WARNING vIRuS!

There is a new and VERY dangerous virus called the HAZ-MAT virus!
it fucks up the sectors on your hd, and really messes up the partition
tables.  It does this once a week, picking a random time to do it.  99.9% of
virus scanners and other antivirus programs will not recognize it, for it is
a totally new strain, using a never before seen code.... Be warned!  The
HAZ-MAT virus usually resides in JPG, and GIF files... once the files are
viewed, the virus takes effect.
scan all images upon download!

I doubt very seriously that this is anything more than a troll.

First off, the algorythms used to find polymorphics are sophisticated 
enough to detect newly published viruses.

Secondly, DOS/Windows et al. are not much more than boot sector viruses 
themselves. :-) Their structure is well know and there isn't any back 
door available to bang the OS from that hasn't already been exploited.

Real OS's like Unix, OS/2 etc. are also know quantities.

Binary launches are the way they do it, and the way a virus spreads, 
unless you get caught up with autoexecuting Word and Excel macros.

I have yet to see *any* truly data propogating viruses.

None the less, it is always a good idea to keep a scanner handy for 
thoses files that wander in off the Net. You never really know what 
they've been doing and who they've been doing it with. :-)

...Paul

-------------------------------------------------------------------------

"Faced with the choice between changing one's mind and proving that there
 is no need to do so, almost everybody gets busy on the proof"

                                            -- John Kenneth Galbraith

"Success is attending a funeral as a spectator"

                                            -- E. BonAnno 

-------------------------------------------------------------------------

On Sat, 31 Aug 1996, kickboxer wrote:

>         There is a new and VERY dangerous virus called the HAZ-MAT virus!
> it fucks up the sectors on your hd, and really messes up the partition
> tables.  It does this once a week, picking a random time to do it.  99.9% of
> virus scanners and other antivirus programs will not recognize it, for it is
> a totally new strain, using a never before seen code.... Be warned!  The
> HAZ-MAT virus usually resides in JPG, and GIF files... once the files are
> viewed, the virus takes effect.
> scan all images upon download!
>                                                                                
> 
>

On Sat, 31 Aug 1996, Paul S. Penrod wrote:

> Binary launches are the way they do it, and the way a virus spreads, 
> unless you get caught up with autoexecuting Word and Excel macros.
> 
> I have yet to see *any* truly data propogating viruses.

Would you count the fingerd exploit used in the Internet Worm as a data
propogating virus?  If a poorly written mail program doesn't do bounds
checking, it could conceivably allow for a Good Times-like virus.  However,
highly unlikely, since mail programs are too diverse and it would be very
doubtful that a brain-dead mail program would become very widespread.  I would
be much more worried about other non-email programs that fail to do bounds
checking (like Netscape v1.1).

-- Mark

PGP encrypted mail prefered.
Key fingerprint = d61734f2800486ae6f79bfeb70f95348
http://www.voicenet.com/~markm/

On Sat, 31 Aug 1996, Mark M. wrote:

> On Sat, 31 Aug 1996, Paul S. Penrod wrote:
> 
> > Binary launches are the way they do it, and the way a virus spreads, 
> > unless you get caught up with autoexecuting Word and Excel macros.
> > 
> > I have yet to see *any* truly data propogating viruses.
> 
> Would you count the fingerd exploit used in the Internet Worm as a data
> propogating virus?  If a poorly written mail program doesn't do bounds
> checking, it could conceivably allow for a Good Times-like virus.  However,
> highly unlikely, since mail programs are too diverse and it would be very
> doubtful that a brain-dead mail program would become very widespread.  I would
> be much more worried about other non-email programs that fail to do bounds
> checking (like Netscape v1.1).
> 
> -- Mark
> 

No, I wouldn't consider the fingerd exploit a data propogated virus in 
the same sense as data embedded in a purely passive activity (viewing an 
image file) which somehow launches a vicious nasty on your disk. However, 
you do bring up an interesting point in that example.

Netscape and programs of that ilk, IMO, yield antoher exploitable pathway 
into a system, should someone figure a method to shove a jam into the 
doorway to keep the door open long enough to allow a renegade proc to be 
started and executed outside the control of the local operator.

...Paul

On Sat, 31 Aug 1996, kickboxer wrote:

> 99.9% of
> virus scanners and other antivirus programs will not recognize it


> scan all images upon download!

duh