Conference hydra::amiga_v1

1079.0. "new virus in ibmpc world" by BAGELS::BRANNON (Dave Brannon) Sat Jan 16 1988 00:38

    Found this in the IBMPC notesfile.  Since the Amiga community has
    been recently exposed to it's first virus, and because there are
    some folks actually running ibmpc software on their Amigas, this
    ibmpc virus warning just might be worth reading.
    
    -dave
        
                    <<< NAC::WORK$01:[NOTES$LIBRARY]IBMPC.NOTE;1 >>>
                                  -< IBM PCs >-
================================================================================
Note 1190.0         Watch for this virus - PLEASE READ IT ALL         No replies
JOCKEY::SHARKEY "I wish I'd thought of that"        265 lines  14-JAN-1988 12:17
--------------------------------------------------------------------------------

    Info from Security notes file.   BEWARE - BEWARE
    
    
    
          <<< HUMAN::_HUMAN$DUA1:[NOTES$LIBRARY]SECURITY_INFORMATION.NOTE;1 >>>
                 -< Digital Worldwide information on SECURITY >-
================================================================================
Note 157.0                     P.C. Virus Warning                        1 reply
STEREO::HOLDEN                                       52 lines  11-DEC-1987 10:11
--------------------------------------------------------------------------------


       *****************   MS/DOS Virus Warning *******************


Date: Wed, 25 Nov 87 11:15 EDT
From: Jeffrey James Bryan Carpenter <JJC%Vms.Cis.Pittsburgh.EDu@VB.CC.
 CMU.EDU>
Subject: Computer Virus
To: risks@csl.sri.com

From: IN%"MD4F@CMUCCVMA" "User Services List (ADVISE-L)" 23-NOV-1987 09:33
To: Jeff Carpenter <256521@vms.cis.pittsburgh.edu>
Subj: Virus warning!
Date: Mon, 23 Nov 87 08:05:57 EST
From: "Kenneth R. van Wyk" <@vms.cis.pittsburgh.edu:LUKEN@LEHIIBM1.BITNET>

Last week, some of our student consultants discovered a virus program
that's been spreading rapidly thoughout Lehigh University.  I thought
I'd take a few minutes and warn as many of you as possible about this
program since it has the chance of spreading much farther than just our 
University.  We have no idea where the virus started, but some users have
told me that other universities have recently had similar problems.

The virus: the virus itself is contained in the stack space of COMMAND.COM.
When a pc is booted from an infected disk, all a user need do to spread
the virus is to access another disk via TYPE, COPY, DIR, etc.  If the
other disk contains COMMAND.COM, the virus code is copied to the other
disk.  Then, a counter is incremented on the parent.  When this counter
reaches a value of 4, any and every disk in the PC is erased thoroughly.
The boot tracks are nulled, as are the FAT tables, etc.  All Norton's horses 
couldn't put it back together again... :-)  This affects both floppy
and hard disks.  Meanwhile, the four children that were created go on
to tell four friends, and then they tell four friends, and so on, and so on.

Detection: while this virus appears to be very well written, the author
did leave behind a couple footprints.  First, the write date of the
command.com changes.  Second, if there's a write protect tab on an
uninfected disk, you will get a WRITE PROTECT ERROR... So, boot up from
a suspected virus'd disk and access a write protected disk - if an
error comes up, then you're sure.  Note that the length of command.com
does not get altered.

I urge anyone who comes in contact with publicly accessible (sp?) disks
to periodically check their own disks.  Also, exercise safe computing -
always were a write protect tab. :-)

This is not a joke.  A large percentage of our public site disks has
been gonged by this virus in the last couple days.

Kenneth R. van Wyk, User Services Senior Consultant,
Lehigh University Computing Center (215)-758-4988
<LUKEN@LEHIINM1.BITNET> <LUKEN@VAX1.CC.LEHIGH.EDU>
================================================================================
Note 157.1                     P.C. Virus Warning                         1 of 1
TAV02::NITSAN "set profile/personal_name="set prof" 196 lines  12-JAN-1988 02:22
--------------------------------------------------------------------------------

[ The following is translated from an article that appeared on "Maariv" (one
  of Israel's most popular daily newspapers) in 8-Jan-1988. I translated it
  myself, so I apologize for the poor style. My own comments appear in brackets
  '[]' within the translated text - Nitsan ]

################################################################################
        THE 'COMPUTER AIDS' VIRUS CONTINUES TO RUN WILD:
              'BEWARE OF FRIDAY THE 13-TH OF MAY'

    The Hebrew University [in Jerusalem] published the warning
    yesterday, as in the above date the virus may destroy any
    information found in the computer memory or on the disks.
    Immunization programs are spread to locate the virus and
    exterminate it.

        by Tal Shahaf

The computer virus that got the nickname "the Israeli Virus" continues to run
wild. The Hebrew University in Jerusalem spread the warning yesterday: Don't
use your computer on Friday, the 13-th of May this year! In this day the virus
was programmed to wake up from its hibernation - and destroy any information
found in the computer memory or on the disks. Because of this reason, it also
got the nickname "time bomb". Moreover, every 13-th of each month, the virus
will cause a significant slow-down in the computer's response.

Evidences were received by Maariv yesterday for the existence of the virus in
many other places in addition to the Hebrew University in Jerusalem. It was
also reported to be detected in one of the I.D.F. [Israeli Defense Forces]
units using personal computers. Other messages mentioned some commercial
companies where the virus had been detected. An owner of a software house from
Tel-Aviv, who asked to stay anonymous, told that the malfunctions were detected
in software kits that were bought with the computers and were installed by the
selling company.

Eli Shapira, an owner of a computer store from Haifa, tells about infected
software kits that arrived at him from people in the area. The virus also
infected a computer in his store, and possibly spread to customers who had
bought software kits. According to him there was a thorough disinfection
activity that cleared the computer and the diskettes in the store.

Computer experts warn that the virus may now be in any software and in any
computer, including those purchased in computer stores.

Currently, the Hebrew University spreads immunization programs that enable
detected the virus in the computer memory and exterminate it. A new problem
popped up though: A mutation of the virus may show up, a few times as dangerous
as the current virus. It all depends on the source of the virus and whether
the person responsible for it is some computer wizard who did it for fun or
some psychopath who does not control his moves.

        "THE ISRAELI VIRUS" SPREADS AT THE RATE OF AIDS

    The immunization programs fit only the virus from Jerusalem.
    Stopping of unauthorized software copying phenomenon is expected.

        by Tal Shahaf

The model that fits the best the spreading of the computerized virus is the
AIDS virus, so claim computer staff. The resemblance is in all dimensions. The
spreading rate of the virus is amazing. A single infected diskette is
sufficient for infecting thousands of personal computers. It is passed by
diskettes going between computers, and also by telephone communication between
computers. Yesterday it was found out that the virus was much wider spread than
what was thought.

Because of this reason, users are warned not to receive diskettes from unknown
source. First precaution: not to use diskettes without the "computerized
condom": a little sticker that prevents any damage to the information on the
diskette.

The computer community is grateful for stopping the process of unauthorized
copying of software that reached incredible use lately. Exactly like AIDS, that
generated the safe sex phenomenon, the computerized virus is about to generate
the phenomenon of decent use only of software .

The phenomenon of growing infected software was discovered yesterday as a side
effect only. The real damage is the time bomb hidden: Every 13-th of each
month, the virus will cause significant slow down in the computer response, and
in 13-th of May this year it will erase all the information in the computer.

Yuval Rahavi, the computer expert from Jerusalem who discovered the vicious
virus, explains that it is a small and sophisticated computer program. When
the computer is turned on, the program is loaded into the computer memory, and
from now on, any program invoked is contaminated. When the virus identify a new
program, it joins it without disturbing its activity. From now on, any use of
this software, transferring it to other user, means spreading the virus.

The temporary solution to the problem is the immunization programs written by
Rahavi. One is used to detect the virus and the other for prevention. It is
loaded into the computer memory before any other software. If the virus then
attempts to reside in the memory, the program will give appropriate warning.
People from the Hebrew University distributed information that described the
virus for all the computer users at the universities, joined with copies of the
immunization programs.

Ofer Ahituv, an owner of a software house, thinks the source for the virus is
in one of the software houses which became involved with his programmers.
According to him, all his software kits will now be distributed carrying a label
specifying they were checked and found clean of any virus.

The possibility of a new virus, which is more dangerous, scares computer people.
Such a virus may harm the information, erase it slowly in such a way it is not
felt. This way, accountants may find out all their clients accounting data has
been erased, banks will lose their customers data, stores - their cash register
data.

The immunization programs are good for fighting the current virus. If a new
virus pops up - these immunizations will be worthless.

Ezra Ben-Kohav, chairman of the computer organization I.O.I.P. [Israeli
Organization for Information Processing] told Maariv yesterday: "There is no
law that defined such action as crime. If the author is caught, there will be
nothing to blame him/her for."

Arie Bender gives the following message: A search team was established in the
Hebrew University, which includes Hilel Bar-Dayan, Amiram Ofir, Eli Peled and
Elisha Ben-Ezra. People in the university asked yesterday to make clear there
was no information or suspicion about the creators of the virus, including
students of the Talpiot program [a special program for young students that
combines army studying].

        THIS IS HOW TO PROTECT YOUR COMPUTER

Yossi Gil, from the computer people who discovered the virus, suggests several
defense activities for the computer users who receive a new diskette and want
to check it.

1. During the check activate the computer without a hard disk, that may be
   infected by the virus.
2. Use diskettes that carry no important information/programs.
3. Invoke the checked software with a diskette protected by a sticker.
4. Invoke the software again with a diskette without a sticker.
5. Compare the two diskettes using a compare program. If no differences are
   found, you may assume the checked diskette is free of the virus.
6. Another rule which is always important: Prepare a copy of any important
   diskette, and specify the date when the copy was done. If the virus attacks
   your computer, you will be able to restore the damaged programs from these
   copies.  (by Tal Shahaf)

        THE VIRUS REACHED HAIFA

The "Israeli virus" was detected, after causing much damage also in the
educational center of the ministry of education in Rotenberg building on the
Carmel [mountain in Haifa]. There is a computer project going on this site, in
which tens of students participate. The center manager, Gideon Goldstein, and
the project people Michael Hazan and Gadi Kats, told that 6 weeks ago there was
a virus discovered, which destroyed 15 thousand dollar worth software and 2
disks in which 7000 hours of work had been invested, in an irrecoverable way.
(by Reuven Ben-Zvi)

        PANIC AMONG OWNERS OF PERSONAL COMPUTERS

The Israeli virus panic moved from within the campus and spread out also to the
computer consumers in Jerusalem. In many stores there were customers reporting
symptoms in their home computers, that matched those which had been found in
the P.C. systems in the university. "This morning we ran into and heard about a
few cases", told Emanuel Marinsky, manager of computer services lab, "It raises
panic".  (by Arie Bender)
################################################################################

[ The following is a local reply to the original note from one of our
  engineering group ]

                <<< SYS$COMMON:[NOTES$LIBRARY]ADVISORY.NOTE;1 >>>
                          -< Local Advisory Subjects >-
================================================================================
Note 48.1                      P.C. Virus Warning                         1 of 1
TAVENG::MONTY "LEG has it now - FCS '91"             25 lines  10-JAN-1988 10:25
                      -< Important notice about PC virus >-
--------------------------------------------------------------------------------

    The PC belonging to the Local Engineering group has been infected by
    one of the flavors of viruses commonly doing the rounds. 
    
    NOTE : We work in a "safe environment" (AID-less) and only use public
    domain or bought programs. So if our PC got infected, I'm pretty sure
    everyone else's PC is infected.
    
    I suspect SOMEONE (no finger pointing yet) used an infected diskette on
    our PC and thus infected our hard disk.
    
         a. Anyone using a PC should check that it is not infected.
            The signs are that after any utility is run, disc space
            disappears.
         
         b. Anyone who has used the LEG machine over the last fortnight
            or has received a field test diskette, should NOT pass the
            diskette to any customer [unless you don't like the 
            customer ;-) ].
         
    To paraphrase the adverts "PLEASE PRACTICE SAFE COMPUTING", don't
    accept diskettes or programs from strangers !!!!!
    
    						....... Monty