User`s guide

ManualsBrandsAMSTRAD ManualsComputer equipmentPC-ECD

Editor: Edward Wilding

Technical Editor: Fridrik Skulason, University of Iceland

Editorial Advisors: Jim Bates, Bates Associates, UK, Phil Crewe, Fingerprint, UK, David Ferbrache, Royal Signals & Radar Establishment, UK, Ray Glath,

RG Software Inc., USA, Hans Gliss, Datenschutz Berater, West Germany, Ross M. Greenberg, Software Concepts Design, USA, Dr. Harold Joseph Highland,

Compulit Microcomputer Security Evaluation Laboratory, USA, Dr. Jan Hruska, Sophos, UK, Dr. Keith Jackson, Walsham Contracts, UK, Owen Keane,

Barrister, UK, John Laws, Royal Signals & Radar Establishment , UK, David T. Lindsay, Digital Equipment Corporation, UK, Yisrael Radai, Hebrew University

of Jerusalem, Israel, Martin Samociuk, Network Security Management, UK, John Sherwood, Sherwood Associates, UK, Prof. Eugene Spafford, Purdue

University, USA, Dr. Peter Tippett, Certus International Corporation, USA, Dr. Ken Wong, PA Consulting Group, UK, Ken van Wyk, CERT, USA.

/90/$0.00+2.50 This bulletin is available only to qualified subscribers. No part of this publication may be reproduced, stored in a retrieval system, or transmitted

by any form or by any means, electronic, magnetic, optical or photocopying, without the prior written permission of the publishers.

CONTENTS

EDITORIAL 2

TECHNICAL NOTES 3

LETTERS

From IBM and Visionsoft 5

From Knoxware and Trend

Micro-Devices 7

IBM PC VIRUSES (UPDATE) 8

NOVELL UPDATE

Novell’s Analysis

of the GP1 Virus 9

NOVELL EXPERIMENTS

Virus Propagation and NetWare

Security 10

VIRUS ANALYSES

2100 and ‘Cracker Jack’

the Plagiarist 19

PRODUCT REVIEWS

ProScan 23

Virus Guard 25

END-NOTES & NEWS 28

ISSN 0956-9979

August 1991

THE AUTHORITATIVE INTERNATIONAL PUBLICATION

ON COMPUTER VIRUS PREVENTION,

RECOGNITION AND REMOVAL

Summary of content (28 pages)

PAGE 1
August 1991 ISSN 0956-9979 THE AUTHORITATIVE INTERNATIONAL PUBLICATION ON COMPUTER VIRUS PREVENTION, RECOGNITION AND REMOVAL Editor: Edward Wilding Technical Editor: Fridrik Skulason, University of Iceland Editorial Advisors: Jim Bates, Bates Associates, UK, Phil Crewe, Fingerprint, UK, David Ferbrache, Royal Signals & Radar Establishment, UK, Ray Glath, RG Software Inc., USA, Hans Gliss, Datenschutz Berater, West Germany, Ross M. Greenberg, Software Concepts Design, USA, Dr.
PAGE 2
Page 2 VIRUS BULLETIN EDITORIAL Network Experiments A large proportion of this month’s edition of VB is devoted to the propagation of computer viruses on Novell NetWare PC networks. The paper Virus Propagation and NetWare Security, submitted by Dr. Jan Hruska and Richard Jacobs of Sophos Ltd, provides some revealing insights into the interaction between various viruses and network software.
PAGE 3
August 1991 VIRUS BULLETIN TECHNICAL NOTES The GP1 Mystery Unravelled A short updated and amended report on the GP1 virus (first reported by VB in June of this year) appears on page 9 of this edition. One of the difficulties in reporting malicious programs which target proprietary software is that specific knowledge of the software’s exact operation is not generally available to the researcher. VB is indebted to Novell for its assistance in unravelling some of the mysteries behind GP1.
PAGE 4
Page 4 VIRUS BULLETIN disabled. As some of them are smaller and faster than ANSI.SYS, they might be a better choice in most cases. Most applications today do not use ANSI.SYS escape sequences to output to screen but call the BIOS routines directly. Unfortunately, a new way to abuse ANSI.SYS has now been discovered, which makes it possible to execute a program on a diskette, just by issuing the DIR command.
PAGE 5
August 1991 VIRUS BULLETIN LETTERS Sir, I am writing to try to clear up a rather surprising confusion that I have evidently caused. In a reply to a letter in the July 1991 VB, the editor reprints a posting of mine to VIRUS-L and attributes to me by implication the opinion that, among other things, virus scanners should not scan for viruses not known to be in the wild, or thought to be extinct.
PAGE 6
Page 6 VIRUS BULLETIN So it is possible to delete all of the DOS partitions with FDISK and (depending on the version of FDISK), lose all of the data held within the partitions.
PAGE 7
August 1991 5th July 1991 Sir, We certainly do not claim that Knoxcard cannot be reverse engineered as your reviewer claims (VB, July 1991, p. 39). Any competent systems programmer should be able to achieve this. What should be kept in mind, however is that once a piece of software is unassembled, writing a program to override it depends on knowing the contents of specific locations/addresses within the unassembled code.
PAGE 8
Page 8 VIRUS BULLETIN August 1991 IBM PC VIRUSES (UPDATE) Updates and amendments to the Virus Bulletin Table of Known IBM PC Viruses as of July 21st 1991. Hexadecimal search patterns can be used to detect the presence of the virus with the aid of a disk utility program, or preferably a dedicated virus scanner.
PAGE 9
August 1991 Page 9 VIRUS BULLETIN ➤ Broadcasts the login information in the login request via NOVELL UPDATE IPX if the proper login request occurs. The socket number (2A9FH) in the broadcast packet is a value not likely to be used by any other program. The code to perform this task is non-functional in the samples, but could easily be corrected. Eric Babcock Novell Inc., Provo, Utah, USA Socket numbers in broadcast packets control which machines on the LAN will accept the broadcast.
PAGE 10
Page 10 VIRUS BULLETIN NOVELL EXPERIMENTS Dr. Jan Hruska / Richard Jacobs Virus Propagation and NetWare Security Computer viruses spread through interchange of executables between computers. On Personal Computers (PCs) this interchange is much more frequent than on minicomputers and mainframes. This report will concentrate on viruses on PCs. The interchange of executables on non-networked PCs is almost exclusively done by floppy disks and is, as a consequence, relatively slow and physically controllable.
PAGE 11
August 1991 Page 11 VIRUS BULLETIN Parasitic Viruses Parasitic viruses modify the contents of COM and/or EXE files. They usually insert themselves at the end, or at the beginning of the file, leaving the bulk of the program intact. The initial jump instruction in the program is modified, but program functionality is usually preserved, although there are several viruses which overwrite the first few hundred bytes of the program rendering it unusable.
PAGE 12
Page 12 VIRUS BULLETIN August 1991 Companion Viruses Virus Entry Into the Network Companion viruses exploit the DOS property that given two programs with the same name but different extensions, the operating system will execute a COM file in preference to an EXE file. A companion virus creates a COM file for every EXE file it ‘infects’. The COM file is usually marked ‘hidden’ and contains the virus code, which also executes the EXE file. A virus will usually enter a network via the user workstation.
PAGE 13
August 1991 VIRUS BULLETIN ➤ The inherited rights mask of a directory determines the effective rights of that directory (read, write, open, close, delete, search) which are set separately and can be used to limit access to certain directories such as those containing executables. Trustee assignments override the directory effective rights. ➤ File/directory attributes (read-only, read-write, share) can be set separately.
PAGE 14
Page 14 VIRUS BULLETIN boot sector on floppy disks. The network was accessed (LOGIN followed by running of various applications, followed by LOGOUT). The workstation was cleared of infection and the network connection was re-established. The workstation hard disk and the workstation memory were examined for infection, and, as expected, nothing was found. Multi-Partite Viruses A clean workstation was used to log into the file-server. The workstation was infected with the Flip multi-partite virus.
PAGE 15
Page 15 VIRUS BULLETIN Virus Application ➣ Application ➣ DOS ➣ August 1991 Interrupt vector ➣ DOS ➣ Interrupt vector Figure 3 - Interrupt routing before and after infection The GP1 virus was tried under NetWare 3.11, where it replicated without problems, unlike the standard Jerusalem virus which refuses to replicate under the same circumstances. After becoming memory-resident the virus infects other files, extending them by 1546 bytes. There were no other visible side-effects.
PAGE 16
Page 16 VIRUS BULLETIN August 1991 Carrier program Virus Program 1 DEYu*&81lp[@# Program 2 DE132{+as$5\%6 Program 3 DE!"334%^dfs6456 Figure 4 - Three programs infected with an identical encrypted virus their presence by intercepting about fifteen different interrupt services, including file-open and file-close.
PAGE 17
August 1991 VIRUS BULLETIN ANTI-VIRUS SOFTWARE Two types of detection software can be used: virus-specific and virus-non-specific. The authors recommend standalone (application) software; memory-resident anti-virus software is not recommended. Regardless of which type of software is used, proper procedures must be followed to ensure that the machine running anti-virus software is clean, i.e. free of any virus active in memory.
PAGE 18
Page 18 VIRUS BULLETIN August 1991 Write-protect the floppy disk. To access the network, switch the PC off, boot from the floppy disk and then run IPX first, followed by NET3. Run LOGIN from the floppy disk. Check that the system login script or the user login script does not contain the command COMSPEC= ... since this causes a potentially infected COMMAND.COM to be loaded from the network when needed. If that statement is present, issue the command COMSPEC=A:\COMMAND.
PAGE 19
August 1991 Page 19 VIRUS BULLETIN 2100 VIRUS ANALYSES Jim Bates 2100 and ‘Cracker Jack’ the Plagiarist The recent ‘explosion’ of new virus variants has increased the workload of researchers to an almost unbearable extent and this is thought to be an inevitable result of the opening of virus ‘exchange’ Bulletin Boards all over the world. Computer viruses are a fascinating subject for study and quite naturally therefore, they can be expected to arouse general curiousity and interest.
PAGE 20
Page 20 VIRUS BULLETIN This list (Figure 1.) gives some idea of just how comprehensively this virus attempts to monitors system services. Stealth Features and 62 Seconds Stamp All the familiar stealth capabilities are present including the subtraction of virus code from reported file lengths for infected files. However, the virus uses the very old method of marking its own infection by setting the time field to 62 seconds.
PAGE 21
August 1991 VIRUS BULLETIN Both Migram and Smack contain slavishly copied sections of the 2100 code which examines the ROM. However, in this case the writer displays almost total ignorance of exactly what the code accomplishes and does not make proper use of the information collected. Similarly, the EXE file infection routine from the Murphy viruses has also been copied exactly without obvious awareness of its operation.
PAGE 22
Page 22 VIRUS BULLETIN Suffice it to say that the display of relatively sophisticated code alongside a plainly infantile mess gives these viruses a strange appearance when disassembled. Also within the code for the Smack virus are plain text messages which are not displayed during virus operations.
PAGE 23
August 1991 Page 23 VIRUS BULLETIN PRODUCT REVIEW 1 Mark Hamilton ProScan - A Commercial Scanner for the Non-Technical End-User McAfee Associates of Santa Clara, California, is well known for its SCAN, NETSCAN, CLEAN and VSHIELD antivirus products which are marketed as shareware. However, McAfee also produce a shrink-wrapped anti-virus product called ProScan which is a melange of the first three of these programs.
PAGE 24
Page 24 VIRUS BULLETIN August 1991 ‘Disinfection’ Capability Each time an infection is discovered, a menu-box appears with four options: ‘Continue checking’, ‘Remove virus’, ‘Info on virus’ and ‘Stop checking’. Figure 2. In contrast to most scanning programs, ProScan, upon detecting a virus infection, provides cursory information about the offending culprit. .OV?, .PRG, .DAT, .BIN and .SYS extensions. (See Figure 1.) These latter extensions can be toggled on and off.
PAGE 25
August 1991 VIRUS BULLETIN Page 25 In Conclusion Postscript This product would be enhanced if the user could augment its detection capabilities with additional search patterns, such as those published by Virus Bulletin. IBM, Bates Associates and S&S (to name but a few) provide this facility - why can’t McAfee Associates? London based company International Data Security has recently been appointed UK distributor for McAfee’s shareware products. IDS does not currently market ProScan.
PAGE 26
Page 26 Virus Guard is a TSR program which can be loaded into memory either from the command line, through a batch file (AUTOEXEC.BAT for instance) or by a network login script. Virus Guard defaults to checking files that have been opened for read access, programs that are about to be executed and the boot sectors of diskettes that are accessed. Boot sector checking and files opened for read access can both be disabled at load time, through command line options.
PAGE 27
August 1991 Page 27 VIRUS BULLETIN signatures (from GUARD.DRV). This made the EMS version less intrusive than the non-EMS version which had to refer frequently to its disk-based signature file. Overhead The conventional memory-only version (Virus Guard) adds approximately 25 percent to the time taken to copy ordinary files or load and execute programs - this increases to approximately 1000 percent if Virus Guard is loaded from diskette.
PAGE 28
Page 28 VIRUS BULLETIN August 1991 END-NOTES & NEWS (IBM VIRUSES (UPDATE) Spanz - CN: Infects files in current directory and on PATH (first file found when run). Six months after all suitable files have been infected, the volume label changed to ‘INFECTED!’ if run in first second of any minute. Virus ends with text ‘* SPANZ *’. Considers files infected if seconds field set to 0,16,32 or 48. Infective length is 639 bytes.