Return-Path: XPUM04@prime-a.central-services.umist.ac.uk
Received: from G.SEI.CMU.EDU by ubu.cert.sei.cmu.edu (5.61/2.3)
        id AA04521; Wed, 20 Jun 90 17:26:21 -0400
Received: from SEI.CMU.EDU by g.sei.cmu.edu (5.61/2.5)
        id AA07112; Wed, 20 Jun 90 17:26:19 -0400
Received: from nsfnet-relay.ac.uk by sei.cmu.edu (5.61/2.3)
        id AA23369; Wed, 20 Jun 90 17:26:12 -0400
Received: from sun.nsfnet-relay.ac.uk by vax.NSFnet-Relay.AC.UK 
           via Janet with NIFTP  id aa23256; 20 Jun 90 16:21 BST
From: Anthony Appleyard <XPUM04@prime-a.central-services.umist.ac.uk>
To: DAVIDF@cs.heriot-watt.ac.uk
Date:         Wed, 20 Jun 90 16:33:16 BST 
Message-Id:   <$TGWGCZNQBTQX at UMPA>
Subject:      Virus-L vol 0 issue #1021



Virus-L Digest Fri, 21 Oct 88, Volume 0 : Issue #1021

Today's Topics

Re: More on hardware damage
Software frying Commodores
PC disk diagnostics- destructive?
Aldus gets hit again
Software effects on hardware
Re: Aldus gets hit again

------------------------------

Date:         Fri, 21 Oct 88 08:40:40 MEZ
From:         "Dr. Gregor Reich" <A8411DAA@AWIUNI11>
Subject:      Re: More on hardware damage
In-Reply-To:  Message of Thu, 20 Oct 88 21:34:00 CDT from <TK0GRM1@NIU>

I think I have to clear up a few things about  my  remark  on  "no  way  to
influence  the  hardware".  What  I  feel  the  danger  of a virus is, that
something goes on which can not be stopped until it's  to  late.  This  can
happen  (on  the  hardware  side) by changing the seek time of a drive to a
value which influences its performance over time. The other  possibilities,
i.e.  bringing  the  heads in a resonance status or frying the monitor (you
can do the same on a Hercules card), would not be unnoticed by  the  people
in  front  of  the  screen.  If  you  have  a BBS or something else running
unobserved, that's of course another story.
G. Reich, Institute for Analytical Chemistry, University of Vienna, Austria

--------------------

Date:         Fri, 21 Oct 88 10:08:00 EDT
From:         Shatner and Nimoy in '92! <PGOETZ@LOYVAX>
Subject:      Software frying Commodores

Remember the Commodore Pet? It was made back  around  1977.  Referencing  a
certain  memory  location made the 6502 run at 2 Mhz (I think) instead of 1
Mhz. The only drawback was that
1. the machine was unreliable at that speed, and
2. on certain models of the Pet, doing so could fry certain chips.

--------------------

Date:         Fri, 21 Oct 88 12:24:08 EDT
From:         "Mark F. Haven" <MHQ@NIHCU>
Subject:      PC disk diagnostics- destructive?

"Date:         Thu, 20 Oct 88 17:16:00 MDT
Sender:       Virus Discussion List <VIRUS-L@LEHIIBM1
From:         GORDON_A%CUBLDR@VAXF.COLORADO.EDU
Subject:      RE: kill that drive!
Regarding  the  software  destruction  of  drives...some  of  the  PC  disk
diagnostics  can  approach  what  seems to be a self destructive mode. When
running the seek test, the drive does indeed start to vibrate  and  becomes
rather  loud.  I  suppose  that  a virus inplanted in an unattended machine
could do the same. I have never had enough courage to run  this  test  more
than  once every so often. I don't know what would happen if the drive were
continuously run this way. I can't imagine it would be very  good  for  it.
Allen Gordon":-

When I worked for a company which  sold  PC's  we  burned  them  in  before
delivery by stressing them as much as possible. One of the things we did to
test drives was to run the diagnostics continuously overnight. It turned up
some  defective  machines (which we returned) but I don't remember the ones
we sent on to our customers coming back with problems in the  drives  at  a
higher  rate than the machines I fixed which we had not burned in. Based on
this I conclude  that  the  PC  diagnostic  seek  test  is  non-destructive
(despite  the  noise).  If anyone has any actual experience to the contrary
PLEASE post it.

--------------------

Date:         Fri, 21 Oct 88 14:31:43 EDT
From:         Ken van Wyk <luken@SPOT.CC.LEHIGH.EDU>
Subject:      Aldus gets hit again

I've just received a word-of-mouth announcement that Aldus Corporation  was
hit  by  another  virus. The original announcement, I'm told, came from the
Associated Press board on Compuserve. The details that I have are  sketchy,
but  they  say  that  the virus was called nVir (?). If anyone has any more
information on this, *please* send it to the list!

Also, the  same  announcement  on  Compuserve  said  that  Carnegie  Mellon
University  (in  Pittsburgh  PA) was also hit by a virus this last week. No
more details on that one, though. Does anyone have any more information  on
this?

The Compuserve message was dated today, 10/21/88.

Kenneth R. van Wyk                   Calvin: Says here that there are four
User Services Senior Consultant         pecks in a bushel.  What's a peck?
Lehigh University Computing Center   Hobbes: A quick smooch.
Internet: <luken@Spot.CC.Lehigh.EDU> Calvin: You know, I just don't understand
BITNET:   <LUKEN@LEHIIBM1>              this math stuff!

--------------------

Date:         Fri, 21 Oct 88 13:46:17 CDT
From:         Kevin Trojanowski <troj@UMAXC.WEEG.UIOWA.EDU>
Subject:      Software effects on hardware

A few years back, I remember hearing some  acquaintances  talking  about  a
method  of  "punishing"  someone  they  didn't  like -- they would give him
copies of pirated software which had the boot sector (or some such) changed
so that when he would boot the disk, the drive would be told to seek  track
99.  On the old Commodore-64 drives, this caused the drive head to fall off
the glides, damage itself on the stops, or some equiavalent thereof  --  in
any case, it ruined the drive.
-Kevin Trojanowski, troj@umaxc.weeg.uiowa.edu

--------------------

Date:         Fri, 21 Oct 88 15:22:51 EDT
From:         Joe McMahon <XRJDM@SCFVM>
Subject:      Re: Aldus gets hit again
In-Reply-To:  Message of Fri,
              21 Oct 88 14:31:43 EDT from <luken@SPOT.CC.LEHIGH.EDU>

>... they say that the virus was called nVir (?).  If anyone has any more
>information on this, *please* send it to the list!

Boy, I don't understand that at all. nVIR is a well-known  Mac  virus  that
can  be  fought  quite successfully with the "Vaccine" CDEV. If this is the
known strain of nVIR, Aldus isn't being very  careful  about  viruses.  For
those  who  know  about  nVIR,  you  may  delete  the rest of this message.

nVIR is a virus supposedly based on some assembler source which was  posted
in  CompuServe  last  year  sometime.  It  follows standard spread patterns
(application -> system, system -> applications), but has  a  few  bugs.  It
doesn't  check  for  a  "killed"  version of itself and does not completely
infect applications which have protected code resources.

Its "function" is to (on a 1-in-16 chance) say "Don't panic"  if  MacInTalk
is  installed, and to beep if it isn't. The LISTSERV here at SCFVM has both
a program to remove it from your applications and a better explanation  (in
the  virus documentation stack). You must use ResEdit to get it out of your
System files.

Again, since source of sorts was available for this one, it may  have  been
modified  to  be more sophisticated and more agressive; it is also possible
that it has been made Vaccine-proof.

- - Joe M.

--------------------

*** end of Virus-L issue ***
