Home of the original IBM PC emulator for browsers.
[PCjs Machine "ibm5170"]
Waiting for machine "ibm5170" to load....
Disk No: 2749 Disk Title: ShareDebate International #5 PC-SIG Version: S1 Program Title: ShareDebate International #5 Author Version: 4/91 Author Registration: Multiple Registraion plans form $5 and up. Special Requirements: 384K RAM. Issue 5's Headlines: ShareDebate International's first double-disk issue Featuring 11 popular authors including Jerry Pournelle & the League for Programming Freedom! Also, ShareDebate has gone Semi-Annual to half subscription costs! Spring/Summer 1991 (Issue #5 & #6) ShareDebate International, a ShareWare disk magazine, formerly a quarterly, is now semi-annual starting with this double-disk issue (#5 & 6). It is a debate forum for computer users concerned about the present & future carried by 544 to 1,444 BBSs or Shareware Dealers. Debates & Articles in This Double Disk Issue Prior to this issue there were 19 debate topics (named in issue #4). Five new debate topics have been added. Three are related to the Gulf War and the Palestinian problem. One is a catch-all topic, which is used by Sysop-Attorney Paula Goldman in her coverage of recent FCC actions that impact the computer industry. The other topic covers intellectual property law and programming freedom. Four position papers of the League for Programming Freeedom, including one written for ShareDebate International, kick off this debate. Benston and Kaufman review the history of S&Ls. Bova writes about freedom of information over the satellite waves. General Graham writes on the political limitations imposed on the Patriot. The 28 Americans killed by the Scud missile didn't need to die. Pournelle discusses how government hurts progress. Smith assesses the National Interest Project level Stock market proposal. Schulman's Prometheus- winning novel, Alongside Night, is excerpted (7 chapters). Martin writes on the Gulf War and viruses. McAfee Associates' latest version of its virus detector is included, SCAN76-C. PC-SIG 1030D East Duane Avenue Sunnyvale Ca. 94086 (408) 730-9291 (c) Copyright 1991 PC-SIG, Inc.
McAFEE ASSOCIATES AGENT LISTING APRIL 8, 1991 McAfee Associates (408) 988-3832 office 4423 Cheeney Street (408) 970-9727 fax Santa Clara, California 95054 (408) 988-4004 BBS 2400 bps U.S.A. (408) 988-5138 BBS HST 9600 (408) 988-5190 BBS v32 9600 In order to provide the global community with anti-virus coverage in a timely manner, McAfee Associates has established an Agents program in place to provide service, sales and support for McAfee Associates products around the world. If you do not see your country listed, please contact McAfee Associates directly. A listing of North American Agents has been added to the end of this file. ASIA Acer Sertek Inc. Address: 135 Sec. 2 Chien Kuo N. Road Taipei 10479, Taiwan, ROC Contact: Jack Hwang Telephone: +886 (02) 501-0055 Fax: +886 (02) 501-2521 AUSTRALIA Computer Virus Clinic Address: P.O. Box 106 Moorebank, N.S.W. 2170 Contact: Colin Keeble Telephone: +61 (02) 822-4303 Fax: +61 (02) 822-4304 AUSTRALIA Computerware for Micros Address: 23 Magill Road Stepney, Adelaide, S.A. 5096 Contact: Priestly Hillam Telephone: +61 (08) 362-8200 Fax: +61 (08) 363-1974 BBS: +61 (08) 363-4293 AUSTRALIA Doctor Disk (Sydney Office) Address: 64 Kippax Street Surrey Hills, NSW 2010 Contact: Robin Edwards Telephone: +61 (09) 328-2011 +61 (02) 281-2099 Fax: +61 (09) 328-9661 +61 (02) 281-9740 Toll-Free: (008) 999 755 (outside of Perth Metro Area) AUSTRIA Terramar Handelsges m.b.H. Address: Nikolsdorfergaße 8/8 A-1050 Wien Contact: Ronald Schmutzer Telephone: +43 (1) 543-731 Fax: +43 (1) 543-339 BELGIUM Impakt nv Address: Ham 64 B-9000 Gent Contact: Frank Lateur Telephone: +32 (91) 25 35 49 Fax: +32 (91) 33 00 78 BELGIUM Software Distributors Address: Dynamicalaan 16 B-2601 Wilrijk Contact: Arthur Schrey Telephone: +32 (3) 830 59 92 Fax: +32 (3) 830 25 92 BRAZIL COMPUSUL Consultoria e Comercio de Informatica Ltda. Address: Rua Emboabas, 68-1o andar 04623-Sao Paulo, SP Contact: Andre Pitrowski Telephone: +55 (11) 533-7331 Fax: +55 (11) 530-6114 BRAZIL Maple Informatica Ltda. Address: R. Maranhao, 554 cj. 26 01240 Sao Paulo, SP Contact: David Rotenberg Telephone: +55 (11) 825-9390 Fax: +55 (11) 826-5375 BRAZIL NUPEC Ltda Address: Rua do Hospicio 981/172 - Boa Vista CEP 50,060 Recife-PE Contact: Anatolio de Paula Crespo Telephone: +55 (81) 222-0698 Fax: +55 (81) 222-0698 CANADA Concise Systems Corp. Address: #25 - 1925 Bowen Road Nanaimo, BC CANADA V9S 1H1 Contact: Jeff Martin Telephone: (604) 756-1604 Fax: (604) 756-0123 CANADA Dolfin Development Address: 709 Eaglemount Crescent Mississauga, Ontario CANADA L5C 1N8 Contact: Mike Cameron Telephone: (416) 896-7731 Fax: (416) 896-1458 CANADA Programmers Guild Products Address: 4652 - 99th Street Edmonton, Alberta CANADA T6E 5H5 Contact: George Woycenko Telephone: (403) 438-5897 Fax: (403) 434-3957 CANADA Schultz Computers Address: 1825 Woodward Drive Ottawa, Ontario CANADA K2C 0R4 Contact: John Schultz Telephone: (613) 727-0589 Fax: (613) 727-1264 CHILE Rigg S.A. Address: Avda. Salvador 1068 P.O. Box 10.295 Santiago Contact: Ricardo Gutierrez Telephone: +56 (2) 225-0222 Fax: +56 (2) 225-0240 FINLAND Nokia Data Systems Address: P.O. Box 458 SF-00101 Helsinki Contact: Kari Ilonen Telephone: +358 (0) 567 4168 Fax: +358 (0) 567 4160 FINLAND SAFECO OY Address: Kirvuntie 22 02140 Espoo Contact: Hannu Ohrling Telephone: +358 (0) 512 1100 Fax: +358 (0) 515 151 FRANCE VIF Micro Address 12 Avenue des Andes 91940 Les Ulis CEDEX Contact: Patrick Le Granche Telephone: +33 (1) 69-07-8632 Fax: +33 (1) 64-46-6831 GERMANY BFK edv-consulting GmbH Address: Gerwigstraße 48 W-7500 Karlsruhe 1 Contact: Christoph Fischer Telephone +49 (7) 2161-1519 Fax: +49 (7) 2162-1479 GERMANY Die Deutsche Software Bibliothek Alpenstraße 52 8038 Grobenzell Contact: Nane Jurgensen Telephone: +49 (8) 1425-3030 Fax: +49 (8) 1425-4641 GERMANY Kirschbaum Software, GmbH Address: Kronau 15 W 8091 Emmering b. Wbg. Contact: Josef Kirschbaum Telephone: +49 (0) 8067-1016 Fax: +49 (0) 8067-1053 GERMANY K.H. Kitroschat, Ingenieurbuero für Neue Technik Address: Naabstraße 9 W-4006 Erkrath Contact: Karl-Heinz Kitroschat Telephone: +49 (02) 1044-8626 Fax: +49 (02) 1044-8626 GERMANY R. Bucker EDV Address Nordhemmer Straße 94 W 4955 Hille 1 Contact: Peter Bucker Telephone: +49 (0) 5703-3669 Fax: +49 (0) 5703-3648 GERMANY NoVIR Address: Schursdorfer Weg 10 2409 Scharbeutz 2 Contact: Peter Bohm Telephone: +49 (0) 4524-1776 Fax: +49 (0) 4524-1419 HONG KONG The Software Tree Limited Address: Block E 15/F Golden Bear Industrial Centre 62-84 Chaiwan Kok Street Tsuen Wan N.T. Contact: Isabel Chan Telephone: +852 (0) 414-4241 Fax: +852 (0) 413-6078 HUNGARY TOPSOFT Software House Address: VEND u.3 H-1025 Budapest Contact: Maria Pistar Telephone: +36 (1) 135-52-10 Fax: +36 (1) 115-65-16 INDIA LAN ESEDA Computer Training Centres Address: 2nd Floor Ramanashree Arcade 18 M.G. Road (Opposite Taj Residency) Bangalore 560001 Contact: M.V. Kotappa Telephone: +91 812 544306 Fax: +91 224 925508 INDONESIA P.T. Yakin Aman Address: #15-16, Block FX-1 Jalan Kelapa Gading Boulevard Jakarta 14240 Contact: M.A. Sunadi Telephone: +62 (21) 451-0072 Fax: +62 (21) 451-2731 IRELAND Systemhouse Technology Group Ltd Address: 39-40 Upper Mount Street Dublin 2 Contact: Dermot Williams or Stephen Kearon Telephone: +353 (1) 283-1922 Fax: +353 (1) 288-6224 BBS: +353 (1) 288-5634 +353 (1) 283-1908 HST ITALY Ultimobyte Editrice, SRL Address: Via A. Manuzio, 15 20124 Milano Contact: Adalberto Fontana Telephone: +39 (2) 655-5306 Fax: +39 (2) 659-7693 JAMAICA W.T.G Systems Ltd. Address: "The Towers" 25 Dominca Drive Kingston 5 Contact: Robert Davies Telephone: (809) 929-9250 Fax: (809) 929-8296 MALAYSIA MCSB Systems (M) Sdn Bhd Address: 17th Floor Menara Bousted Jalan Raja Chulan 50200 Kuala Lumpur Contact: Mr. M.F. Leong Telephone: +60 (3) 241 7400 Fax: +60 (3) 248 8010 MEXICO Mundo PC, S.A. Address: Rio San Lorenzo No. 507-A OTE Garza Garcia N.L. 66220 Contact: Roberto Herrera Telephone: +52 (8) 378-34-48 Fax: +52 (8) 378-34-40 NEW ZEALAND Computer Software Library of NZ, Ltd. Address: R.D. 3 Timaru Contact: Bill Strauss Telephone: +63 (3) 615-9333 Fax: +63 (3) 615-9333 NETHERLAND ANTILLES Micro Computer Consultants Address: Fokkerweg 30 Muskus Building Willemstad Curaco Contact: Edison Maduro Telephone: +599 (9) 61 31 61 Fax: +599 (9) 61 61 19 PORTUGAL Fobis, Informatic e Gestao, Lda. Address: Praca de Londres 3-1.Dt P-1000 Lisboa Contact: Luis Dias Telephone: +351 (1) 848 31 84 Fax: +351 (1) 715 11 11 SAUDI ARABIA Gulf Stars Computer Systems Address: Suite #201/202, Al Banafaea Building Riyadh 11573 Contact: Anwah Qahwash Telephone: +966 (1) 463-1098 Fax: +966 (1) 465-3156 SPAIN DATAMON, SA Address: Corcega, 485 08025 Barcelona Contact: Carmen Navarro Telephone: +34 (3) 207-2704 Fax: +34 (3) 257-1370 SWEDEN Virus Help Center Address: Box 1237 S 801 37 Gävle, Sweden Contact: Mikael Larsson Telephone: +46 (26) 100518 Fax: +46 (26) 275720 BBS: +46 (26) 275710 SWITZERLAND Computer Concepts AG Address: Postfach 104 CH-8606 Naenikon Contact: Marcus Laubli Telephone: +41 (1) 941-6229 Fax: +41 (1) 941-6229 UNITED ARAB EMIRATES Al Bawardi Computers Address: Flat 301, Third Floor, Grandstore Building Hamdan Street, P.O. Box 4118 Abu Dhabi Contact: Syed Rehan Aziz Telephone: +971 (2) 721777 Fax: +971 (2) 727357 UNITED KINGDOM International Data Security Address: 37/41 Gower Street London WC1E 6HH Contact: Grace Fodor Telephone: +44 (71) 631 0548 Fax: +44 (71) 580 1466 ZAMBIA KBM Software Plaza Address: P.O. Box 320139 Woodlands Lusaka Contact: (Ms.) Kasonde B. Mwila Telephone: +260 (1) ? Fax: +260 (1) 210400 UNITED STATES AMI Data Systems Address: 2778 Shasta Road Berkeley, CA 94708 Contact: John Mace Telephone: (415) 843-3204 Fax: (415) 843-3204 UNITED STATES Blue Chip Computer Company Address: 3085 Woodman Drive Dayton, OH 45420 Contact: Larry Song Telephone: (513) 299-4594 Fax: (513) 298-5798 UNITED STATES CDT, Inc. Address: 3110 Rhapsody Court Colorado Springs, CO 80920 Telephone: (719) 260-0567 Fax: (719) 531-5256 UNITED STATES Computer Security Plus, Inc. Address: 200 East Robinson St., Suite 890 Orlando, FL 32801 Contact: Padgett Peterson Telephone: (407) 648-0709 Fax: (407) 648-0733 UNITED STATES Jetics Inc. Address: 8229 Boone Blvd. Suite 860 Vienna, VA 22182 Contact: Wayne Carpenter Telephone: (703) 893-4404 Fax: (703) 821-0710 UNITED STATES Jim's Consulting Services Address: 24 Frank Lloyd Wright Drive Ann Arbor, MI 48106 Contact: Jim Shaeffer Telephone: (313) 930-5838 Fax: (313) 429-1963 UNITED STATES Microplus Systems Technologies Address: 1020 East El Camino Real Sunnyvale, CA 94087 Contact: Ralph Manildi or Bui Han Telephone: (408) 737-2525 Fax: (408) 737-2402 UNITED STATES MSB Computing Environments Address: 626 Walnut Street, Suite 207 San Carlos, CA 94070 Contact: Fritz Schneider Telephone: (415) 637-0119 Fax: (408) 739-3204 Internet: email@example.com UNITED STATES NetLAN Address: 29 West 38th Street New York, NY 10018 Contact: Al Berg Telephone: (212) 768-2273 Fax: (212) 768-2201 UNITED STATES OverFlow Corporation Address: 5200 SW Macadam, Suite 320 Portland, OR 97201 Contact: Dean Warren Telephone: (503) 228-7838 Fax: (503) 228-7908 UNITED STATES Standard Systems Solutions, Inc. Address: 410 West Commercial Street East Rochester, NY 14445 Contact: Steve Smith Telephone: (716) 586-2460 Fax: (716) 586-0936 UNITED STATES TIEX Computer/Communications Products Address: 13748 Neutron Road Dallas, TX 75244 Contact: Bill Geiser Telephone: (214) 392-0647 Fax: (214) 385-072 UNITED STATES VacciVirus Address: 84 Hammond Street Waltham, MA 02154 Contact: Roger Aucoin Telephone: (617) 893-8282 Fax: (617) 969-0385
USE OF McAFEE ASSOCIATES PROGRAMS The McAfee Associates VIRUSCAN series is distributed as shareware for home use, but must be licensed for use within a business, corporation, or organization. This includes educational institutions and government agencies. If you have or suspect computer virus infection, you are allowed to use the software for five (5) days free of charge to isolate and remove the computer virus or suspect computer virus. We will provide you with assistance if requested. If you are a shareware distributor, you may distribute all software listed below in the registration form as long as you contact McAfee Associates for permission first. You must distribute the all the files intact and in unmodified form (duplicate files may be removed) and may not charge more than a reasonable disk copying fee. You must obtain updates from our BBS at the number below. If you are a System Operator and run a publically-accessable BBS for which their is no fee for use then you may use the software free of charge--that's our way of saying thanks. REGISTRATION FOR McAFEE ASSOCIATES PROGRAMS Registration is required for the use of the VIRUSCAN, SHIELD and CLEAN-UP program series in a home environment. This form should be used to register a program. Registered users of the VIRUSCAN programs receive free technical support and assistance with virus infections in the form of walk-throughs of virus removal. The nine line McAfee Associates Bulletin Board (mail box) is available to access to the latest versions of the VIRUSCAN series and for downloads of virus-related information. Registered users obtain free upgrades for their registered programs for a period of one year after registration, provided they are downloaded from the BBS. Diskettes are not mailed to registered users unless specifically requested. Diskettes are mailed first class in the U.S. and by airmail for foreign countries. For such mailings, please add $9.00US. Only one mailing will be made to registered users. Corporate, business and organizational users require a site license for the use of the VIRUSCAN programs. For site license information please contact McAfee Associates at the address or phone number below. ==CUT HERE===============================================CUT HERE== REGISTRATION FORM For Individual Home Users PROGRAM: # COPIES: AMOUNT: CLEAN-UP ($35 per copy) _________ $______________ VIRUSCAN ($25 per copy) _________ $______________ VSHIELD ($25 per copy) _________ $______________ SENTRY ($25 per copy) _________ $______________ FSHIELD ($25 per copy) _________ $______________ VCOPY ($15 per copy) _________ $______________ - ADD - $9 for Diskette (5.25" 360K only) $______________ (All programs and documentation fit on one diskette) TOTAL $______________ PAYMENT BY: Check/Money Order No.__________ enclosed for $____________________ OR CHARGE: MasterCard ______ Visa ______ Card Number_______________________________________________________ Name on Card______________________________________________________ Exp. Date_________________________________________________________ Signature_________________________________________________________ MAILING ADDRESS: NAME______________________________________________________________ ADDRESS LINE 1____________________________________________________ ADDRESS LINE 2____________________________________________________ CITY/STATE/PROVINCE_______________________________________________ COUNTRY/POSTAL CODE_______________________________________________ HOME PHONE________________________________________________________ OFFICE PHONE______________________________________________________ SEND TO: +----------------------------+ McAfee Associates | OR SEND TO ANY OF THE | 4423 Cheeney Street | THE AUTHORIZED AGENTS | Santa Clara, California | LISTED IN THE ACCOMPANYING | 95054-0253 USA | AGENTS.TXT FILE. | +----------------------------+ (408) 988-3832 Voice - Use this # for questions/bug reports (408) 988-4004 BBS - Use this # for obtaining program upgrades (408) 988-5138 BBS US Robotics HST 9600 (HST) (408) 988-5190 BBS US Robotics HST 9600 Dual Standard (HST/v.32) (408) 970-9727 FAX ==CUT HERE===============================================CUT HERE==
VIRUSCAN Version 7.2C76 Copyright (C) 1989, 1990, 1991 by McAfee Associates. All rights reserved. Documentation by Aryeh Goretsky. McAfee Associates (408) 988-3832 office 4423 Cheeney Street (408) 970-9727 fax Santa Clara, CA 95054-0253 (408) 988-4004 BBS 2400 bps U.S.A. (408) 988-5138 BBS HST 9600 (408) 988-5190 BBS v32 9600 TABLE OF CONTENTS: SYNOPSIS . . . . . . . . . . . . . . . . . . . . . . . . . . .2 - What VIRUSCAN is, system requirements AUTHENTICITY . . . . . . . . . . . . . . . . . . . . . . . . .2 - Verifying the integrity of VIRUSCAN WHAT'S NEW . . . . . . . . . . . . . . . . . . . . . . . . . .3 - Features, new viruses added in this release OVERVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . .4 - Detailed description of VIRUSCAN OPERATION. . . . . . . . . . . . . . . . . . . . . . . . . . .5 - How to use VIRUSCAN EXAMPLES . . . . . . . . . . . . . . . . . . . . . . . . . . .8 - Samples of frequently-used options EXIT CODES . . . . . . . . . . . . . . . . . . . . . . . . . .9 - For running VIRUSCAN from batch files VIRUS REMOVAL. . . . . . . . . . . . . . . . . . . . . . . . .9 - How to manually remove a virus REGISTRATION . . . . . . . . . . . . . . . . . . . . . . . . .10 - How to register VIRUSCAN TECH SUPPORT . . . . . . . . . . . . . . . . . . . . . . . . .10 - Information you should have ready when calling APPENDIX A . . . . . . . . . . . . . . . . . . . . . . . . . .11 - Creating a virus string file with the /EXT option Page 1VIRUSCAN Version 7.2C76 Page 2 SYNOPSIS VIRUSCAN (SCAN) is a virus detection and identification program for the IBM PC and compatible computers. VIRUSCAN will search a PC for known computer viruses in memory, the boot sector, the partition table, and the files of a PC and its disks. VIRUSCAN will also detect the presence of unknown viruses. SCAN works by searching the system for instruction sequences or patterns that are unique to each computer virus, and then reporting their presence if found. This method works for viruses that VIRUSCAN recognizes. To detect unknown viruses, VIRUSCAN can append a validation code or "CRC check" to .COM and .EXE files. If the file has been modified in any way, SCAN will report that infection may have occurred. VIRUSCAN can also look for new viruses from a user-supplied list of virus search strings. VIRUSCAN runs on any PC with 256Kb and DOS version 2.00 or greater. AUTHENTICITY VIRUSCAN runs a self-test when executed. If SCAN has been modified in any way, a warning will be displayed. The program will still continue to check for viruses, though. If SCAN reports that it has been damaged, it is recommended that a clean copy be obtained. VIRUSCAN versions 46 and above are packaged with the VALIDATE program to ensure the integrity of the SCAN.EXE file. The VALIDATE.DOC instructions tell how to use the VALIDATE program. The VALIDATE program distributed with VIRUSCAN may be used to check all further versions of SCAN. The validation results for Version 76-C should be: FILE NAME: SCAN.EXE SIZE: 58,467 DATE: 04-09-1991 FILE AUTHENTICATION Check Method 1: A9AB Check Method 2: 158B If your copy of SCAN.EXE differs, it may have been modified. Always obtain your copy of VIRUSCAN from a known source. The latest version of VIRUSCAN and validation data for SCAN.EXE can be obtained off of McAfee Associates' bulletin board system at (408) 988-4004. Beginning with Version 72, all McAfee Associates programs for download are archived with PKWare's PKZIP Authentic File Verification. If you do not see the "-AV" message after every file is unzipped and receive the message "Authentic Files Verified! # NWN405 Zip Source: McAFEE ASSOCIATES" when you unzip the files then do not run them. If your version of PKUNZIP does not have verification ability, then this message may not be displayed. Please contact McAfee Associates if your .ZIP file has been tampered with. VIRUSCAN Version 7.2C76 Page 3 WHAT'S NEW Version 76-C of SCAN fixes a false alarm with the Friday-13 virus. Version 76 of VIRUSCAN adds 18 new viruses, bringing the total number of known computer viruses to 239, for a total of 501 viruses including strains. The enclosed VIRLIST.TXT file outlines the characteristics of the new viruses. For a comprehensive discussion of each of the viruses, we recommend that you access the VSUM document copyrighted by Patricia Hoffman. It is available on most bulletin board systems. In addition, two new command line options have been added to improve batch mode operation of SCAN: The /NOPAUSE option turns off the screen pause that occurs when SCAN fills up a screen with messages. The /NOBREAK option will prevent SCAN from stopping when a Control-C or Control-Break is issued. VIRUSCAN Version 7.2C76 Page 4 OVERVIEW VIRUSCAN scans diskettes or entire systems for pre-existing computer virus infections. It will identify the virus infecting the system, and tell what area of the system (memory, boot sector, file) the virus occupies. An infected file can be removed with the overwrite-and-delete option, /D which will erase the file. The CLEAN-UP program is also available to automatically disinfect the system and repair damaged areas whenever possible. VIRUSCAN Version 76 identifies all 239 known computer viruses along with their variants. Some viruses have been modified so that more than one "strain" exists. Counting such modifications, there are 501 virus variants. The ten most common viruses which account for over 95% of all reported PC infections are also identified by SCAN. The accompanying VIRLIST.TXT file lists describes all new, public domain, and extinct computer viruses identified by SCAN. The number of variants of each virus is listed in parentheses after the virus name. All known computer viruses infect one or more of the following areas: the hard or fixed disk partition table [also known as the master boot record]; the DOS boot sector of hard disks and floppy disks; or one or more executable files within the system. Executable files include operating system files, .COM files, .EXE files, overlay files, or any other files loaded into memory and executed. A virus that infects more than one area, such as a boot sector and an executable file is called a multipartite virus. VIRUSCAN identifies every area or file that is infected, and indicates both the name of the virus and CLEAN-UP I.D. code used to remove it. SCAN will check the entire system, an individual diskette, sub-directory, or individual files for existing viruses. VIRUSCAN will also check for new, unknown viruses with the Add Validation and Check Validation options. This is done by computing a code for a file, appending it to the file, and then validating the file against that code. If the file has been modified, the check will no longer match, indicating that viral infection may have occurred. SCAN uses two independently generated CRC (Cyclic Redundancy Check) checks that are added to the end of program files to do this. Files which are self-checking should not be validated since this will "set off" the program's self-check. Files which are self-modifying may have different values for the same program depending upon the modifications. VIRUSCAN adds validation codes to .COM and .EXE files only. The validation codes for the partition table, boot sector, and system files, are kept in a hidden file called SCANVAL.VAL in the root directory. VIRUSCAN can also be updated to search for new viruses via an External Virus Data File option, which allows the user to provide the VIRUSCAN program with new search strings for viruses. VIRUSCAN can display messages in either English or French. VIRUSCAN works on stand-alone and networked PC's, but not on a file server. For networks, the NETSCAN file server-scanning program is required. VIRUSCAN Version 7.2C76 Page 5 OPERATION IMPORTANT NOTE: WRITE PROTECT YOUR FLOPPY DISK BEFORE SCANNING YOUR SYSTEM TO PREVENT INFECTION OF THE VIRUSCAN PROGRAM. VIRUSCAN will check each area or file on the designated drive(s) that could be host to a virus. If a virus is found, a message is displayed telling the name of the infected file or system area and the name of the identified virus. SCAN will examine files for viruses based on their extensions. The default executable extensions supported by SCAN are .BIN, .COM, .EXE, .OV?, .PGM, .PIF, .PRG, .SYS and .XTP. Additional extensions can be added to SCAN or all files on disk can be selected for scanning. To run VIRUSCAN type: SCAN d1: ... d10: /A /AV /CV /D /E .xxx .yyy .zzz /EXT d:filename /FR /MANY /NLZ /NOBREAK /NOMEM /NOPAUSE /REPORT d:filename /RV Options are: \ - Scan root directory and boot area only /A - Scan all files, including data, for viruses /AV - Add validation codes to specified files /CV - Check validation codes for files /D - Overwrite and delete infected file /E .xxx .yyy .zzz - Scan overlay extensions .xxx .yyy .zzz /EXT d:filename - Scan using external virus information file /FR - Display messages in French /M - Scan memory for all viruses (see below for specifics) /MANY - Scan multiple floppies /NLZ - Skip internal scan of LZEXE compressed files /NOBREAK - Disable Ctrl-C / Ctrl-Brk during scanning /NOMEM - Skip memory checking /NOPAUSE - Disable screen pause when scanning /REPORT d:filename - Create report of infected files /RV - Remove validation codes from specified files (d1: ... d10: indicate drives to be scanned) The /A option will cause SCAN to check all files on the referenced drive. This should only be used if a file-infecting virus has already been detected. Otherwise the /A option should only be used when checking a new program. The /A option will add a substantial time to scanning. This option takes priority over the /E option. The /AV option allows the user to add validation codes to the files being scanned. If a full drive is specified, SCAN will create validation data for the partition table, boot sector, and system files of the disk as well. Validation adds ten (10) bytes to files; the validation data for the partition table, boot sector, and system files is stored separately in a hidden file in the root directory of the scanned drive. VIRUSCAN Version 7.2C76 Page 6 The /CV option checks the validation codes inserted by the /AV option. If the file has been changed, SCAN will report that the file has been modified, and that viral infection may have occurred. Using the /CV option adds about 25% more time to scanning. NOTE: Some older Hewlett Packard and Zenith PC's modify the boot sector or partition table each time the system is booted. This will cause SCAN to continually notify the user of boot sector or partition table modifications if the /CV switch is selected. Check your system's manual to determine if your system contains self-modifying boot code. The /D option tells VIRUSCAN to prompt the user to overwrite and delete an infected file when one is found. If the user selects "Y" the infected file will be overwritten with hex code C3 [the Return-to-DOS instruction] and then deleted. A file erased by the /D option can not be recovered. If the McAfee Associates' CLEAN- UP program is available, it is recommended that CLEAN be used to remove the virus instead of SCAN, since in most cases it will recover the infected file. Boot sector and partition table infectors can not be removed by the /D option and require the CLEAN-UP virus disinfection program. The /E option allows the user to specify an extension or set of extensions to scan. Extensions should include the period character "." and be separated by a space after the /E and between each other. Up to three extensions may be added with the /E. For more extensions, use the /A option. The /EXT option allows VIRUSCAN to search for viruses from a text file containing user-created search strings. The syntax for using the external virus data file is /EXT d:filename, where d: is the drive name and filename is the name of the external virus data file. For instructions on how to create an external virus data file, refer to Appendix A. NOTE: The /EXT option is intended for advanced users and computer anti-virus researchers to add their own strings for detection of computer viruses on an interim or emergency basis. When used with the /D option, it will delete infected files. This option is not recommended for general use and should be used with caution. The /FR option tells VIRUSCAN to output all messages in French instead of English. The /M option tells VIRUSCAN to check system memory for all known computer viruses that can inhabit memory. SCAN by default only checks memory for critical and "stealth" viruses, which are viruses which can cause catastrophic damage or spread the infection during the scanning process. SCAN will check memory for the following viruses in any case: 1554 1971 1253 2100 3445-Stealth 4096 512 Anthrax Brain Dark Avenger Disk Killer Doom-2 EDV Fish6 Form Invader Joshi Microbes Mirror Murphy Nomenclature Phantom Plastique Polish-2 P1R (Phoenix) Taiwan-3 Whale Zero-Hunt VIRUSCAN Version 7.2C76 Page 7 If one of these viruses is found in memory, SCAN will stop and advise the user to power down, and reboot the system from a virus-free system disk. Using the /M option with another anti-viral software package may result in false alarms if the other package does not remove its virus search strings from memory. The /M option will add 6 to 20 seconds to the scanning time. The /MANY option is used to scan multiple diskettes placed in a given drive. If the user has more than one floppy disk to check for viruses, the /MANY option will allows the user to check them without having to run SCAN multiple times. If a system has been disinfected, the /MANY and /NOMEM options can be used to speed up scanning of disks. The /NLZ option tells VIRUSCAN not to look inside files compressed with the LZEXE file compression program. SCAN will still check the programs for external infections. The /NOBREAK option disables Control-C or Control-Break from stopping VIRUSCAN while running. The /NOMEM option is used to turn off all memory checking for viruses. It should only be used when a system is known to be free of viruses. The /NOPAUSE option disables the "More..." prompt that appears when SCAN fills up a screen with data. This allows VIRUSCAN to run on a machine with multiple infections without requiring operator intervention when the screen fills up with messages from the SCAN program. The /REPORT option is used to generate a listing of infected files. The resulting list is saved to disk as an ASCII text file. To use the report option, specify /REPORT on the command line, followed by the device and filename [See EXAMPLES below for samples]. The /RV option is used to remove validation codes from a file or files. It can be used to remove the validation code from a diskette, subdirectory, or file(s). Using /RV on a disk will remove the partition table, boot sector, and system file validation. This option can not be used with the /AV option. VIRUSCAN Version 7.2C76 Page 8 EXAMPLES The following examples are shown as they would be typed in. SCAN C: To scan drive C: SCAN A:R-HOOPER.EXE To scan file "R-HOOPER.EXE" on drive A: SCAN A: /A To scan all files on drive A: SCAN B: /D /A To scan all files on drive B:, and prompt for erasure of infected files. SCAN C: D: E: /AV /NOMEM To add validation codes to files on drives C:, D:, and E:, and skip memory checking. SCAN C: D: /M /A /FR To scan memory for all known and extinct viruses, as well as all files on drives C: and D:, and output all messages in French. SCAN C: D: /E .WPM .COD To scan drives C: and D:, and include files with the extensions .WPM and .COD SCAN A: /CV To check for known and unknown viruses (via the validation codes) on drive A: SCAN C: /EXT A:SAMPLE.ASC To scan drive C: for known computer viruses and also for viruses added by the user via the external virus data file option. SCAN C: /M /REPORT A:INFECTN.RPT To scan for all viruses in memory and drive C:, and create a log on drive A: called INFECTN.RPT SCAN C: D: /NOPAUSE /REPORT B:VIRUS.RPT To scan drives C: and D: for viruses without stopping, and create a log on drive B: called VIRUS.RPT VIRUSCAN Version 7.2C76 Page 9 EXIT CODES VIRUSCAN will set the DOS ERRORLEVEL upon program termination to: ERRORLEVEL | DESCRIPTION -----------+-------------------------- 0 | No viruses found 1 | One or more viruses found 2 | Abnormal termination (program error) If a user stops the scanning process, SCAN will set the ERRORLEVEL to 0 or 1 depending on whether or not a virus was discovered prior to termination of the SCAN. The /NOBREAK option can be used to prevent scanning from being stopped. VIRUS REMOVAL What do you do if a virus is found? You can contact McAfee Associates for assistance with manually removing the virus, for disinfection utilities, and for more information about the virus. The CLEAN-UP universal virus disinfection program is available and will disinfect the majority of reported computer viruses. It is updated frequently to remove new viruses. The CLEAN-UP program can be downloaded from McAfee Associates BBS. It is strongly recommended that you get experienced help in dealing with viruses, especially critical viruses that can damage or destroy data [for a listing of critical viruses, see the /M option under OPTIONS, above] and partition table or boot sector infecting viruses, as improper removal of these viruses could result in the loss of all data and use of the disk(s). IF CLEAN-UP IS NOT AVAILABLE, THEN FOR: BOOT SECTOR INFECTORS Power down the infected system and boot off of an uninfected, write-protected diskette. Use the DOS SYS command to attempt to overwrite the boot sector. This works in many cases. Run VIRUSCAN to see if the virus has been eradicated. If this does not work, do a file-by-file backup of the system (in other words, do not backup the boot sector) and do a low-level format of the disk. For a floppy diskette, copy the files off of the infected diskette using the DOS COPY command, not XCOPY or DISKCOPY which will transfer the virus. Reformat or discard the infected floppy disk. FILE INFECTORS Power down the infected system and boot off of an uninfected, write-protected diskette. Run VIRUSCAN with the /D and /A options. Scan all original disks for viruses and replace programs from them if clean. VIRUSCAN Version 7.2C76 Page 10 PARTITION TABLE INFECTORS Power down the infected system and boot off of an uninfected, write-protected diskette. Proceed to do a file-by-file backup of the system (in other words, do not backup the partition table). Then do a low-level format of the disk. Disinfection utilities are available for the majority of reported computer viruses, these programs can be downloaded from McAfee Associates' BBS at (408) 988-4004. REGISTRATION A registration fee of $25.00US is required for the use of VIRUSCAN by individual home users. Registration is for one year and entitles the holder to unlimited free upgrades off of McAfee Associates BBS. Diskettes are not mailed unless requested. Add $9.00US for diskette mailings. Only one diskette mailing will be made. Registration is for home users only and does not apply to businesses, corporations, organizations, government agencies, or schools, who must obtain a license for use. Contact McAfee Associates for more information. Outside of America, registration and support may be obtained from the Agents listed in the accompanying AGENTS.TXT file. TECH SUPPORT For fast and accurate help, please have the following information prepared when you contact McAfee Associates: - Program name and version number. - Type and brand of computer, hard disk, plus any peripherals. - Version of DOS you are running, plus any TSRs or device drivers in use. - Printouts of your AUTOEXEC.BAT and CONFIG.SYS files. - The exact problem you are having. Please be as specific as possible. Having a printout of the screen and/or being at your computer will help also. McAfee Associates can be contacted by BBS or fax twenty-four hours a day, or call our business office at (408) 988-3832, Monday through Friday, 8:30AM to 6:00PM Pacific Standard Time. McAfee Associates (408) 988-3832 office 4423 Cheeney Street (408) 970-9727 fax Santa Clara, CA 95054-0253 (408) 988-4004 BBS 2400 bps U.S.A (408) 988-5138 BBS HST 9600 (408) 988-5190 BBS v32 9600 If you are overseas, please refer to the AGENTS.TXT file for a listing of McAfee Associates Agents for support or sales. VIRUSCAN Version 7.2C76 Page 11 APPENDIX A: Creating a Virus String File with the /EXT Option The External Virus Data file should be created with an editor or a word processor and saved as an ASCII text file. Be sure each line ends with a CR/LF pair. NOTE: The /EXT option is intended for emergency and research use only. It is an temporary method for identifying new viruses prior to the subsequent release of SCAN. A sound understanding of viruses and string-search techniques is advised as a prerequisite for using this option. The virus string file uses the following format: #Comment about Virus_1 "aabbccddeeff..." Virus_1_Name #Comment about Virus_2 "gghhiijjkkll..." Virus_2_Name . . "uuvvwwxxyyzz..." Virus_n_Name Where aa, bb, cc, etc. are the hexadecimal bytes that you wish to scan for. Each line in the file represents one virus. The Virus Name for each virus is mandatory, and may be up to 25 characters in length. The double quotes (") are required at the beginning and end of each hexadecimal string. SCAN will use the string file to search memory, the Partition Table, Boot Sector, System files, all .COM and .EXE files, and Overlay files with the extension .BIN, .OV?, .PGM, .PIF, .PRG, .SYS and .XTP. Virus strings may contain wild cards. The two wildcard options are: FIXED POSITION WILDCARD The question mark "?" may be used to represent a wildcard in a fixed position within the string. For example, the string: "E9 7C 00 10 ? 37 CB" would match "E9 7C 00 10 27 37 CB", "E9 7C 00 10 9C 37 CB", or any other similar string, no matter what byte was in the fifth place. RANGE WILDCARD The asterisk "*", followed by range number in parentheses "(" and ")" is used to represent a variable number of adjoining random bytes. For example, the string: "E9 7C *(4) 37 CB" would match "E9 7C 00 37 CB", "E9 7C 00 11 37 CB", and "E9 7C 00 11 22 37 CB". The string "E9 7C 00 11 22 33 44 37 CB" would not match since the distance between 7C and 37 is greater than four bytes. You may specify a range of up to 99 bytes. VIRUSCAN Version 7.2C76 Page 12 Up to 10 different wildcards of either kind may be used in one virus string. COMMENTS A pound sign "#" at the begining of a line will denote that it is a comment. Use this for adding notes to the external virus data file. For example: #New .COM virus found in file FRITZ.EXE from #Schneiderland on 01-22-91 "53 48 45 45 50" Fritz-1 [F-1] Could be used to store a description of the virus, name of the original infected file, where and when it was received, and so forth.
VALIDATE Version 0.3 From McAfee Associates (408) 988-3832 VALIDATE is a file-authentication program that may be used to check other programs for signs of tampering. VALIDATE uses two discrete methods to generate Cyclic Redundancy Checks (CRC's), which are then displayed for the user to compare against the known value for the program(s) validated. The known validation data can be published by the author of the program or be obtained from a trusted information database. The dual CRC checking provides a high degree of security. The Computer Virus Industry Association (CVIA) provides an online database of validation values for shareware authors at no cost. You are encouraged to call the CVIA's BBS at (408) 988-4004 to access current validation data for McAfee Associates' VIRUSCAN, California Software Concepts' SHEZ, Vern Berg's LIST, and other shareware programs. To confirm that a program is in its original, untampered state, run the VALIDATE program on it, record the validation data produced, and compare it against the record in the online database. If they match, than it is highly improbable (less than one in sixty-four quadrilion) that the program has been modified. To run VALIDATE, type: VALIDATE d:\path\filename.ext The VALIDATE program will then display the following information: Size: (#/bytes) Date: (file creation date) File Authentication Check Method 1: (a four digit CRC) Check Method 2: (a four digit CRC) The VALIDATE program may be copied and distributed at no charge as long as it is distributed whole and intact and unmodified in any way, along with this file. Please report virus infections and reports of program tampering to: Computer Virus Industry Association 4423 Cheeney Street Santa Clara, CA 95054-0253 USA (408) 727-4559 telephone answering machine The validation data for VALIDATE.COM is: WITH CRC WITHOUT CHECKING CHECKING Size: 6495 6485 Date: 10-31-1989 10-31-1989 File Authentication Check Method 1: 4637 CB21 Check Method 2: 1214 13B7 If you have an older version of VALIDATE, it may be ten (10) bytes shorter. This is because it was not processed by VIRUSCAN's CRC-checking feature, added in Version 66 of VIRUSCAN. The validation code can be removed from VALIDATE.COM by running VIRUSCAN against it with the /RV Remove Validation option. However, this is not recommended.
VIRUS CHARACTERISTICS LIST V76 Copyright 1989, 1990, 1991 McAfee Associates All Rights Reserved. (408) 988-3832 The following list outlines the major characteristics of the known IBM PC and compatible virus strains identified by SCAN. The number of known varients of each virus is also listed. This number is listed in parenthesis beside the name of the strain. The total number of known viruses is summed at the end of the list. The Clean-Up virus I.D. code is included in brackets. An asterisk ("*") in front of a virus name denotes an extinct computer virus. ========================================================================== A Infects Fixed Disk Partition Table-A-------------------+ 9 Infects Fixed Disk Boot Sector-----9-----------------+ | 8 Infects Floppy Diskette Boot-------8---------------+ | | 7 Infects Overlay Files--------------7-------------+ | | | 6 Infects EXE Files------------------6-----------+ | | | | 5 Infects COM files------------------5---------+ | | | | | 4 Infects COMMAND.COM----------------4-------+ | | | | | | 3 Virus Installs Self in Memory------3-----+ | | | | | | | 2 Virus Uses Self-Encryption---------2---+ | | | | | | | | 1 Virus Uses STEALTH Techniques------1-+ | | | | | | | | | | | | | | | | | | | Increase in | | | | | | | | | | Infected | | | | | | | | | | Program's | | | | | | | | | | Size 1 2 3 4 5 6 7 8 9 A | | | | | | | | | | | | Virus Disinfector V V V V V V V V V V V Damage ----------------------------------------------------------------------------- Staf [Staf] Clean-Up . . x x x . . . . . 2083 O,P,L Mix2 [MX2] Clean-Up . . x x x x x . . . 2280 O,P Brain Slayer [Slay] Clean-Up . . x . x x x . . . 5120 O,P,L,D Striker [Str] Clean-Up . . x x x . . . . . 461 O,P,F Guppy [Guppy] Clean-Up . . x x x . . . . . 152 O,P Arab Virus [Ar] Clean-Up . . x . x . . . . . 834 O,P V-801 [V801] Clean-Up . . x x x x x . . . 801 O,P,L Terror [Ter] Clean-Up . . x x x x x . . . 1085 O,P,F S-847 [S847] Clean-Up . . x . x . . . . . 850 O,P Frogs [Frogs] Clean-Up . . x x x . . . . . 1500 O,P Enigma [Enigma] Clean-Up . x x . . x x . . . 1755 O,P AGI-Plan [AGI] Clean-Up . . . x x . . . . . 1536 O,P,L Crash [Crash] Clean-Up . . . . . . . . . . (See footnote) Hymn-2 [H-2] Clean-Up . . x x x x x . . . 1962 O,P,L Tester [TV] Clean-Up . . x x x . . . . . 1000 O,P 453  Clean-up . . x x x . . . . . 453 O,P Curse Boot [Curse] M-Disk . . x . . . . x x . N/A B,O Striker [STR] Clean-Up . . . . x . . . . . 461 D,O,B,L Azusa [Azusa] Clean-Up . . x . . . . x . x N/A D,O,B,L Lazy [Lazy] Clean-Up . . x x x . . . . . 720 O,P V-555  Clean-Up . . x x x x x . . . 555 O,P,L Phantom [Phant] Clean-Up . . x x x . . . . . 2253 O,P V-299 [V299] Clean-Up . . . . x . . . . . 299 O,P,D Cancer [Cn] Clean-Up . . . . x . . . . . 1480 O,P,D 1575/1591 [15xx] (2) Clean-Up . . x x x x . . . . vary O,P,L USSR 492 [U492] Clean-Up . . . . x . . . . . 492 O,P USSR 1049 [U1049] Clean-Up . . x . x x . . . . 1049 O,P,L Skism [Skism] Clean-Up . . x . x x x . . . 1815 O,P Holocaust (3) [Holo] Clean-Up x . x x x . . . . . 3784 O,P,L,D Stone-90 [S90] Clean-Up . . . x x . . . . . 961 O,P 903  Clean-Up . . x x x . . . . . 903 O,P Dir-Vir [DVir] Clean-Up x . x x x . . . . . 691 O,P,D Hybrid [Hybrid] Clean-Up . . . x x . . . . . 1306 O,P,L IKV528 [I528] Clean-Up . . . x x . . . . . 528 O,P Iraqi Warrior [Iwar] Clean-Up . . . x x . . . . . 777 O,P,L,D Little Pieces [LP] Clean-Up . . x . x x . . . . 1374 O,P Saddam [Saddam] Clean-Up . . x x x . . . . . 919 O,P,D,L Monxla-B [MonB] Clean-Up . . . x x . . . . . 535 O,P,L Plague [Plague] Clean-Up . . . . x x . . . . Overwriting Sentinel [Sent] Clean-Up . . x x x x x . . . 4625 L,O,P,D Swiss 143 [S143] Clean-Up . . . x x . . . . . 143 O,P,D Voronezh [Voro] Clean-Up . x x x x x x . . . 1600 O,P,D V-961 [V961] Clean-Up . . x x x . . . . . 961 O,P USSR311 [U311] Clean-Up . . . . x . . . . . 321 O,P USSR830 [U830] Clean-Up . . x x x . . . . . 830 O,P USSR529 [U529] Clean-Up . . x x x . . . . . 529 O,P USSR516 [U516] Clean-Up . . x x x . . . . . 516 O,P USSR2144 [U2144] Clean-Up . x x x x x x . . . 2144 L,O,P,D USSR1049 [U1049] Clean-Up . . x x x . . . . . 1049 O,P Tiny-133 [T133] Clean-Up . . . x x . . . . . 133 O,P Sverdlov [Sverd] Clean-Up . . x x x x x . . . 1962 O,P Label [Label] Clean-Up . . x x x . . . . . Overwrites Kukaturbo [Kuka] Clean-Up . . x x x . . . . . Overwrites Justice [Just] Clean-up . . x x x . . . . . 1242 O,P Hymn [Hymn] Clean-Up . . x x x x x . . . 642 O,P,D Happy New Year [HNew] Clean-Up . . x x x x x . . . 1865 O,P Destructor [Dest] Clean-Up . . x x x x x . . . 1150 O,P Leapfrog Virus (3) [Leap] Clean-Up . . x x x . . . . . 516 O,P,D MGTU Virus (4) [MGTU] Clean-Up . . . x x . . . . . 273 O,P,D Nina [Nina] Clean-Up . . x x x . . . . . 256 O,P,D Lozinsky (4) [Loz] Clean-Up . . . x x . . . . . 1023 O,P,D BeBe [BeBe] Clean-Up . . . x x . . . . . 1004 O,P,D Best Wish [BWish] Clean-Up . . . x x x x . . . 1024 O,P,D Beeper (2) [Beep] Clean-Up . . x . x . . . . . 482 O,P,D Parity [Parity] Clean-Up . . . x x . . . . . 441 O,P,D F-Word [FW] Clean-Up . . x x x . . . . . 417 O,P,D USSR-948 [U948] Clean-Up . x . . x x x . . . 948 O,P,D USSR-711 [U711] Clean-Up . x . . x . . . . . 711 P,D USSR-707 [U707] Clean-Up . x . x x . . . . . 707 P,D USSR-696 [U696] Clean-Up . x . . x . . . . . 696 P,D USSR-600 [U600] Clean-Up . x . x x . . . . . 600 P,D USSR-394 [U394] Clean-Up . x . x x . . . . . 394 P,D USSR-257 [U257] Clean-Up . x . x x . . . . . 257 P,D USSR-256 (2) [U256] Clean-Up . x . x x . . . . . 256 P,D Christmas Violater [CVio] Clean-Up . . . x x . . . . . ???? O,P,D Off Stealth [Off] Clean-Up x . x x x x x . . . 1689 O,P,D Jeff (3) [Jeff] Clean-Up . . . x x . . . . . 828 O,P,D,F Bloody! [Bloody] Clean-Up . x x . . . . x . x N/A B,O ZeroHunt [Hunt] Clean-Up x x x . x . . . . . N/A O,P,D Music Bug (3) [MBug] Clean-Up . . x . . . . x . x N/A B,O Dot Killer [Dot] Clean-Up . . x x x . . . . . 944 O,P Father Christmas [FC] Clean-Up . . . x x . . . . . 1881 O,P 3445  Clean-Up x x x . x x . . . . 3445 O,P,D,L Mirror (2) [Mirror] Clean-Up . . x . . x . . . . 928 O,P Polish-2 [P-2] Clean-Up . . x x x . . . . . 512 O,P,D Polish 217 [P-217] Clean-Up . . . x x . . . . . 217 O,P,D Happy Day [Happy] Clean-Up . . . x x . . . . . 453 O,P Monxla (3) [Monxla] Clean-Up . . . x x . . . . . 939 O,P USSR (4) [USSR] Clean-Up . x . . . x . . . . 575 O,P Polimer [Polimer] Clean-Up . . . x x . . . . . 512 O,P,D DataLock [Data] Clean-Up . . x x x x x . . . 920 O,P Carioca (6) [Carioca] Clean-Up . . x . x . . . . . 951 O,P 529  Clean-Up . . x x x . . . . . 529 O,P,D Spyer (3) [Spyer] Clean-Up . . x . x x x . . . 1181 O,P Taiwan4 [T4] Clean-Up . . x x x x x . . . 2576 O,P,D Keypress (3) [Key] Clean-Up . . x x x x . . . . 1232 O,P,D Casper (2) [Casper] Clean-Up . x . x x . . . . . 1200 L,O,P,D 1605 (2)  Clean-Up . . x x x x . . . . 1605 L,O,P,D Violator (5) [Vio] Clean-Up . . . x x . . . . . 1055 O,P,D Blood-2 [B-2] Clean-Up . . . . x . . . . . 427 O,P,D Wisconsin (3) [Wisc] Clean-Up . x . x x . . . . . 825 O,P,D Christmas-J [C-J] Clean-Up . . x x x x . . . . 600 O,P Burger (3) [Burger] Clean-Up . . . x x x . . . . Overwrites Leprosy-B [LepB] Clean-Up . . . x x x . . . . Overwrites Whale (3) [Whale] Clean-Up x x x x x x x . . . 9216 L,O,P,D Invader (4) [Invader] Clean-Up . x x . x x x x x . 4096 B,L,O,P,D Scott's Valley [SVal] Clean-Up . x x . x x x . . . 2133 L,O,P,D Black Monday (2) [BMon] Clean-Up . . x x x x x . . . 1055 L,O,P,D Nomenclature (4) [Nom] Clean-Up . . x x x x x . . . 1024 O,P,D Anthrax - Boot (2) [Atx] M-Disk . . x . . . . . . x N/A O,P,D Anthrax - File (4) [Atx] Clean-Up . . x x x x . . . . 1206 O,P,D 651  Clean-Up . . x . x . . . . . 651 O,P,D Paris [Paris] Clean-Up . . . x x x x . . . 4909 O,P,D,L Leprosy (5) [Lep] Clean-Up . . x x x x x . . . Overwrites Mardi Bros. (3) [Mardi] Clean-Up . . x . . . . x x . N/A B,O 1253 - Boot  M-DISK . . x . . . . x x x N/A O,P,D,L 1253 - COM  Clean-Up . . x x x . . . . . 1253 O,P,D,L AirCop (3) [AirCop] Clean-Up . . x . . . . x . . N/A B,O 400 (5)  Clean-Up . . x . x . . . . . Vary O,P,D P1 (7) [P1r] Clean-Up . x x . x . . . . . Vary O,P,D,L Ontario [Ont] Clean-Up . x x x x x . . . . Vary O,P,D V2100 (2)  Clean-Up . . x . x x . . . . 2100 O,P,D,L Plastique (9) [P1q] Clean-Up . . x x x x x . . . 3012 O,P,D Wolfman (2) [Wolf] Clean-Up . . x x x x . . . . 2064 O,P Doom2 [Dm2] Clean-Up . . x . x x . . . . 2504 O,P,D,L Flip (4) [Flip] Clean-Up . x x x x x x . . . 2343 O,P,D,L Fellowship (3) [Fellow] Clean-Up . . x . . x . . . . 1022 O,P,D,L Flash [Flash] Clean-Up . . x x x x . . . . 688 O,P,D,L 1008  Clean-Up . x x x x . . . . . 1008 O,P,D,L Taiwan3 [T3] Clean-Up . . x x x x x . . . 2905 O,P,D,L Armagedon (3) [Arma] Clean-Up . . x x x . . . . . 1079 O,P 1381  Clean-Up . . . . . x x . . . 1381 O,P Tiny (13) [Tiny] Clean-Up . . . x x . . . . . 163 O,P Subliminal (3) [Sub] Clean-Up . . x x x . . . . . 1496 O,P Sorry [Sorry] Clean-Up . . x x x . . . . . 731 O,P RedX (2) [Redx] Clean-Up . . . x x . . . . . 796 O,P 1024 (2)  Clean-Up . . x x x . . . . . 1024 O,P Joshi (4) [Joshi] Clean-Up x . x . . . . x x x N/A B,O,D Microbes [Micro] M-DISK . . x . . . . x x . N/A B,O,D Print Screen (2) [PrtScr] M-DISK . . x . . . . x x . N/A B,O,D Form (2) [Form] M-DISK . . x . . . . x x . N/A B,O,D July 13th [J13] Clean-Up . x . . . x . . . . 1201 O,P,D,L 5120 (3)  Clean-Up . . . x x x x . . . 5120 O,P,D,L Victor (2) [Victor] Clean-Up . . x x x x x . . . 2458 P,D,L JoJo (3) [JoJo] Clean-Up . . x . x . . . . . 1701 O,P W-13 (4) [W13] Clean-Up . . . . x . . . . . 532 O,P Slow (5) [Slow] Clean-Up . x x . x x x . . . 1721 O,P,L Frere Jacques [Frere] Clean-Up . . x . x x x . . . 1811 O,P Liberty (2) [Liberty] Clean-Up . . x x x x x . . . 2862 O,P Fish-6 (2) [Fish] Clean-Up x x x x x x x . . . 3584 O,P,L Shake [Shake] Clean-Up . . x . x . . . . . 476 O,P Murphy [Murphy] Clean-Up . . x x x x x . . . 1277 O,P V800 (3) [V800] Clean-Up x x x . x . . . . . none O,P,L Kennedy (3) [Kennedy] Clean-Up . . x . x . . . . . 308 O,P 8 Tunes/1971 (2)  Clean-Up . . x . x x x . . . 1971 O,P Yankee - 2 [Doodle2] Clean-Up . . . . x x . . . . 1961 O,P June 16th [June16] Clean-Up . . . x x . . . . . 1726 F,O,P,L XA1 [XA1] Clean-Up . x . . x . . . . . 1539 F,O,P,L 1392  Clean-Up . . x x x x . . . . 1392 O,P,L 1210  Clean-Up . . x . x . . . . . 1210 O,P,L 1720 (3)  Clean-Up . . x . x x x . . . 1720 F,O,P,L Saturday 14th (3) [Sat14] Clean-Up . . x . x x x . . . 685 F,O,P,L Korea (4) [Korea] Clean-Up . . . . . . . x x . N/A B,O Vcomm (5) [Vcomm] Clean-Up . . . . . x . . . . 1074 O,P,L ItaVir [Ita] Clean-Up . . . . . x . . . . 3880 O,P,L,B Solano (3) [Solano] Clean-Up . . x . x . . . . . 2000 O,P,L V2000 (3)  Clean-Up . . x x x x x . . . 2000 O,P,L 1559  Clean-Up . . x x x x . . . . 1554 O,P,L 512 (5)  Clean-Up x . x x x . . . . . none O,P,L EDV (2) [EDV] Clean-Up x . x . . . . x x x N/A B,O Joker [Joke] Clean-Up . . x x x . . . . . O,P Icelandic-3 [Ice-3] Clean-Up . . x . . x . . . . 853 O,P Virus-101  Clean-Up . x x x x x x x . . 2560 P 1260 (3)  Clean-Up . x . . x . . . . . 1260 P Perfume (2) [Fume] Clean-Up . . . . x . . . . . 765 P Taiwan (3) [Taiwan] Clean-Up . . . . x . . . . . 708 P Chaos [Chaos] MDISK . . x . . . . x x . N/A B,O,D,F Virus-90  Clean-Up . . x . x . . . . . 857 P Oropax (5) [Oro] Clean-Up . . x . x . . . . . 2773 P,O 4096 (4)  Clean-Up x . x x x x x . . . 4096 D,O,P,L Devil's Dance (2) [Dance] Clean-Up . . x . x . . . . . 941 D,O,P,L Amstrad (5) [Amst] Clean-Up . . . . x . . . . . 847 P Payday (2) [Payday] Clean-Up . . x . x x x . . . 1808 P Datacrime II-B [Crime-2] Clean-Up . x . x x x . . . . 1917 P,F Sylvia/Holland [Holland] Clean-Up . . . . x . . . . . 1332 P Do-Nothing [Nothing] Clean-Up . . x . x . . . . . 608 P Sunday (4) [Sunday] Clean-Up . . x . x x x . . . 1636 O,P Lisbon (2) [Lisb] Clean-Up . . . . x . . . . . 648 P Typo/Fumble [Typo] Clean-Up . . x . x . . . . . 867 O,P Dbase [Dbase] Clean-Up . . x . x . . . . . 1864 D,O,P Ghost Boot [Ghost] Clean-Up . . x . . . . x x . N/A B,O Ghost COM [Ghost] Clean-Up . . . . x . . . . . 2351 B,P Alabama (3) [Alabama] Clean-Up . . x . . x . . . . 1560 O,P,L Yankee Doodle (6) [Doodle] Clean-Up . . x . x x . . . . 2885 O,P 2930  Clean-Up . . x . x x . . . . 2930 P AIDS (4) [Aids] Clean-Up . . . . x . . . . . Overwrites Disk Killer (4) [Killer] Clean-Up . . x . . . . x x . N/A B,O,P,D,F 1536/Zero Bug [Zero] Clean-Up . . x . x . . . . . 1536 O,P MIX1 [Ice] Clean-Up . . x . . x . . . . 1618 O,P Dark Avenger (4) [Dav] Clean-Up . . x x x x x . . . 1800 O,P,L 3551/Syslock [Syslock] Clean-Up . x . . x x . . . . 3551 P,D VACSINA (5) [Vacs] Clean-Up . . x . x x x . . . 1206 O,P Typo Boot [TBoot] Clean-Up . . x . . . . x x . N/A O,B Swap Boot [Swap] M-DISK . . x . . . . x . . N/A B Datacrime II [Crime-2] Clean-Up . x . . x x . . . . 1514 P,F Icelandic II [Ice-2] Clean-Up . . x . . x . . . . 661 O,P Pentagon [Pentagon] M-DISK . . . . . . . x . . N/A B Traceback (3)  Clean-Up . . x . x x . . . . 3066 P Datacrime-B [Crime-B] Clean-Up . x . . x . . . . . 1168 P,F Icelandic (3) [Ice] Clean-Up . . x . . x . . . . 642 O,P 405  Clean-Up . . . . x . . . . . Overwrites Fu Manchu (4) [Fu] Clean-Up . . x . x x x . . . 2086 O,P Datacrime (2) [Crime] Clean-Up . x . . x . . . . . 1280 P,F 1701/Cascade (12) [170x] Clean-Up . x x . x . . . . . 1701 O,P Stoned (8) [Stoned] Clean-Up . . x . . . . x . x N/A O,B,L Ping Pong-B (7) [Ping] Clean-Up . . x . . . . x x . N/A O,B Den Zuk (4) [DenZuk] Clean-Up . . x . . . . x . . N/A O,B Lehigh [Lehigh] Clean-Up . . x x . . . . . . Overwrites P,F Vienna/648 (19) [Vienna] Clean-Up . . . . x . . . . . 648 P Alameda (2) [Alameda] Clean-Up . . x . . . . x . . N/A B Friday 13th COM [Fri13] Clean-Up . . . . x . . . . . 512 P Jerusalem (24) [Jeru] Clean-Up . . x . x x x . . . 1808 O,P SURIV02 [SurivA] Clean-Up . . x . . x . . . . 1488 O,P SURIV01 [SurivA] Clean-Up . . x . x . . . . . 897 O,P Brain (4) [Brain] Clean-Up . . x . . . . x . . N/A B Total Known Viruses - 501 LEGEND: Size Increase: N/A - Virus does not attach to files. None - Virus does not change file size (attaches to tag end of file) Overwrites - Virus overwrites beginning of file, no file size change All Others - The length in bytes by which a file will increase when infected. Damage Fields: B - Corrupts or overwrites the boot sector D - Corrupts data files F - Formats or overwrites all/part of disk L - Directly or indirectly corrupts file linkage O - Affects system run-time operation P - Corrupts program or overlay files Characteristics: x - Yes . - No Disinfectors: CLEAN-UP - CLEAN-UP universal virus disinfector SCAN /D - VIRUSCAN with /D option SCAN /D /A - VIRUSCAN with /D and /A options MDISK /P - MDISK with "P" option All Others - The name of disinfecting program NOTE: The SCAN /D options will overwrite and then delete the entire infected program. The program must then be replaced from the original program diskette. If you wish to try and recover an infected program, then use the above-named disinfector if available. If a virus infects Overlay Files (Item 7) Clean-Up should be used with the /A option when removing the virus. Footnote: The 'crash' virus (in all implementations we have encountered) crashes when run. It is included since it is possible that under other architectures than those tested, it might flourish.
Volume in drive A has no label Directory of A:\ READ ME 1458 4-19-91 10:46p DBATE005 BAT 868 4-22-91 12:07a DBATE005 BW 452 4-22-91 12:07a DBATE005 CFG 486 4-22-91 12:07a DBATE005 COL 486 4-22-91 12:07a DBATE005 HDR 12914 4-22-91 12:08a DBATE005 MRK 11914 4-22-91 12:07a DBATE005 NEW 64 4-28-91 3:04p DBATE005 OLD 70 4-22-91 12:07a DBATE005 PGE 129142 4-22-91 12:07a DEZIP EXE 13246 4-19-91 10:32p DEZIPDOC EXE 3963 4-19-91 10:32p INQUIRY COM 208 4-19-91 10:32p IRIS EXE 65606 4-19-91 10:32p IRIS MSG 7472 4-19-91 10:32p SCAN76-C ZIP 67170 4-16-91 10:04p SI005FLS BW 452 4-22-91 12:19a SI005FLS CFG 486 4-22-91 12:19a SI005FLS COL 486 4-22-91 12:19a SI005FLS MRK 3074 4-22-91 12:19a SI005FLS PGE 9035 4-22-91 12:19a FILE2749 TXT 2172 8-01-91 2:31a GO BAT 826 8-08-91 5:22a 23 file(s) 332050 bytes 17408 bytes free