Re: Maslin archive "virus"? (Was: Reasonable price for a complete SOL-20 system?

[william degnan]

On Oct 23, 2016 1:13 AM, "Fred Cisin"  wrote:
>
> On Sat, 22 Oct 2016, Eric Christopherson wrote:
>>
>> Where is this image? I found what I think is the Maslin archive at
>> http://www.retroarchive.org/maslin/ but I don't see any Sharp stuff
>> there.
>
>
>
> http://www.vcfed.org/forum/archive/index.php/t-34683.html
> includes a post:
>
> MasawVx
> July 30th, 2014, 08:59 PM
> beware!!!
> there are 3 viruses detected on the archive. i scanned it using f-prot
windows.
> [Found virus] 
C:\AARDVARK_Tape_Backups\25jul96\sydex\dos\pc-7000.td0->(TeleDisk)
> [Found virus] 
C:\AARDVARK_Tape_Backups\maslin_c_d_10apr97\ddrive
\sydex\dos\pc-7000.td0->(TeleDisk)
> [Found virus] 
C:\AARDVARK_Tape_Backups\maslin_c_d_3oct95\ddrive\
sydex\dos\pc-7000.td0->(TeleDisk)
>
>

Yup that was me.  It would be easy enough for anyone with this archive to
locate the above referenced files and clean them out.

I don't have the cleaned Maslin archive on my site but I could post.  I
think I took it down after a while.  Don't remember.  My site is not geared
to be an all inclusive archive for things like that.

Bill Degnan
twitter: billdeg
vintagecomputer.net

Re: Maslin archive "virus"? (Was: Reasonable price for a complete SOL-20 system?

[Fred Cisin]

On Sat, 22 Oct 2016, Eric Christopherson wrote:

Where is this image? I found what I think is the Maslin archive at
http://www.retroarchive.org/maslin/ but I don't see any Sharp stuff
there.



http://www.vcfed.org/forum/archive/index.php/t-34683.html
includes a post:

MasawVx
July 30th, 2014, 08:59 PM
beware!!!
there are 3 viruses detected on the archive. i scanned it using f-prot 
windows.
[Found virus]  
C:\AARDVARK_Tape_Backups\25jul96\sydex\dos\pc-7000.td0->(TeleDisk)
[Found virus]  
C:\AARDVARK_Tape_Backups\maslin_c_d_10apr97\ddrive 
\sydex\dos\pc-7000.td0->(TeleDisk)
[Found virus]  
C:\AARDVARK_Tape_Backups\maslin_c_d_3oct95\ddrive\ 
sydex\dos\pc-7000.td0->(TeleDisk)

Re: Maslin archive "virus"? (Was: Reasonable price for a complete SOL-20 system?

[Eric Christopherson]

On Thu, Oct 20, 2016, Fred Cisin wrote:
> > On Wed, 19 Oct 2016, Sam O'nella wrote:
> > > Does that archive on classiccmp.org have the infected images removed or
> > > cleaned? (Just curious as I remember this came up in a couple other forums
> > > that I think one or two of the images did have a virus).
> > 
> > an 8080/Z80 compatible CP/M virus???
> > Or are you talking about a virus in some sort of MS-DOS image?
> > Or an MS-DOS boot sector virus that wrote itself onto the "boot sector"
> > of a non-MS-DOS format?
> 
> OK, answering my own query, I did a trivial amount of GOOGLEing, and found
> discussion that said that "Stoned" was found in TD0 images of PC-7000 MS-DOS
> 2.11.

Where is this image? I found what I think is the Maslin archive at
http://www.retroarchive.org/maslin/ but I don't see any Sharp stuff
there.

-- 
Eric Christopherson

Re: Maslin archive "virus"? (Was: Reasonable price for a complete SOL-20 system?

[william degnan]

Yes, I discovered the virus years ago.  I thought I posted a cleaned
version somewhere is not on my site somewhere.

Bill Degnan
twitter: billdeg
vintagecomputer.net
On Oct 20, 2016 8:17 PM, "Fred Cisin"  wrote:

> On Wed, 19 Oct 2016, Sam O'nella wrote:
>>
>>> Does that archive on classiccmp.org have the infected images removed or
>>> cleaned? (Just curious as I remember this came up in a couple other
>>> forums
>>> that I think one or two of the images did have a virus).
>>>
>>
>> an 8080/Z80 compatible CP/M virus???
>> Or are you talking about a virus in some sort of MS-DOS image?
>> Or an MS-DOS boot sector virus that wrote itself onto the "boot sector"
>> of a non-MS-DOS format?
>>
>
> OK, answering my own query, I did a trivial amount of GOOGLEing, and found
> discussion that said that "Stoned" was found in TD0 images of PC-7000
> MS-DOS 2.11.
>
> That is an EXTREMELY common MS-DOS boot sector virus.  And was apparently
> in an image of an MS-DOS disk.  However, some "anti-virus" software would
> not find it, since it might ONLY look in the boot sector for that virus,
> not within an archive image.
> Many other "anti-virus" software will get a lot of false positives, since
> it is only looking for a short "signature" - meaning that the staff in the
> anti-virus company extracts a short sequence from an infected disk, and
> then triggers whenever it encounters that particular sequence of bytes.
>
> Are they skilled enough to extract a significant "signature" that would
> only occur in that virus, or do they grab a random sequence within the
> infected disk?
>
>
> In any case, it is NOT likely to be a problem for any sort of Cromemco
> disk.  And the discussion that GOOGLE turned up was specifically referring
> to MS-DOS 2.11 of PC-7000.
> Do NOT boot an 80x86 machine from one of those images.
> BTW, ANY versions of MS-DOS 2.11 or 3.31 should be saved!  Even if it
> means manually "disinfecting".  Those were the most customized versions of
> MS-DOS, and included 3.5" disk formats that were not PC-DOS compatible,
> special versions of MODE.COM (for non-80x25 screens, and laptop
> externals), etc.
>
>
> --
> Grumpy Ol' Fred ci...@xenosoft.com
>

Maslin archive "virus"? (Was: Reasonable price for a complete SOL-20 system?

[Fred Cisin]

On Wed, 19 Oct 2016, Sam O'nella wrote:

Does that archive on classiccmp.org have the infected images removed or
cleaned? (Just curious as I remember this came up in a couple other forums
that I think one or two of the images did have a virus).


an 8080/Z80 compatible CP/M virus???
Or are you talking about a virus in some sort of MS-DOS image?
Or an MS-DOS boot sector virus that wrote itself onto the "boot sector" of a 
non-MS-DOS format?


OK, answering my own query, I did a trivial amount of GOOGLEing, and found 
discussion that said that "Stoned" was found in TD0 images of PC-7000 
MS-DOS 2.11.


That is an EXTREMELY common MS-DOS boot sector virus.  And was apparently 
in an image of an MS-DOS disk.  However, some "anti-virus" software would 
not find it, since it might ONLY look in the boot sector for that virus, 
not within an archive image.
Many other "anti-virus" software will get a lot of false positives, since 
it is only looking for a short "signature" - meaning that the staff in the 
anti-virus company extracts a short sequence from an infected disk, and 
then triggers whenever it encounters that particular sequence of bytes.


Are they skilled enough to extract a significant "signature" that would 
only occur in that virus, or do they grab a random sequence within the 
infected disk?



In any case, it is NOT likely to be a problem for any sort of Cromemco 
disk.  And the discussion that GOOGLE turned up was specifically referring 
to MS-DOS 2.11 of PC-7000.

Do NOT boot an 80x86 machine from one of those images.
BTW, ANY versions of MS-DOS 2.11 or 3.31 should be saved!  Even if it 
means manually "disinfecting".  Those were the most customized versions of 
MS-DOS, and included 3.5" disk formats that were not PC-DOS compatible, 
special versions of MODE.COM (for non-80x25 screens, and laptop 
externals), etc.



--
Grumpy Ol' Fred ci...@xenosoft.com