What's a "mutating signature virus"?
Larry
never in a context that provided any information about what it is or
how to prevent it (or is this an attempt at humor). I checked the FAQ
for this newsgroup to no avail. Could someone shed some light?
--
* - * - * - * - * - * - * - * - * - * - *
* Larry Johnson *
* UUCP: ...!uunet!dprmpt!larry *
* - * - * - * - * - * - * - * - * - * - *
Fridrik Skulason
>how to prevent it (or is this an attempt at humor). I checked the FAQ
>for this newsgroup to no avail.
Well, you are asking in the wrong newsgroup :-) You should ask in comp.virus.
> Could someone shed some light?
I assume it means the same as "polymorphic virus" - that is: An encrypted
virus, with a self-modifying decryption routine, so that no two instances
of the same virus look identical or have any search string in common.
(a somewhat simplified explanation, but good enough).
-frisk
Keith Warren Rickert
>la...@dprmpt.UUCP (Larry) writes:
Unless of course he means the 'Usenet signature virus',
which is just a joke that people put in their .sig's (more
often back in jan-feb-mar or so..or was it mar-april.
Keith
Pete Chown
>The subject line say it...I've seen this mentioned several times, but
>never in a context that provided any information about what it is or
>how to prevent it (or is this an attempt at humor). I checked the FAQ
>for this newsgroup to no avail. Could someone shed some light?
A mutating signature virus is a virus that gets into your system when
you read news. It hides in your .signature file, so that it gets
copied to any article you happen to post - then when people read that
article it infects their .signature file as well.
To prevent this being done to my .signature, I have created a named
pipe called .signature instead of a regular file. Clearly nothing can
be stored in a named pipe so I am safe. Then whenever I want to post
I start up a process which writes my signature into the named pipe,
and I know that I am posting with a clean signature.
In case the program which does the write gets infected, I have a cron
job which copies the program back on the first of every month,
including, of course, the first of April, April Fools Day.
--
---------------------------------------------+ "A tight hat can be stretched.
Pete Chown, pc...@phx.cam.ac.uk (Internet) | First damp the head with steam
pc...@uk.ac.cam.phx (Janet :-) -+ from a boiling kettle."
Tom J Parry
>The subject line say it...I've seen this mentioned several times, but
>never in a context that provided any information about what it is or
>how to prevent it (or is this an attempt at humor). I checked the FAQ
>for this newsgroup to no avail. Could someone shed some light?
I too have heard of these things. From my meagre knowledge, they appear to
be an unusual strain of the better known "Signature Virus". Each instance
of this virus tends to propogate to several thousand machines, and is usually
non vendor/hardware specific. They propogate using a well known hole in the
USENET News system (which I don't think I should divulge). The lifetime of
each instance of the virus varies according to the host of which it resides:
some hosts will expunge the virus in as little as 1 day, while others may take
a month or more to dispose of it.
Most signature viruses tend to appear in a widespread but little
understood code called "ASCII", and can be as little at 40 bytes long!
Most signature viruses do not contain any replication code of their own
(due to their size) unlike many other computer viruses. They rely on
another similar form to ensure their replication (this other form is
sometimes called a "post").
As for "Mutating", this generally refers to changes in the virus over time.
The normal virus propogation mechanism is usually flawless, but sometimes the
virus causes a new "Meme" to be placed into a human host (which is perhaps the
least understood part of the Signature Virus lifecycle). Often, when it leaves
a human host, the essence of the Virus remains, but the exact details change.
--
Tom J Parry.
Your reality is a figment of my imagination.
Jurgen Botz
>Larry (la...@dprmpt.UUCP) wrote:
>>[what is a mutating signature virus?]
>
>[...] They propogate using a well known hole in the
>USENET News system (which I don't think I should divulge).
This is not true! ;-) Actually, signature viruses propagate by
exploiting a rather well-known security hole in the human psyche...
the need to conform!
--
Jurgen Botz | Internet: JB...@mtholyoke.edu
Academic Systems Consultant | Bitnet: JB...@mhc.bitnet
Mount Holyoke College | Voice: (US) 413-538-2375 (daytime)
South Hadley, MA, USA | Snail Mail: J. Botz, 01075-0629
Jesse Mundis
spread of a "meme" through people who post to Usenet. This infection has
the symptoms that the poster puts phrases into her signature. Around the
end of January this year, I did a grep through our news hierarchy and found
the following list (with number of occurances) of cases. Amazing what we
keep in our directories isn't it?
34 Hi! I am a .signature virus. Copy me into your .signature to join in!
19 .signature virus v3.0. 1992 Greetings! Copy me into YOUR .signature now!
16 HI ! I'm a mutating signature virus. You cannot resist helping me spread !
14 Yes, this is the One True .signature Virus!
13 | HELLO, I'm a signature virus!
12 grep -il 'sig.*virus' $* | xargs sed -n '/^-- /,$p' | post -n alt.fan.warlord
12 Hi! I'm an anti-virus utility! Install me in your .signature right away!
11 This signature protected by SigVirusGuard 1.2 (shareware $5) =====
10 *This is the offical .signature virus for Kodak and all of its subsidiaries*
10 *** "Hi! I'm a signature virus. Copy me into your .sig to join in!" ***
9 I'm a .signature virus! Join the fun and copy me into yours!
9 HELLO! I'm a signature virus! Join in the fun and copy me into yours!
7 Signature file virus V2.2b - The Border Destroyer
7 Sig Virus 2.0: copy me backwards from how you read me | IRONPIG
7 --------- I'm a .signature virus. C'mon and copy me in your .signature.
7 -- Hi! I am a .signature virus. Copy me into your .signature to join in!
6 HI! I'm a signature virus. Copy me into yours and join the fun!
5 # Yes, this is the One True .signature Virus!
4 Ich bin ein Virus. Mach' mit und kopiere mich in Deine .signature.
4 I'm a .signature virus! Copy me into your .sig and join in the fun!
4 Hi! I am the .signature virus' evil twin, Bob. You know what to do.
4 HELLO! I'm a .signature virus! Join in and copy me into yours!
4 Copy this line into your .signature to protect it against viruses! [version -9]
4 -=-=- Virus Sigzy 2.0 has commandeered this .signature. Beware! -=-=-
4 -- Hi! I am a .signature virus. Copy me into your .signature to join in! --
4 ************************************************************(.sig virus)****
4 ** I'm a .sig virus. Attach me to your .sig! Help me spread! **
3 |i am a .sig virus |
3 signature virus 2.1d - Copy me into your .signature if you like to bowl!
3 Signature virus, maybe? ;-)
3 SIGNATURE VIRUS 3.0b, NEW AND IMPROVED -- NOW EVEN LOUDER AND MORE ANNOYING!!!!
3 Hello! I am a signature virus!
3 HELLO, I'm a signature virus! Join in the fun and copy me into yours!
3 Copy me and I will protect your .signature from viruses!
3 --------- I'm a .signature virus. C'mon and copy me into your .signature.
3 *** "Hi! I'm a signature virus. Copy me into your .sig to join in!" ***
2 | adequately be explained by a .sig virus.
2 | "Hi! I am a .signature virus. Copy me into your .signature to join in!" |
2 | cat * | egrep -v "signature virus|infection"
2 I am the signature virus vaccine! Death to signature viruses!!!
2 I am the anti-Kibo sig virus! Copy me into your .sig and then post everywhere!
2 HI, I'm a replicating signature virus! Join in the fun and copy me into yours!
2 HELLO, I'm a signature virus!
2 Greetings! Mutant .signature virus, this! Me you copy into yours also, is fun!
2 .signature virus killer v1.0lsd:
1 |> HELLO! I'm a .signature virus! Join in and copy me into yours!
1 | [ HELLO, I'm a signature virus! Join in the fun and copy me into yours! ] |
1 | *** I'm a .signature virus! ***
1 really poor .sig virus and the usual trite disclaimer, bleh, gack, ish, blif
1 never fear .signature viruses again.
1 [ HELLO, I'm a signature virus! Join in the fun and copy me into yours! ] |
1 This is not a signature virus. Do not copy this line into your .sig.
1 This is a .signature anti-virus...
1 Isn't this really a .sig virus in disguise? :-)
1 Ich bin ein .signature Virus. Mach' mit und kopiere mich in Deine .signature.
1 I'm a stealth .signature virus! Copy me into your .sig quietly!
1 Hi, I am a signature virus shield - put me in your .sig for protection
1 Hi! I'm the .signature virus and
1 Hi! I'm a .signature virus! Append me to your next article.
1 Hi! I'm a .signature virus! Add me to your .signature and join in the fun!
1 Hi! I am a .signature virus. Copy me into your .signature to join in
1 Hi! I am a .signature virus. Copy me into your .signature to join in!
1 Hi! I am a .signature virus. Copy me into your .signature file to join in!
1 Hi ! I'm a .signature virus. Join the fun and copy me into your .signature !
1 HI! I'm a signature mutating virus. You can't resist adding me to your .signfile
1 HELLO, I'm a more persuasive signature virus! Join in the fun and copy me
1 Anti-signature-virus? Use the Force, Scott!
1 :-) Signature Virus Removal Complete. :-)
1 .signature virus version 3.035...
1 .signature anti-virus utility v2.3
1 .sig Virus Killer
1 -this is a .sig virus. please copy this line into your .sig
1 -I am a .sig virus. Please copy this to your .sig and help propagate me.-
1 -- Ha! The signature virus claims another victim! Your .sig will be next!
1 - Hi! I'm an anti-virus utility! Install me in your .signature right away! -
1 "This is a subliminal .sig virus Copy Me!") I wouldn't classify
--
Jesse Mundis | Amdahl Corporation | Freedom is just chaos
je...@uts.amdahl.com | 1250 East Arques Ave M/S 316 | with better lighting.
(408) 746-4796 | Sunnyvale, CA 94088-3470 | -Alan Dean Foster
#include <Disclaimer.standard>
Pete Hardie
>To prevent this being done to my .signature, I have created a named
>pipe called .signature instead of a regular file. Clearly nothing can
>be stored in a named pipe so I am safe. Then whenever I want to post
>I start up a process which writes my signature into the named pipe,
>and I know that I am posting with a clean signature.
Ah, but I have heard of a subspecies of the MSV that searches for named pipes
called '.signature' and then lurks on them to insert a copy of its own
code into the pipe just beofre the user input!
:->
--
Pete Hardie: phardie@nastar (voice) (404) 497-0101
Digital Transmission Systems, Inc., Duluth GA
Member, DTS Dart Team | cat * | egrep -v "signature virus|infection"
Position: Goalie |
Vesselin Bontchev
> As people have already said, "mutating signature virus" refers to the
> spread of a "meme" through people who post to Usenet. This infection has
> the symptoms that the poster puts phrases into her signature. Around the
> end of January this year, I did a grep through our news hierarchy and found
> the following list (with number of occurances) of cases. Amazing what we
> keep in our directories isn't it?
You missed one encrypted .signature virus... There was one who used to
put a rot13 encoded version of this popular phrase in his signature...
:-)
Regards,
Vesselin
--
Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226 Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bont...@fbihh.informatik.uni-hamburg.de D-2000 Hamburg 54, Germany