Subject: Forwarded mail....

From: [email-masked] ("Val H. Smith")
Date: 21 Aug 1996 12:35:18 -0700

This looked legitimate enough that I felt it was worth passing on.

[email-masked]
Val H. Smith
Associate Professor
Department of Systematics and Ecology, and
Director, Environmental Studies Program
University of Kansas
Lawrence, KS 66045
913-864-4565
FAX 913-864-5321

Forwarded message text:

Have you heard anything about this virus (on NY Times today)?

          August 21, 1996

          Preparing for Thursday's Hare Virus

          By ROBERT E. CALEM 

               An extremely virulent new computer virus named after the
Hare
               Krishna religious group is expected to hit DOS- and
Microsoft
          Windows-based PC's on Thursday and again on September 22,
          according to virus experts, including producers of anti-virus
software. 

          On those dates, the experts have predicted, the Hare virus will
          automatically overwrite the hard disks of infected machines,
unless the
          virus has been removed. But before that happens, they said, the
infected
          PCs could manifest problems with infected executable files. 

          Programs designed to detect and eliminate the virus have been
available
          for several weeks, at no cost. 

          There is some disagreement among experts about how widely the
virus
          has spread. Nevertheless, the experts stress, it would be
irresponsible
          for PC owners to assume they are safe from the Hare virus --
so-called
          because it displays "Hare Krsna Hare Hare on the PC's monitor
before
          it erupts. 

          The Hare virus is generally described as among the most virulent
ever
          produced. 

          "It's an encrypted polymorphic multipartite virus," said Peter
Harrison,
          marketing manager for security products at Cheyenne Software in
          Roslyn Heights, New York. 

          That means the software has three major characteristics. "It's
          encrypted," Harrison said, "which makes it more difficult to
detect, and
          it encrypts itself as it replicates. It's polymorphic: It changes
how large it
          is by changing the pattern of digits" that compose the file in
which it is
          stored. And, he added, "It's multipartite, which means it infects
files and
          the boot sector of a PC." 

          In the old days, Harrison noted, viruses only infected files, and
to catch
          one, a user had to boot the computer from an infected diskette.
The
          Hare virus travels in files downloaded from the Internet and
attaches
          itself to any .exe or .com files that are activated after the
virus has been
          stored on a PC's hard drive. 

          The polymorphic nature of the virus makes it especially virulent,
said
          Jimmy Kuo, director of antivirus research at McAfee Associates
Inc. in
          Santa Clara, Calif. "When it infects a new machine, that is when
it
          changes. This is called 'slow polymorphism,' and that technique
          specifically antagonizes the antivirus people. It's harder for us
to find a
          new machine to infect" all the time, he said, versus running the
virus over
          and over again on the same machine to find a cure. 

          In addition, Kuo said, the Hare virus infects a PC's master boot
record,
          to do maximum damage. Kuo said it isn't clear whether the Hare
virus is
          able to spread from computer to computer through floppy
diskettes. 

          What is certain is that the Hare virus does not affect Apple
Macintosh
          computers or UNIX-based machines. The reason, said Charles
Renert,
          development manager for the Symantec Antivirus Research Center in
          Santa Monica, Calif., is the way the Hare virus functions. 

          "The nature of the virus is it infects executable code," Renert
said. "And
          the nature of how the computer understands executable code is
different
          on those three machines." This virus was designed to affect only
          executable code that can be understood by DOS- and Windows-based
          computers. 

          How many PC users will be hit by the Hare virus is less certain.
Kuo at
          McAfee estimated that only 100 to 1,000 computers will have their
          hard disk drives overwritten tomorrow because the virus, which he
          described as buggy, will have wrought problems for computer
owners
          long before -- by causing .exe files not to function properly,
prompts
          their owners to fix those files. 

          Renert at Symantec called Kuo's estimate "highly speculative,"
and
          added, "There is not enough knowledge or awareness (about the
Hare
          virus) to come up with an estimate. 

          "I don't want to ring the alarm bells and say it is that
widespread that
          everybody has been infected," Renert continued. However, he
added, "I
          want people to be aware that if they haven't considered
protecting
          themselves, then they are putting themselves at risk." 

          He added that the Hare strain is both easily spread and difficult
to
          eradicate. 

          Virus hunters said that three versions of the virus have been
distributed
          since last May, especially on the alt.sex and alt.cracks
newsgroups and
          on the shareware software-oriented newsgroup alt.comp.shareware. 

          At the shareware site, Harrison said, the virus was disguised as
the file
          PKZIP300.EXE -- a phony version 3.0 of the PKZIP utility. The
latest
          version PKZIP is only 2.0, Harrison said. 

          "The virus has been successful in its infection, for the most
part, in what
          we've witnessed here in our labs," Renert said. Though the major
          anti-virus software vendors all claim they can find and get rid
of the
          Hare, Renert said, "Few anti-virus products have a detection and
repair
          (facility) for all the strains of the virus that have appeared." 

          Cheyenne's Harrison said, "We were impressed at how well it is
written.
          It is real good at lying dormant and not doing anything until the
22d." 

          The virus's origin is also a matter for debate among the experts.
          Symantec traced its first sighting of the Hare virus to New
Zealand.
          McAfee traced its first sighting to Eastern Europe. 

          "The short story is, it is definitely very capable of overwriting
a PC's
          hard drive," Harrison said. "We'll know about the severity and
how
          widespread it is on Friday. And maybe it will be a bigger story
in
          September." 

          Detection and repair software for the Hare virus is available at:

          McAfee.com 
          Symantec Anti-Virus Research Center 
          Cheyenne Security Center