
       ---------------------------------------------------------------- 

                      VIRUS WARFARE: THE NOVEMBER MESSAGE 

       ---------------------------------------------------------------- 

       Interesting stories sometimes begin with a touch of horror. 
       Technological terror is so much more invigorating when the plot 
       is true and the author real.... 

       Imagine you are a computer operator at a local college on a 
       crisp November afternoon. It is Monday and you have finished 
       running a routine payroll data processing job which will print 
       employee paychecks on Friday. You decide to check messages on 
       the University computer network which links colleges and 
       Universities throughout America. At 4:15 PM the following 
       message flashes onto your screen. This message is NOT fictional. 
       The dates and people are REAL: 

       Monday, 30 November 1987   BITNET computer network - URGENT 

       FROM: Kenneth R. Van Wyk, User Services Senior Consultant, 
       Lehigh University Computing Center   (215)-758-4988 
       <LUKEN@LEHIIBM1.BITNET>  <LUKEN@VAX1.CC.LEHIGH.EDU> 
       {RISKS-FORUM Digest    Volume 5 : Issue 67} 

       Last week, some of our student consultants discovered a virus 
       program that's been spreading rapidly throughout Lehigh 
       University. I thought I'd take a few minutes and warn as many 
       of you as possible about this program since it has the chance of 
       spreading much farther than just our University.  We have no 
       idea where the virus started, but some users have told me that 
       other universities have recently had similar problems. 

       The virus: the virus itself is contained in the stack space of 
       COMMAND.COM. When a PC is booted from an infected disk, all a 
       user need do to spread the virus is to access another disk via 
       TYPE, COPY, DIR, etc.  If the other disk contains COMMAND.COM, 
       the virus code is copied to the other disk.  Then, a counter is 
       incremented on the parent.  When this counter reaches a value of 
       4, any and every disk in the PC is erased thoroughly. The boot 
       tracks are nulled, as are the FAT tables, etc.  All Norton's 
       horses couldn't put it back together again...  :-)  This affects 
       both floppy and hard disks.  Meanwhile, the four children that 
       were created go on to tell four friends, and then they tell four 
       friends, and so on, and so on. 

       Detection: while this virus appears to be very well written, the 
       author did leave behind a couple of footprints.  First, the 
       write date of the COMMAND.COM changes.  Second, if there's a 
       write protect tab on an uninfected disk, you will get a WRITE 
       PROTECT ERROR...  So, boot up from a suspected virus'd disk and 
       access a write protected disk - if an error comes up, then 
       you're sure.  Note that the length of command.com does not get 
       altered. 

       I urge anyone who comes in contact with publicly accessible 
       disks to periodically check their own disks.  Also, exercise 
       safe computing -always wear a write protect tab.  :-) 

       This is not a joke.  A large percentage of our public site disks 
       have been gonged by this virus in the last couple of days. 

       END OF MESSAGE ... 

       ---------------------------------------------------------------- 

                      COMPUTER VIRUSES: ELEGANT SOFTWARE
                             WITH A SAVAGE PURPOSE 
        
       ---------------------------------------------------------------- 

       If you followed the previous message closely you are beginning 
       to sense what a computer virus is and can do. A definition might 
       roughly describe a VIRUS as a SELF-REPLICATING computer program 
       which copies itself and attaches to one of the following areas 
       of a computer: the hard disk partition table, the DOS boot 
       sector of a hard disk or floppy or one or more executable files 
       within the system. It may also make itself resident in RAM 
       memory during computer operation. 

       Infected executable files may be operating system programs, 
       system device drivers, .COM files, .EXE files, overlay files or 
       any other file which can be loaded into memory and executed.  
       The virus activates itself at some predetermined (or randomly 
       determined) time and attempts to destroy, remove or otherwise 
       scramble data and programs. Some virus type even attempt to 
       damage computer hardware.

       A trademark of a virus is that it is SELF-REPLICATING and thus 
       clones multiple copies of itself. A virus is a computer program 
       - designed by someone - to spread identical copies of itself 
       among many computers and destroy data or programs in a specific 
       targeted manner. 

       In many ways a computer virus is quite similar to a biological 
       virus. It attacks one computer then proliferates among many 
       computers as infected floppy disks and the programs contained 
       within are shared among many computer users. The virus may lie 
       dormant for many months, or even years, all the while 
       replicating its program code to many more programs and floppy 
       disks. When an infected program is run it will in turn infect 
       other programs and disks in that same computer. Sometimes, but 
       not always, viruses interfere with printing or other routine DOS 
       operations. Many times the programmer who designed the virus 
       allows unintentional errors to exist within the virus program 
       code which can cause unexplained system crashes and other odd 
       behavior BEFORE the virus is triggered to erase or destroy data. 
       It seems even viruses are not perfect programs and can be 
       subject to programming bugs and errors just like standard 
       programs! 

       What does a virus program look like to a human operator? Simply 
       a string of highly encoded computer data bytes which by 
       themselves mean nothing to the casual observer. If you were to 
       glimpse deep inside the computer program code which makes up a 
       virus you might see something on your screen like the following 
       "machine code" listing: 

          xxxx:0110  02 00 02 3B A2 F8 29 00-11 00 04 00 11 00 80 00   
          xxxx:0120  00 00 00 00 0F 00 00 00-00 01 00 FA 33 C0 8E D0   
          xxxx:0130  BC 00 7C 16 07 BB 78 00-36 C5 37 1E 56 16 53 BF   
          xxxx:0160  13 72 67 A0 10 7C 98 F7-26 16 7C 03 06 1C 7C 03   
          xxxx:0190  A1 34 7C E8 96 00 B8 01-02 E8 AA 00 72 19 8B FB   
          xxxx:01B0  B9 0B 00 F3 A6 74 18 BE-5F 7D E8 61 00 32 E4 CD   
          xxxx:01C0  16 5E 1F 8F 04 8F 44 02-CD 19 BE A8 7D EB EB A1   
          xxxx:01D0  1C 05 33 D2 F7 36 0B 7C-FE C0 A2 31 7C A1 2C 7C   
          xxxx:0200  0C 01 06 2C 7C F7 26 0B-7C 03 D8 EB D9 8A 2E 15   
          xxxx:0210  7C 8A 16 1E 7C 8B 1E 32-7C EA 00 00 70 00 AC 0A   
          xxxx:0230  18 7C FE C2 88 16 30 7C-33 D2 F7 36 1A 7C 88 16   
          xxxx:0240  1F 7C A3 2E 7C C3 B4 02-8B 16 2E 7C B1 06 D2 E6   
          xxxx:0250  0A 36 30 7C 8B CA 86 E9-8B 16 1E 7C CD 13 C3 0D   

       Computer virus programs can be designed in assembly machine 
       code, Basic, Pascal, C and even the DOS batch file language.

       What triggers a virus to destroy data once it is embedded within 
       your computer? Depending on the person who designed the virus 
       programming code, the virus can trigger and destroy data based 
       on: 

       A date, perhaps Friday the 13th to add a cruel twist of fate. 
       The number of repetitions a certain program is run. An occurrence 
       such as printing the payroll or running Lotus 123. A lack of an 
       occurrence (removal of a name from a list.) A time of day, 
       perhaps 1 AM when an office network is running unattended. A 
       capacity, say when your hard drive reaches 90% capacity, nearly 
       full. A random time of day or random date, or both. The presence 
       of another program or removal of a program. Use of a modem or 
       your printer. A particular person's name or password. 
       
       Essentially, the programmer of the virus code selects a 
       "trigger" of some type and deliberately programs the virus to 
       wake up and "bite" when a certain condition is met! 

       One of the original viruses designed to infect the IBM PC came 
       from Pakistan where the programmers of the "Brain" virus wanted 
       to punish American software users who copied or "pirated" 
       commercial software. They did this by infecting illegal copies 
       of commercial software which they sold in their retail store in 
       Pakistan. 
       
       In 1989 a large number of viruses were reported as originating in 
       Israel. Some authorities speculate that PLO members might have 
       written virus programs for political purposes to "punish" those 
       living in Israel or America. Others speculate that those living 
       in Israel might have designed the virus programs to penetrate 
       complex computer networks in Arab countries or America to gain 
       access to sensitive government data. Rumors continue to surface 
       that perhaps the Russian KGB tried to develop a "super virus" 
       that could penetrate NATO computer systems. 

       In 1987, a European public BBS modem system was found to contain 
       a highly specialized program "toolkit" designed by a young 
       programmer. The purpose of this software toolkit was to assist 
       in designing yet better and more clever virus programs! 
       
       Private American BBS systems have been reported to exist wherein 
       virus programmers trade virus program code examples and ideas on 
       how to create "more savage" virus programs! These BBS systems 
       have confidential telephone numbers and passwords so that only 
       virus programmers can access these "virus libraries of 
       information." 

       What is the lure of programming a virus? The few programmers of 
       virus software who have been caught usually explain their act as 
       an intellectual challenge - an attempt to see how far 
       programming code can be extended. In some respects this may be 
       true. Virus programs are frequently crafted with obscure and 
       highly elegant machine code and must be self replicating, self-
       modifying and "wired" with elaborate logic and algorithmic 
       triggers. A virus must be small, fast and very stealthy. A virus 
       in many respects is programming at the cutting edge of the 
       craft, and perhaps this is the lure.

       ---------------------------------------------------------------- 

                               NOW THE BAD NEWS: 
                VIRUSES AREN'T THE ONLY TOUGH KID ON THE BLOCK! 

       ---------------------------------------------------------------- 

       Perhaps we should back up and also define several other "rogue 
       program" types which pose a security risk to your computer data. 

       A TROJAN HORSE program appears as something useful - perhaps a 
       program to sort names or print a list of telephone numbers on 
       the computer. Yet it actually does something destructive either 
       immediately or at a later time. As an example, several trojan 
       horse programs offer to display X-rated images or colorful games 
       which distract your attention to the screen long enough for the 
       program to cheerfully erase your bookkeeping data. A trojan 
       horse might (but does not usually) replicate its code to several 
       other disks. This replication feature is more distinctive of a 
       true virus. 

       A LOGIC BOMB is much like a trojan horse and may lie hidden 
       within a useful program. However when a certain point of logic 
       or data is presented to the program (e.g., the programmer's name 
       is removed from the company payroll records presumably because 
       the programmer has been fired) then the logic bomb is activated 
       to "extract revenge" by scrambling payroll records or perhaps 
       removing all occurrences of the numbers 4, 7 and 9 from any data 
       throughout company records. Insidious . . . 

       A WORM is somewhat similar to a virus. It can replicate and 
       spread throughout a computer system. When the worm program is 
       run is creates copies of itself and runs those copies. It can 
       wreak havoc on interconnected computer systems such as are found 
       within university networks or government computers. A well-known 
       worm infection occurred in the Fall off 1988 when a worm program 
       was installed on a large internet network and quickly spread 
       through hundreds of government and university UNIX type 
       computers. All of the infected computers quickly bogged down as 
       the worm created and then ran many copies of itself thus 
       demanding more and more memory and computing time from 
       legitimate programs and more necessary work tasks. 

       A word before we continue. Virus programs are not THAT common. 
       They are real, but have been vastly over-reported in the popular 
       press. They seem to be more common within university communities 
       where youthful students might be tempted to "test" their 
       programming skills by creating virus programs. Commercial 
       software has OCCASIONALLY been infected, but for practical 
       purposes, commercial programs purchased from retail sources and 
       packed in original factory boxes are low probability sources of 
       viruses. 

       Public domain and shareware sources of software as well as 
       BBS/modem sources are sometimes suspected of virus infection, 
       but most reputable shareware distributors and BBS systems report 
       low computer virus incidence. 
       
       Indeed, the shareware and public domain software community is 
       more rigorous in routine testing for virus infections than the 
       commercial software development houses. Computer virus programs 
       DO exist, but they are quickly caught and erradicated from most 
       BBS systems and shareware sources. Your chance of computer virus 
       infection is probably on the order of 2% probability, but 
       knowledge and foresight are a wise investment in computer and 
       data security! 
       
       Published lists of virus programs detail unique virus names and 
       characteristics. One of the better virus lists is the shareware 
       software program DIRTY DOZEN which is available from most 
       computer clubs and many BBS systems. Some examples of virus 
       programs which have been identified include: 

                                   ICELANDIC        
                                   PENTAGON         
                                 DARK AVENGER     
                                    SYSLOCK          
                               DISK KILLER/OGRE 
                                   ZERO BUG         
                                    VACSINA          
                                   DATACRIME        
                                   TRACEBACK        

       What can you do to protect your computer data?
       
       Make frequent backups of data you consider essential. To "backup"
       means to routinely copy important files from your hard drive to 
       floppies or other portable magnetic media. Weekly file backup is 
       a minimum. Daily is not unreasonable. Consider rotating between 
       two or three sets of backups (use backup floppy set #1, then set 
       #2 then set #3 - then back to set #1 and so on). 
       
       Limit the exchange of data disks within your workplace unless 
       necessary - especially if those disks contain EXE or COM files. 
       Always write protect all floppies unless they are data disks 
       which must be updated routinely. 

       If you find a file on a public BBS system interesting, leave it 
       there for a month and wait to see if other users report problems 
       with the program. This pessimistic outlook may save considerable 
       hard disk data. Other common sense suggestions for preventing 
       virus outbreaks include the following: 

       Avoid sharing commercial software and making copies for others. 
       It is a violation of the author's copyright to copy commercial 
       software, in any event. Always obtain public domain and 
       shareware software from reliable sources such as large BBS 
       systems - Compuserve and PC MagNet are relatively reliable as 
       are large shareware distributors such as PC SIG and Public Brand 
       Software who obtain their copies directly from the author via US 
       mail. 

       If possible, use one of the many virus checking programs on the 
       market to test public domain and shareware software prior to 
       installation on your system. Test ALL of your system's files - 
       perhaps at the same time as you perform routine backups - as a 
       monthly or weekly routine. The first time you start a suspected 
       public domain/shareware program run it from a floppy disk and 
       not your hard drive. 
       
       Always write protect your floppies if possible. 

       Use one of the available "vaccination programs" which continuously 
       monitor your system for unauthorized or otherwise unexpected data 
       transfers. These programs monitor your hard disk and memory for 
       activity not usually normal under DOS operations. If you do 
       detect a virus program, consider that both your hard disk and 
       your backup copies are probably infected. Keep original 
       application disks from the manufacturer safely tucked away and 
       protected by write protect tabs so they cannot be infected.
              
       Never start a hard disk-equipped computer from a floppy disk 
       except the ORIGINAL DOS disk which is WRITE PROTECTED with a tab 
       in place. No exceptions! 

       Curiously, 90% of those infected with a virus or trojan horse 
       program are reinfected within a month! This attests to 
       widespread sharing of data disks and poor data work habits. 
       
       Don't always assume a computer problem is virus related. Most of 
       the time it is related to improper equipment use. Carefully 
       scrutinize file directories on your disk(s) for date or file 
       size changes. Viruses are fond of adding their code to the files 
       COMMAND.COM, IBMBIO.COM, or IBMSYS.COM. Perhaps jot down or 
       print out known file sizes and dates of creation and check for 
       any changes which may appear since you first installed that file 
       on your disk. 

       Both commercial and shareware/public domain software programs 
       exist whose purpose is to detect and repair damage caused by 
       virus software:

    Software Program          Purpose and method of action
     ------------------------------------------------------------------

    Viruscan &           From McAfee Associates  telephone (408) 988-3832.
    Clean                Available from most BBS's, computer clubs, this
                         is an exceptional program, updated frequently.
                         Scans drives and RAM memory for virus presence.
                         The program is proactive: is searches for exact
                         virus "flags" rather than waiting for a virus to
                         hit. Program is self-testing to make sure that
                         it has not itself been infected! The scan 
                         program searches for the virus, the clean 
                         program attempts to remove it.
       
     F-Prot              From Fridrik Skulason, Reykjavik, Iceland. 
                         Available from most BBS systems and shareware 
                         vendors. Reliable and inexpensive virus utility. 
                         Has scored higher on some tests than McAfee's 
                         Virus Scan program.

     VIRX                Runs faster than Viruscan and detects and 
                         deletes many of the same viruses. From 
                         Microcom, Inc. POB 51816, Durham, NC 27717.

     Dirty Dozen         Detailed list of virus and trojan horse programs
                         which is available from most computer clubs or
                         shareware distributors. Interesting reading.
                  
    Dr. Solomon's        A commercial virus detection and removal 
    Toolkit              utility. Performs well. (800) 872-2599

    AntiVirus            From Central Point Software. Another highly
                         regarded commercial virus detection and removal 
                         utility. (800) 445-2110

    PC Magazine          Checks and verifies your files and allows
    PCDATA               continuous testing prior to virus infection.
                         Free from computer clubs, shareware outlets, 
                         BBS's. See February 13, 1990 edition, PC 
                         Magazine. Cleverly provides backup for 
                         crucial data and makes unique "fingerprint" 
                         of sensitive files.

    DBack                Backup FAT Tables, similar capability in PCDATA.
                  
    PC-Tools Deluxe      Repairs damage to file allocation table and 
                         damaged files

    Mace+                Repairs damage to file allocation table and 
    Utilities            damaged files               
        

    Norton Utilities     Repairs damage to file allocation table and 
                         damaged files               

       ---------------------------------------------------------------- 

                  WHAT NEXT? - WHAT TO DO WHEN A VIRUS BITES 

       ---------------------------------------------------------------- 

       The cat is out of the bag and you are pretty sure - that sinking 
       feeling - that a virus is in your computer. What next? If you 
       don't want to try to unravel the mess yourself, try calling 
       McAfee Associates at the telephone number listed above. They can 
       send you a diagnosis program (VIRUSCAN) and virus removal 
       program - also available from most computer clubs and shareware 
       vendors. 

       In the case of boot sector infestations, power down your system 
       then restart from an uninfected write-protected ORIGINAL COPY 
       DOS disk. Execute the DOS SYS command to attempt to overwrite 
       the boot sector with new startup files. This will work in most 
       cases. If it does not work, backup all data files which are 
       essential (and maybe infected) then perform a low level format 
       of the hard disk or a normal format if it is an infected floppy 
       disk. Do likewise for ALL floppies which may have come into 
       contact with the virus. When you are done, use VIRUSCAN to check 
       for the presence of continuing virus infestation. 

       If an EXE or COM file has been infected, power down the system, 
       reboot from the factory WRITE PROTECTED DOS disk, delete all 
       infected COM and EXE files then replace them with the original 
       files from the WRITE PROTECTED, factory original program disks. 
       Run any virus detection utility again to check for absence of 
       the virus.

       For a disk partition table infection the only option short of a 
       removal utility is to low level format the disk. And with that 
       action destroy not only the virus but also your data. Better 
       hope you have backup data on a floppy disk! 

       After disinfecting a hard disk, you MUST test and probably
       reformat EVERY floppy that came into contact with the infected 
       computer. If you are reinstalling a backup copy, do not restore 
       it unless it was made BEFORE the system became infected. Run 
       a virus testing utility to be sure. 

       For additional help, consider contacting the National Computer 
       Security Association at 717/258-1816 or McAfee Associates  
       at 408/988-3832.

       Tutorial finished. Be sure to order your FOUR BONUS DISKS which 
       expand this software package with vital tools, updates and 
       additional tutorial material for laptop users! Send $20.00 to 
       Seattle Scientific Photography, Department LAP, PO Box 1506, 
       Mercer Island, WA 98040. Bonus disks shipped promptly! Some 
       portions of this software package use sections from the larger 
       PC-Learn tutorial system which you will also receive with your 
       order. Modifications, custom program versions, site and LAN 
       licenses of this package for business or corporate use are 
       possible, contact the author. This software is shareware - an 
       honor system which means TRY BEFORE YOU BUY. Press escape key to 
       return to menu. 
       
 

