I would refrain from sending in depth information about any particular virus to this list because it tends to help people think up new ways of writing viruses. Loren .-----------------------------------------------------------------------. | Loren K Keim | |-----------------------------------------------------------------------| | Lehigh Valley Innovative Technologies: Software / Hardware | | (215) 865-4253 | | Century 21 Loren Keim: Com / Ind / Res (215) 395-0393 | | Keim Enterprises: Consulting / Programming (215) 865-3904 | | Lehigh University: Consulting / Programming | |-----------------------------------------------------------------------| | Virus Busters: Loren Keim, Chris Bracy, Joe Sieczkowski, Mitch Ludwig | |_______________________________________________________________________| -------------------- Date: Tue, 26 Apr 88 02:42:00 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Roger Gonzalez Subject: Virus types In-Reply-To: Your message of Tue 26 Apr 88 01:37:33 EDT Does the now infamous XMAS EXEC that munched up all the IBMs on Bitnet really qualify as a virus? Technically, it DID reproduce, but it seems almost more Trojan Horsey. Frankly, I'm a bit scared about the future of viruses... Imagine 5 years from now, when we all have incredibly fast 586 machines with 256 parallel processing CPUs! Have fun tracking the little bugger down then! I agree with you... I think its pretty safe to say that nothing will ever be a cure-all for viruses. I may be growing out of my destructive tendencies, but I can certainly understand how much fun it can be to thwart trends toward complete user-friendliness. Its the same thing with software piracy.. it's FUN to crack copy protection schemes. I just heard of a nasty virus starting to circulate on IBM pcs. Its on BATTLEZNE and I'm told that it randomly causes warm boots to occur until you shut the silly thing off. Fortunately for "serious" users, a virus on a game shouldn't be too threatening. If anyone really wants the details, I'll track 'em down, but I wouldn't worry about it. Pax etc, Roger -------------------- Date: Tue, 26 Apr 88 09:26:00 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: MITCH MITCHELL ROSEN Subject: Fuddy-duddies unite > From: -=*REB*=- > Subj: Nettiquite >> PS anyone want to hire me? > FLAME ON! > Do you *really* think that this is appropriate here? That flame was the most inappropriate gripe I've come across for a while. The writer's tongue was clearly in cheek when asking about employment. Chill out a bit. Its not healthy to take everything so seriously. - Mitchell Rosen > [Boy, this list's first real flame :-) :-) :-) ] I guess I'm number two. -------------------- Date: Tue, 26 Apr 88 13:38:00 EST Reply-To: Virus Discussion List Sender: Virus Discussion List From: Mitchel Ludwig Subject: RE: Fuddy-duddies unite >From: MITCH MITCHELL ROSEN > >> From: -=*REB*=- >> Subj: Nettiquite > >>> PS anyone want to hire me? > >> FLAME ON! >> Do you *really* think that this is appropriate here? > >That flame was the most inappropriate gripe I've come across for >a while. The writer's tongue was clearly in cheek when asking about >employment. > >Chill out a bit. Its not healthy to take everything so seriously. > >- Mitchell Rosen > >> [Boy, this list's first real flame :-) :-) :-) ] > >I guess I'm number two. > Guys, please?!?!? This is getting a little crazy. Both REB and whoever the writer was were both a) A little overzealous and b) Joking. Let's let it lie. Mitch Tag... You're it ____________ ____/--\____ //-n-\\ \______ ___) ( _ ____) _____---=======---_____ __\ \____/ / `--' ====____\ /.. ..\ /____==== ) `|=(- - - - - - - - - - -*// ---\__O__/--- \\ \------------' \_\ /_/ BITnet : MFL1@lehigh.bitnet Phonet : 215-758-1381 INTnet : KMFLUDW@vax1.cc.lehigh.edu Slonet : Box 72 Lehigh Univ. Bethlehem, PA 18015 -------------------- Date: Tue, 26 Apr 88 13:51:00 EST Reply-To: Virus Discussion List Sender: Virus Discussion List From: Mitchel Ludwig Subject: RE: Speaking >From: Loren K Keim -- Lehigh University Well Folks, > >I am quite surprized at the number of personal letters I received >over this list over the last day. Comments should probably >be sent to the list directly, instead of sending them just to >me. > [Erronious kaka eliminated] > >Loren > >|-----------------------------------------------------------------------| >| Virus Busters: Loren Keim, Chris Bracy, Joe Sieczkowski, Mitch Ludwig | >|_______________________________________________________________________| Loren, As one of the 'Virus Busters' I am beginning to get a bit annoyed at the constant back patting you seem to be giving yourself. None of the rest of us involved in the Lehigh virus affair have gone out of our way to let the world know how great we are. Yes, I agree with you that the public needs to know exactly what they are dealing with in respect to virus's in general, but I do not agree with your methods. Richard Baum may have been wrong in his flame earlier when he complained about job hunting here, but he was wrong because the request should have been taken as a joke. You, on the other hand are using the net as a way, not to educate the public concerning virus's, but rather to educate them concerning the fact that *YOU* know all about virus's. Now, enough of this, if you wish to let the world know how much you know about computer virus's, do it in one long letter that we can all ignore. Then get down to the business of what the list is about, helping others. Now, for everyone : I am looking for information (for a second party not on the network) concerning virus's (is this right or is it viruses?) that cause problems on the mac. He is concerned because his workplace uses primarily mac's for publishing needs. Any help? Mitch (I may have helped solve a virus but that's no reason to brag) Ludwig Tag... You're it ____________ ____/--\____ //-n-\\ \______ ___) ( _ ____) _____---=======---_____ __\ \____/ / `--' ====____\ /.. ..\ /____==== ) `|=(- - - - - - - - - - -*// ---\__O__/--- \\ \------------' \_\ /_/ BITnet : MFL1@lehigh.bitnet Phonet : 215-758-1381 INTnet : KMFLUDW@vax1.cc.lehigh.edu Slonet : Box 72 Lehigh Univ. Bethlehem, PA 18015 -------------------- Date: Tue, 26 Apr 88 14:30:00 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Joe Ogulin -- 'Milamber' Subject: Re: Nettiquite In-Reply-To: Your message of Tue 26 Apr 88 01:02:36 EDT come on, rich...anyone can tell it's a joke... --Joe -------------------- Date: Tue, 26 Apr 88 15:14:07 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: David.Slonosky@QueensU.CA Subject: Macintosh viruses I would also be interested in Macintosh virus information as our lab uses a fat Mac. Does anyone remember the article in the Computing Recreation section of Scientific American about two or three years back where he talked about worms and battling programs, one pro-computer and one anti-computer? It's sort of tangent to this discussion, but reading these comments made me think of it and I'd like to read it again soon. -------------------- Date: Tue, 26 Apr 88 16:15:00 EST Reply-To: Virus Discussion List Sender: Virus Discussion List From: UJWSIEC@VAX1.CC.LEHIGH.EDU Subject: RE: Speaking >>From: Loren K Keim -- Lehigh University >>Well Folks, >> >>I am quite surprized at the number of personal letters I received >>over this list over the last day. Comments should probably >>be sent to the list directly, instead of sending them just to >>me. >> >>Loren >> > >From: Mitchel Ludwig > >Loren, > > As one of the 'Virus Busters' I am beginning to get a bit >annoyed at the constant back patting you seem to be giving yourself. >None of the rest of us involved in the Lehigh virus affair have gone >out of our way to let the world know how great we are. > > Yes, I agree with you that the public needs to know exactly >what they are dealing with in respect to virus's in general, but I do >not agree with your methods. You are using the net as a way, >not to educate the public concerning virus's, but rather to >educate them concerning the fact that *YOU* know all about virus's. > >Mitch FFFFFFFF LL AAAA MM MM EEEEEEE OOOOO NNN N FF LL AA AA MMM MMM EE OO OO NNNN N FFFFF LL AA AA M MM MM M EEEE OO OO NN NN N FF LL AAAAAAAA M MM M EE OO OO NN NN N FF LL AA AA M M EE OO OO NN NNN FF LLLLLL AA AA M M EEEEEEE OOOOO NN NN Enough is Enough! This pointless bickering is getting out of hand. Mitch, if you have a gripe with Loren send mail to him directly. There is no point making it nationwide. Moreover, Loren's letter was perfectly pertinent. Yesterday he received numerous letters that were very appropriate for the list. So he stated the fact. I don't think he was practicing conceit. *Flame off* Athough I feel its inappropriate to bring such quarrels to the list, I felt this particular letter was neccessary to clear the air of any misconceptions. I'm sorry for those of you that had to wade though it. Now let's talk about viruses.... - ---------------------------------------------------------------------------- ujwsiec@vax1.cc.lehigh.edu Joe Sieczkowski {ihnp4}!c11ux!lehi3b15!joes AI Lab, CSEE Department jws5@lehigh.bitnet Lehigh University Packard Lab #19 Bethlehem, PA 18015 -------------------------------------------------------------------- "Yes...It was a dark and stormy night that a party of three and myself found, tracked, and destroyed the Lehigh Virus." --------------------------------------------------------- -------------------- Date: Tue, 26 Apr 88 16:40:30 ECT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Art Weisenseel Subject: RE: Speaking In-Reply-To: Message of Tue, 26 Apr 88 13:51:00 EST from Actually this is not in reference to Speaking, but to Mac viruses. Anyhow, in this week's Infoworld (the April 25 issue) on page 8 there is an article on a Mac virus which looks for the programming signatures "ERIC" and "VULT" in Electronic Data Systems' proprietary programs. According to the article the virus is unruly enough to cause printing and system problems and occasionally destroy data, although its real purpose is to destroy Mac applications which have those two signatures. The article says the Killscores program available on Compuserve Macintosh b-boards and elsewhere will knock it off infected disks. Hope I got it right; I'm not an Mac user. Art Weisenseel Computer Services State University of NY - College at Purchase PR0032@BINGVMB.BITNET "Twenty Seconds Ahead of the Past" -------------------- Date: Tue, 26 Apr 88 21:29:34 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Loren K Keim -- Lehigh University Emergency: In case of emergency, contact me at 865-4253 or 865-3904. A few things: I have had quite a bit of difficulty finding information about the new slew of Mac Viruses that have arrived. Here is some of what I HAVE been able to locate: The NASA virus: NASA has kept very quiet about how this virus works, and replicates. From what I've been able to decipher (someone correct me if they have more knowledge), it doesn't actually damage the system in any way, but slows down programs and increases their length, makes it very hard to print things, crashes the system, as well as typing some sort of obnoxious message. Apparently the virus has no effect on data files, but it injects itself into every program file and makes itself very hard to eliminate. I believe that the virus probably appends itself to the end of the program file. It "goes off" every 2, 4 and 7 days after infected. Another Christmas Tree Virus: A Mac version that simply copies itself to any existant hard drive and any disks in any drives attached to the system. It does no actual damage, and appears in the directory as a program file. The way to know if you have this virus is if you have a file XMAS in your directory. Unnamed virus: According to the April 11 issue of Infoworld, a virus exists that "transmits itself from Mac to Mac by invading a standard executable application file". This virus destroys files. "The easiest way to spot this virus is by looking at the icons tht represent the Note Pad File and Scrapbook File in the Macintosh System Folder". "These icons normally resemble small Macintoshes, but when infected, the icons become a rectangle with a bent corner. More as I get it. I believe the NASA virus and the Unnamed one (found in Washington and Boston so far) will be taken care of by the new anti viral program for the Mac that we'll (LVIT'll) be releasing in the next few weeks. Also, if you missed Art W.'s letter, go back and read it! Also, I must apologize. Mitch tells the world that: >> As one of the 'Virus Busters' I am beginning to get a bit >> annoyed at the constant back patting you seem to be giving yourself. >> None of the rest of us involved in the Lehigh virus affair have gone >> out of our way to let the world know how great we are. If I have upset anyone, I am quite sorry. I was not trying to pat myself on the back. And Mitch, we argue constantly; lets try to keep it off the listservs. Incidently, the trailer that I put on my message is a direct copy of the trailer Chris Bracy's been using for a while. Gotta Run, Loren -------------------- Date: Tue, 26 Apr 88 14:52:20 EST Reply-To: Virus Discussion List Sender: Virus Discussion List From: Lou Surface Subject: Re: Nettiquite In-Reply-To: Message of Tue, 26 Apr 88 14:30:00 EDT from Can we please get back to the discussion at hand? This should be the last message of its kind please.