Return-Path: XPUM04@prime-a.central-services.umist.ac.uk Received: from G.SEI.CMU.EDU by ubu.cert.sei.cmu.edu (5.61/2.3) id AA18161; Tue, 5 Jun 90 14:12:17 -0400 Received: from SEI.CMU.EDU by g.sei.cmu.edu (5.61/2.5) id AA18774; Tue, 5 Jun 90 14:12:14 -0400 Received: from nsfnet-relay.ac.uk by sei.cmu.edu (5.61/2.3) id AA19750; Tue, 5 Jun 90 14:12:01 -0400 Received: from sun.nsfnet-relay.ac.uk by vax.NSFnet-Relay.AC.UK via Janet with NIFTP id aa28114; 5 Jun 90 17:07 BST From: Anthony Appleyard To: KRVW <@NSFnet-Relay.AC.UK:KRVW@sei.cmu.edu> Date: Tue, 05 Jun 90 14:04:48 BST Message-Id: <$TGVGDBVHCNXT at UMPA> Subject: Virus-L vol 0 issue #0614 Virus-L Digest Tue, 14 Jun 88, Volume 0 : Issue #0614 Today's Topics Re: alternative to shorting battery Soldering vs. Shorting Any info on gerbel virus? re: yet another alternative to shorted batteries Not presently here Re: Not presently here ** no subject, date = Tue, 14 Jun 88 13:12:13 EST version number hack. Academic Assignment of Viruses ------------------------------ Date: Tue, 14 Jun 88 01:27:25 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Amanda B Rosen Subject: Re: alternative to shorting battery Recently, Jefferson Ogata wrote: >The proper alternative to shorting a soldered battery is to desolder >it and wait. It all depends on if you're under warranty or not. Desolder the battery and your warranty is shot. Short it and you're OK. Even if the battery blows there's a good chance your dealer won't know. Please, people, let's just agree that shorting batteries is a last-ditch effort to be used only by the desperate, and drop it... This is way off virus subjects... /a -------------------- Date: Tue, 14 Jun 88 02:35:17 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Amanda B Rosen Subject: Soldering vs. Shorting I agree, it's silly. This is the last I will write about the subject (sighs of relief...) I believe that in fact, the dealer DID short the battery... /a -------------------- Date: Tue, 14 Jun 88 09:25:59 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: "Kenneth R. van Wyk" Subject: Any info on gerbel virus? I've just received a word of mouth report about a virus called the gerbel virus. The report was sketchy, but it *appears* to be a boot- record virus. It reportedly makes a few copies of itself and then destroys the original (much like the Lehigh virus). Well, when it does its nasty work, it supposedly puts gerbel tracks (or reasonable ASCII renditions thereof) across the bottom of the user's screen and outputs some inane (sp?) message. Note that this is all sketchy! Do *NOT* necessarily trust it as being accurate. Does anyone out there have any substantiated information on this alleged gerbel virus? If so, please forward it to the list. Ken P.S. I now know more than I ever thought I would about Mac II batteries; I hope we can get on to the real issues at hand. Which isn't to say Mac batteries aren't really awesome... :-) ...lets all try to keep the discussion to viruses, ok? Kenneth R. van Wyk User Services Senior Consultant Steve Dallas: Who's driving?! Lehigh University Computing Center Opus: Oh keep your pants on, Internet: I pressed cruise control. BITNET: -------------------- Date: Tue, 14 Jun 88 08:44:00 CDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: GREENY Subject: re: yet another alternative to shorted batteries > The proper alternative to shorting a soldered battery is to desolder > it and then wait. I agree. But since you have gone to all the trouble to desoldering the little sucker, and since this problem COULD arise again, why not drop a mini-SPST switch in there to prevent the desoldering mess again next time it happens? Radio shack has em for say $1.29....and maybe a little plastic box and a piece of velcro to stick it to the side of the power supply...about a total of $3-$4.....and somewhat helpful too... Any objections? Suggestions? bye for now but not for long... Greeny Bitnet: MISS026@ECNCDC Internet: MISS026%ECNCDC.BITNET@CUNYVM.CUNY.EDU Disclaimer: Route all complaints to /dev/null -------------------- Date: Tue, 14 Jun 88 06:17:16 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: riacs!ames!hc!csed-1!csed-47!roskos@rutgers.edu Subject: Not presently here I am in Seattle, and thus cannot answer your mail at present. I will answer your message when I return. This reply was automatically generated. -------------------- Date: Tue, 14 Jun 88 11:43:15 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: "Kenneth R. van Wyk" Subject: Re: Not presently here In-Reply-To: Message of Tue, 14 Jun 88 06:17:16 EDT from >This reply was automatically generated. If anyone else out there plans on using one of these "automatic answering machine" programs, *PLEASE* advise them not to reply to VIRUS-L! It's very rude, and won't be tolerated. 'Nuff said. Ken Kenneth R. van Wyk User Services Senior Consultant Steve Dallas: Who's driving?! Lehigh University Computing Center Opus: Oh keep your pants on, Internet: I pressed cruise control. BITNET: -------------------- Date: Tue, 14 Jun 88 13:12:13 EST Reply-To: Virus Discussion List Sender: Virus Discussion List From: "Neil Goldman (216) 861-5000" To: VIRUS-L at LEHIIBM1 Two points of interest. 1) According to Ross Greenberg, the author of FluShot+, a new version with 'all known bugs, defeciences, problem spots, and areas of concern' is currently in Beta test. It should be released next week. 2) RE: Jim Shaffer's request for info on the Universal Virus Simulator. the National BBS Society (NBBS) can be reached at: 4423 Cheeney Street Santa Clara, CA 95054 Voice - (408) 727-4559 BBS - (408) 988-4004 They have two programs. The first is called VIRUSIM.EXE, and simulates every known method (except boot sector infect) of replication. First run your protection software, then execute VIRUSIM. It will tell you which test it is running. Hopefully, your protection software will 'stop it in the act.' If not, you know which type of know virus replication mechanisms which you are *not* immune to. The second is called VIRUS-B.COM. It is a modified version of the Israeli Friday the 13th virus. The branch to the destruction mechanism has been removed, and it is restricted to the current subdirectory. Also, It will only infect COM files, but will not infect COMMAND.COM. When it infects a COM file, it changes the time/date stamp, increases the program size by about 500 bytes, and when the infected program is executed, it will display a message indicating so. Infected programs do themselves become viruses. NOTE: Before they would allow me to download these two programs, they called the Senior Manager in my department to insure I was who I claimed to be. Obviously, in the 'wrong hands', these two programs are potentially hazardous. -------------------- Date: Tue, 14 Jun 88 15:34:09 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Russell Nelson Subject: version number hack. Another form of delayed virus execution is based on the version number. Imagine if a virus waited until the version number of MS-DOS was 3.5 or greater until it attacked? -russ -------------------- Date: Tue, 14 Jun 88 23:24:00 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List Comments: Resent-From: WHMurray@DOCKMASTER.ARPA Comments: Originally-From: WHMurray@DOCKMASTER.ARPA From: WHMurray@DOCKMASTER.ARPA Subject: Academic Assignment of Viruses A society that depends upon any mechanism for its own proper functioning, cannot tolerate, much less encourage, any tampering with the intended operation of that mechanism. Therefore, one is tempted to rise up in indignation at the idea of a qualified academic assigning a virus to his students. The next thing you know, they will be assigning plagiarism. How about the forgery of academic credentials? Perhaps we should offer a course in how to falsify research results. Or, perhaps, on how to trash another's experiments, notes or reports. Perhaps it is a sign of immaturity that we are unable to recognize the moral equivalency. I will leave open the question of whether the immaturity is in the technology, the society, or academia. I thought that we put this issue to bed several years ago when we stopped assigning the breaking of security. It seems that we did not. For an academic to be unable to recognize that assignments, and the recognition that goes with their successful completion, encourages the behavior assigned, demonstrates a lack of understanding of the activity in which he is engaged. If he understands it, and still makes such an assignment, he demonstrates a lack of understanding of where his real interest rests. Such irresponsible behavior may account, in part, for the anti-academic bias in our society and for the manifest distrust of the scientific establishment. It is of little wonder that the citizens of Cambridge, Massachusetts are reluctant to trust the likes of these with genetic engineering. If there is any lesson that we should have learned from the computer, it is that understanding the effects of what we intend for it to do is a daunting task. Even getting it to do what we intend is not trivial. It seems to me, that there is plenty of material here for assignments; we need not look to assignments which are at best trivial, and at worst, William Hugh Murray, Fellow, Information System Security, Ernst & Whinney 2000 National City Center Cleveland, Ohio 44114 21 Locust Avenue, Suite 2D, New Canaan, Connecticut 06840 -------------------- *** end of Virus-L issue *** Return-Path: XPUM04@prime-a.central-services.umist.ac.uk Received: from G.SEI.CMU.EDU by ubu.cert.sei.cmu.edu (5.61/2.3) id AA21727; Thu, 7 Jun 90 17:46:32 -0400 Received: from SEI.CMU.EDU by g.sei.cmu.edu (5.61/2.5) id AA16382; Thu, 7 Jun 90 17:46:32 -0400 Received: from nsfnet-relay.ac.uk by sei.cmu.edu (5.61/2.3) id AA14358; Thu, 7 Jun 90 17:46:15 -0400 Received: from sun.nsfnet-relay.ac.uk by vax.NSFnet-Relay.AC.UK via Janet with NIFTP id aa26842; 7 Jun 90 19:40 BST From: Anthony Appleyard To: KRVW <@NSFnet-Relay.AC.UK:KRVW@sei.cmu.edu> Date: Tue, 05 Jun 90 14:04:48 BST Message-Id: <$TGVGDBVHCNXT at UMPA> Subject: Virus-L vol 0 issue #0614 Virus-L Digest Tue, 14 Jun 88, Volume 0 : Issue #0614 Today's Topics Re: alternative to shorting battery Soldering vs. Shorting Any info on gerbel virus? re: yet another alternative to shorted batteries Not presently here Re: Not presently here ** no subject, date = Tue, 14 Jun 88 13:12:13 EST version number hack. Academic Assignment of Viruses ------------------------------ Date: Tue, 14 Jun 88 01:27:25 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Amanda B Rosen Subject: Re: alternative to shorting battery Recently, Jefferson Ogata wrote: >The proper alternative to shorting a soldered battery is to desolder >it and wait. It all depends on if you're under warranty or not. Desolder the battery and your warranty is shot. Short it and you're OK. Even if the battery blows there's a good chance your dealer won't know. Please, people, let's just agree that shorting batteries is a last-ditch effort to be used only by the desperate, and drop it... This is way off virus subjects... /a -------------------- Date: Tue, 14 Jun 88 02:35:17 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Amanda B Rosen Subject: Soldering vs. Shorting I agree, it's silly. This is the last I will write about the subject (sighs of relief...) I believe that in fact, the dealer DID short the battery... /a -------------------- Date: Tue, 14 Jun 88 09:25:59 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: "Kenneth R. van Wyk" Subject: Any info on gerbel virus? I've just received a word of mouth report about a virus called the gerbel virus. The report was sketchy, but it *appears* to be a boot- record virus. It reportedly makes a few copies of itself and then destroys the original (much like the Lehigh virus). Well, when it does its nasty work, it supposedly puts gerbel tracks (or reasonable ASCII renditions thereof) across the bottom of the user's screen and outputs some inane (sp?) message. Note that this is all sketchy! Do *NOT* necessarily trust it as being accurate. Does anyone out there have any substantiated information on this alleged gerbel virus? If so, please forward it to the list. Ken P.S. I now know more than I ever thought I would about Mac II batteries; I hope we can get on to the real issues at hand. Which isn't to say Mac batteries aren't really awesome... :-) ...lets all try to keep the discussion to viruses, ok? Kenneth R. van Wyk User Services Senior Consultant Steve Dallas: Who's driving?! Lehigh University Computing Center Opus: Oh keep your pants on, Internet: I pressed cruise control. BITNET: -------------------- Date: Tue, 14 Jun 88 08:44:00 CDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: GREENY Subject: re: yet another alternative to shorted batteries > The proper alternative to shorting a soldered battery is to desolder > it and then wait. I agree. But since you have gone to all the trouble to desoldering the little sucker, and since this problem COULD arise again, why not drop a mini-SPST switch in there to prevent the desoldering mess again next time it happens? Radio shack has em for say $1.29....and maybe a little plastic box and a piece of velcro to stick it to the side of the power supply...about a total of $3-$4.....and somewhat helpful too... Any objections? Suggestions? bye for now but not for long... Greeny Bitnet: MISS026@ECNCDC Internet: MISS026%ECNCDC.BITNET@CUNYVM.CUNY.EDU Disclaimer: Route all complaints to /dev/null -------------------- Date: Tue, 14 Jun 88 06:17:16 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: riacs!ames!hc!csed-1!csed-47!roskos@rutgers.edu Subject: Not presently here I am in Seattle, and thus cannot answer your mail at present. I will answer your message when I return. This reply was automatically generated. -------------------- Date: Tue, 14 Jun 88 11:43:15 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: "Kenneth R. van Wyk" Subject: Re: Not presently here In-Reply-To: Message of Tue, 14 Jun 88 06:17:16 EDT from >This reply was automatically generated. If anyone else out there plans on using one of these "automatic answering machine" programs, *PLEASE* advise them not to reply to VIRUS-L! It's very rude, and won't be tolerated. 'Nuff said. Ken Kenneth R. van Wyk User Services Senior Consultant Steve Dallas: Who's driving?! Lehigh University Computing Center Opus: Oh keep your pants on, Internet: I pressed cruise control. BITNET: -------------------- Date: Tue, 14 Jun 88 13:12:13 EST Reply-To: Virus Discussion List Sender: Virus Discussion List From: "Neil Goldman (216) 861-5000" To: VIRUS-L at LEHIIBM1 Two points of interest. 1) According to Ross Greenberg, the author of FluShot+, a new version with 'all known bugs, defeciences, problem spots, and areas of concern' is currently in Beta test. It should be released next week. 2) RE: Jim Shaffer's request for info on the Universal Virus Simulator. the National BBS Society (NBBS) can be reached at: 4423 Cheeney Street Santa Clara, CA 95054 Voice - (408) 727-4559 BBS - (408) 988-4004 They have two programs. The first is called VIRUSIM.EXE, and simulates every known method (except boot sector infect) of replication. First run your protection software, then execute VIRUSIM. It will tell you which test it is running. Hopefully, your protection software will 'stop it in the act.' If not, you know which type of know virus replication mechanisms which you are *not* immune to. The second is called VIRUS-B.COM. It is a modified version of the Israeli Friday the 13th virus. The branch to the destruction mechanism has been removed, and it is restricted to the current subdirectory. Also, It will only infect COM files, but will not infect COMMAND.COM. When it infects a COM file, it changes the time/date stamp, increases the program size by about 500 bytes, and when the infected program is executed, it will display a message indicating so. Infected programs do themselves become viruses. NOTE: Before they would allow me to download these two programs, they called the Senior Manager in my department to insure I was who I claimed to be. Obviously, in the 'wrong hands', these two programs are potentially hazardous. -------------------- Date: Tue, 14 Jun 88 15:34:09 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List From: Russell Nelson Subject: version number hack. Another form of delayed virus execution is based on the version number. Imagine if a virus waited until the version number of MS-DOS was 3.5 or greater until it attacked? -russ -------------------- Date: Tue, 14 Jun 88 23:24:00 EDT Reply-To: Virus Discussion List Sender: Virus Discussion List Comments: Resent-From: WHMurray@DOCKMASTER.ARPA Comments: Originally-From: WHMurray@DOCKMASTER.ARPA From: WHMurray@DOCKMASTER.ARPA Subject: Academic Assignment of Viruses A society that depends upon any mechanism for its own proper functioning, cannot tolerate, much less encourage, any tampering with the intended operation of that mechanism. Therefore, one is tempted to rise up in indignation at the idea of a qualified academic assigning a virus to his students. The next thing you know, they will be assigning plagiarism. How about the forgery of academic credentials? Perhaps we should offer a course in how to falsify research results. Or, perhaps, on how to trash another's experiments, notes or reports. Perhaps it is a sign of immaturity that we are unable to recognize the moral equivalency. I will leave open the question of whether the immaturity is in the technology, the society, or academia. I thought that we put this issue to bed several years ago when we stopped assigning the breaking of security. It seems that we did not. For an academic to be unable to recognize that assignments, and the recognition that goes with their successful completion, encourages the behavior assigned, demonstrates a lack of understanding of the activity in which he is engaged. If he understands it, and still makes such an assignment, he demonstrates a lack of understanding of where his real interest rests. Such irresponsible behavior may account, in part, for the anti-academic bias in our society and for the manifest distrust of the scientific establishment. It is of little wonder that the citizens of Cambridge, Massachusetts are reluctant to trust the likes of these with genetic engineering. If there is any lesson that we should have learned from the computer, it is that understanding the effects of what we intend for it to do is a daunting task. Even getting it to do what we intend is not trivial. It seems to me, that there is plenty of material here for assignments; we need not look to assignments which are at best trivial, and at worst, William Hugh Murray, Fellow, Information System Security, Ernst & Whinney 2000 National City Center Cleveland, Ohio 44114 21 Locust Avenue, Suite 2D, New Canaan, Connecticut 06840 -------------------- *** end of Virus-L issue ***