text:
On Thu, 14 Mar 2002 15:23:44 -0500,
Liberalminded <[email]>, in
<yv7k8.55875$[email]> wrote:
+>
+> "I R A Darth Aggie" <[email]> wrote in message
+> news:[email]...
+> > On Thu, 14 Mar 2002 15:04:20 -0500,
+> > Liberalminded <[email]>, in
+> > <kk7k8.74705$[email]> wrote:
+> > +>
+> > +> "Skippy" <[email]> wrote in message
+> > +> news:[email]...
+> > +> > pz <[email]> wrote:
+> > +> >
+> > +> > >Maybe somebody has some examples of usenet anonymity being used to
+> noble
+> > +> > >purpose...?
+> > +> >
+> > +> > Gary Burnore was reported to the authorities using an anonymous
+> > +> > remailer for molesting a girl under the age of consent.
+> > +> >
+> > +>
+> > +> Damn!!  Can you just get on with your fucking life.
+> > +> Does everything have to be Gary this or that?
+> > +> This is what I see in almost every thread you are in and sometimes post
+> > +> after post
+> > +>
+> > +> Poster:  How are you today?
+> > +> Skippy:  Burnore is a freak.
+> > +>
+> > +> Poster: I have problems with my modem
+> > +> Skippy:  Burnore had a modem and raped Mongolian children with it
+> > +>
+> > +> Poster:  Did you hear about Bush and the nukes?
+> > +> Skippy:  Bush's names starts with a B and so does Burnore who rapes
+> small
+> > +> rodents and takes children's candy while running nekkid through a Vet
+> Day
+> > +> Parade and I hear he smells bad to.
+> > +>
+> > +> Poster:  Who is Skippy in love with?
+> > +> Skippy:  Gary Burnore -----
+> >
+> > Yeah, that pretty much sums it up...
+>
+> at least the d00d could morph and attack somebody else from time to time.
+> If I ever get like that I am going to cut my phone lines and drive my car
+> off a bridge.

If it happens, I'll bring a digital camera, and then it could be
posted with the caption of "This is what happens when you take Usenet
way too seriously."

James


author: Liberalminded

subject: Re: I think Skippy and Robbie are the same person now plus he is in love with Gary and I can prove it    was Re: Abuse from Alttopia

text:
"I R A Darth Aggie" <[email]> wrote in message
news:[email]...
to
post
rapes
Vet
time.
car

I just took some time off myself.  I knew when I came back the same old shit
would be here and damn if it wasn't.  You would think some of these idiots
would learn it is always best to not really give a fucking damn 99% of the
time when posting but ---- without them we would not have easy people to
fuck with.


author: I R A Darth Aggie

text:
On Thu, 14 Mar 2002 16:13:59 -0500,
Liberalminded <[email]>, in
<Ee8k8.56035$[email]> wrote:
+>
+> "I R A Darth Aggie" <[email]> wrote in message
+> news:[email]...
+> > On Thu, 14 Mar 2002 15:23:44 -0500,
+> > Liberalminded <[email]>, in
+> > <yv7k8.55875$[email]> wrote:
+> > +>
+> > +> "I R A Darth Aggie" <[email]> wrote in message
+> > +> news:[email]...
+> > +> > On Thu, 14 Mar 2002 15:04:20 -0500,
+> > +> > Liberalminded <[email]>, in
+> > +> > <kk7k8.74705$[email]> wrote:
+> > +> > +>
+> > +> > +> "Skippy" <[email]> wrote in message
+> > +> > +> news:[email]...
+> > +> > +> > pz <[email]> wrote:
+> > +> > +> >
+> > +> > +> > >Maybe somebody has some examples of usenet anonymity being used
+> to
+> > +> noble
+> > +> > +> > >purpose...?
+> > +> > +> >
+> > +> > +> > Gary Burnore was reported to the authorities using an anonymous
+> > +> > +> > remailer for molesting a girl under the age of consent.
+> > +> > +> >
+> > +> > +>
+> > +> > +> Damn!!  Can you just get on with your fucking life.
+> > +> > +> Does everything have to be Gary this or that?
+> > +> > +> This is what I see in almost every thread you are in and sometimes
+> post
+> > +> > +> after post
+> > +> > +>
+> > +> > +> Poster:  How are you today?
+> > +> > +> Skippy:  Burnore is a freak.
+> > +> > +>
+> > +> > +> Poster: I have problems with my modem
+> > +> > +> Skippy:  Burnore had a modem and raped Mongolian children with it
+> > +> > +>
+> > +> > +> Poster:  Did you hear about Bush and the nukes?
+> > +> > +> Skippy:  Bush's names starts with a B and so does Burnore who
+> rapes
+> > +> small
+> > +> > +> rodents and takes children's candy while running nekkid through a
+> Vet
+> > +> Day
+> > +> > +> Parade and I hear he smells bad to.
+> > +> > +>
+> > +> > +> Poster:  Who is Skippy in love with?
+> > +> > +> Skippy:  Gary Burnore -----
+> > +> >
+> > +> > Yeah, that pretty much sums it up...
+> > +>
+> > +> at least the d00d could morph and attack somebody else from time to
+> time.
+> > +> If I ever get like that I am going to cut my phone lines and drive my
+> car
+> > +> off a bridge.
+> >
+> > If it happens, I'll bring a digital camera, and then it could be
+> > posted with the caption of "This is what happens when you take Usenet
+> > way too seriously."
+>
+> I just took some time off myself.  I knew when I came back the same old shit
+> would be here and damn if it wasn't.  You would think some of these idiots
+> would learn it is always best to not really give a fucking damn 99% of the
+> time when posting but ---- without them we would not have easy people to
+> fuck with.

Fish. Barrel. Large-calibre handgun. The visually impaired could fish them.

James


text:
"I R A Darth Aggie" <[email]> wrote in message
news:[email]...
used
anonymous
sometimes
with it
through a
to
my
shit
idiots
the
to
them.

I think we should just take a sample of their last twenty post and feed it
into a bot and let it do the task ---- do ya think ????

They stole my idea and have been doing this for years!!!

Damn them all to hell!!


author: George Wenzel

subject: [alt.comp.virus] FAQ Part 1/4

text:
Archive-name: computer-virus/alt-faq/part1
Posting-Frequency: Fortnightly
URL: http://www.webworlds.co.uk/dharley/
Maintainer: Co-maintained by David Harley, Bruce Burrell, and George Wenzel

               alt.comp.virus (Frequently Asked Questions)
               *******************************************

                       Version 1.03: Part 1 of 4
                      Last modified 12th May 1997

                      ("`-''-/").___..--''"`-._
                       `6_ 6  )   `-.  (     ).`-.__.`)
                       (_Y_.)'  ._   )  `._ `. ``-..-'
                     _..`--'_..-_/  /--'_.' ,'
                    (il),-''  (li),'  ((!.-'

ADMINISTRIVIA
=============

   New or modified entries are now flagged with two plus symbols at the
   beginning of the line. Sorry if I missed any on this update.

@@ Amendments between official upgrades are now flagged with two
   ampersands (@@) in the first two columns rather than three plus
   signs (+++). This is because I usually edit this document from home,
   and +++ has a specific meaning to Hayes-compatible modems which I
   invariably forget about.

++ Maintenance of this FAQ is now shared between the following:

	David Harley  <[email]>
	Bruce Burrell <[email]>
	George Wenzel <[email]>

Exactly how (not to mention if) this will work in practice has yet to
be determined. For the moment, it will work as follows.

George will do the real work, like making sure the darn thing is posted
regularly and organizing archiving, posting automagically etc., keeping
an eye on whether URLs are still current etc. Bruce and I will
concentrate on doing what we do best: Bruce will keep an eye open for
sloppy grammar and general imprecision; I'll sit here claiming credit
for the work of others and make the final decision in the event of any
contention. All three of us will refer to ourselves as "co-maintainer"
rather than "maintainer".

Any of us may choose to suggest edits, additions and subtractions to/from
the FAQ, but, with effect from the next revision, all edits will be
agreed between the three of us before inclusion in the FAQ. If anyone
else wishes to contribute a suggestion, alteration or addition, they
can send it to any or all of the above, and it will be used subject to
the agreement of all three of us.

For the present, the authoritative version of the FAQ remains the one
at http://webworlds.co.uk/dharley/. Administration of the <Guide to
AntiVirus FAQs> and the <Viruses and the Macintosh> FAQ remains with
David Harley alone.

Disclaimer
----------

This document is primarily concerned with defending the integrity of
computing systems and preventing damage caused by viruses or other
malicious and/or other unauthorized software. It attempts to address
many of the issues which are frequently discussed on alt.comp.virus,
but does not claim to represent all shades of opinion among the users of
a.c.v. - in particular, it does not include information which, in my
estimation, is likely to be of more help to those interested in the
spreading of unauthorized and/or malicious software than to those
who wish to be protected from it.

This document is an honest attempt to help individuals with computer
virus-related problems and queries. It can *not* be regarded as being
in any sense authoritative, and has no legal standing. The authors
accept no responsibility for errors or omissions, or for any ill effects
resulting from the use of any information contained in this document.

Not all the views expressed in this document are mine, and those views
which *are* mine are not necessarily shared by my employer.

        David Harley
        ------------

Copyright Notice
----------------

Copyright on all contributions to this FAQ remains with the authors
and all rights are reserved. It may, however, be freely distributed
and quoted - accurately, and with due credit.

It may not be reproduced for profit or distributed in part or as
a whole with any product for which a charge is made, except with
the prior permission of the copyright holders. To obtain such permission,
please contact one of the co-maintainers of the FAQ.

Availability
------------

The latest version of this document is available from:

(1)
        http://www.webworlds.co.uk/dharley/
        (this is the primary source)

(2)

Thanks to the efforts of Ed Fenton, the FAQ is now available
as a hypertext electronic document (DOS). This will be
available from ftp.gate.net (see below).

        ftp.gate.net/pub/users/ris1/acvfaqht.zip
        ftp.gate.net/pub/users/ris1/acvfaq.zip

Derek Giroulle has offered to make the FAQ available in
French and Dutch. More details in due course. If there's any
interest in other non-English versions, perhaps people would
let me know and I'll see what I can do.

A number of individuals and sites have agreed to make it available
via anonymous FTP and/or WWW. These include:

        FTP://ftp.gate.net/pub/users/ris1/acvfaq.zip
        http://www.drsolomon.com/
        http://www.innet.net/~ewillems/
        http://www.agora.stm.it/N.Ferri/infos.htm

It is also available on AOL:

        America Online: (Virus Information Center: Keyword VIRUS

----------------------------------------------------------------------

PREFACE
=======

(i) What is the FAQ, and whom is it for?
    -----------------------------------

  This FAQ is intended to make available answers to questions which
  are repeatedly asked on alt.comp.virus, and tries to gather the most
  useful information regarding this group and the issues discussed here
  into a relatively short document. The hope is to produce (eventually)
  an easily-digested document for newcomers, as a means of saving those
  who regularly reply to posted questions having to re-invent the wheel
  each time.

  I recommend that you read this FAQ in conjunction with the comp.virus
  (VIRUS-L)FAQ, which gives more detailed information regarding some
  issues which are, inevitably, covered in both FAQs.

  The VIRUS-L/comp.virus FAQ is regularly posted to the comp.virus
  newsgroup. The latest version should be available as:

        ftp://cert.org/pub/virus-l/FAQ.virus-l

  You can get the Mk. 2 version at

        ftp://ftp.datafellows.com/pub/misc/anti-vir/vlfaq200.zip
        ftp://cs.ucr.edu/pub/virus-l/

  which is very long and very thorough. This document is subject to
  revision, so the file name may change.

  A very terse mini-FAQ maintained by George Wenzel is posted more or
  less daily to alt.comp.virus. I am now regularly posting a guide to
  virus-related FAQs (contact details and digest of contents), which I
  plan to extend to other security areas eventually, as a supplement
  to this FAQ. Both these resources will eventually be available by
  FTP/WWW.

(ii) Credits/Acknowledgements
     ------------------------

  The following have contributed text and/or ideas and/or
  proofreading/corrections and/or URLs to the a.c.v. FAQ.

        Vesselin Bontchev
        Bruce Burrell
        Graham Cluley
        Henri Delger
        Edward Fenton
        Nicola Ferri
	Sarah Gordon
        David Harley
        R. Wallace Hale
        Norman Hirsch
        Matthew Holtz
        Mikko H. Hypponen
        Douglas A. Kaufman
        Tom Kelchner
	Paul Kerrigan
	Chengi Jimmy Kuo
        Susan Lesch
        Gerard Mannig
        Mike Ramey
        Perry Rovers
        Megan Skinner
        Fridrik Skulason
        Robert Slade
        Alan Solomon
        Ken Stieers
        Hector Ugalde
        George Wenzel
        Caroline Wilson
	Tarkan Yetiser

  Acknowledgement is also due to the work of Ken Van Wyk, former
  moderator of VIRUS-L/comp.virus, and the contributors to the
  comp.virus FAQ (both versions).

  Thanks also to [email] (aka Phreex), who mailed me a copy of the FAQ
  he posted to a.c.v. some months before this one was begun, David J. Loundy
  for assistance regarding legal issues, and to Nick FitzGerald, the
  moderator of comp.virus and maintainer of the Mk. II comp.virus FAQ.
  And especially to George Wenzel and Lucky the Cat.

(iii) Guide to posting etiquette
     --------------------------

  Messages asking for help posted to alt.comp.virus are more likely to
  receive a useful response if they conform to accepted standards of
  civility. The newsgroup news.announce.newusers includes information
  on good newsgroup etiquette, or try

        ftp://rtfm.mit.edu/pub/usenet/news.answers
        http://www.fau.edu/rinaldi/netiquette.html

  However, adhering to the following guidelines would be particularly
  helpful:

* Keep your lines short (say 72 characters per line), so that anyone
  who follows up doesn't have to reformat quoted text to keep it
  readable).
* Don't quote all or most of a message you're following up unless it's
  either very short, or necessary in order to address each point made.
  In the latter case, please put the point you're answering close to
  your answer and try to format it so that it's readable. Remember that
  some people have to pay for connection/download time.
* On the other hand, a message which says something like 'I totally
  agree' without including enough of the original for us to tell what
  you're agreeing with is a waste of bandwidth.
* Keep it polite. It's unlikely that anyone who replies to your
  posting is being paid to do so, and it wouldn't excuse bad manners if
  they were. Of course, the cut and thrust of debate may be a different
  matter altogether....
* Asking for a reply by direct e-mail may be reasonable if you need
  an urgent solution or are using a borrowed account. It isn't
  reasonable if you simply can't be bothered to check newsgroups.
  At least try to think up a good excuse, and be prepared to offer a
  summary to the group.
* Check that there isn't already a thread on the subject you're
  asking about before posting yet another 'Has anyone heard of the GOOD
  TIMES virus?' message. If there is, check it first: the answer to
  your question may already be there (if it isn't in this document!).
  Please remember that many people have to pay for connect time, and
  don't appreciate duplicate postings or uuencoded binaries.
* If you want to follow up a message which doesn't seem particularly
  relevant to alt.comp.virus, check the 'Newsgroups:' header: there
  have been a lot of responses to spammings recently which have made
  increased the bandwidth used, often quite unnecessarily.
* Please don't post test messages here unless you really need to:
  use one of the newsgroups intended for the purpose: there is probably
  one local to your news server - ask your Systems Administrator,
  provider or local helpdesk. If you must post to the entire Internet,
  use misc.test - if you do, put the word IGNORE in your Subject: field,
  or you'll get auto-responder messages in your mail for weeks
  afterwards. Look through the postings in news.announce.newusers
  for relevant guidelines before you post.
* If you get into an exchange of E-mail, please remember that
  not everyone can handle all forms of E-mail attachment (uuencoded,
  MIME format etc. - if it's text, *send* it as text. NB also that
  (uu)encoding text makes it longer as well as unreadable, so don't!

(iv) How to ask on the alt.comp.virus newsgroup for help
     ---------------------------------------------------

  The more relevant information you give us, the more we can help you.
  It helps to tell us the following:

* What you think the problem is (you might think it's a virus, but
  maybe it isn't)
* What the symptoms are. If you ran some software that gave you a
  message, tell us which package, version number, and the exact wording
  of the message.
* Please be as accurate as possible about the order in which events
  happened.
* If just one file is infected, give the filename.
* If you're running more than one anti-virus product, please list
  them (including version number), and say what each one said about
  the possible virus.
* Which version of which operating system you are running.
* Any other configuration information which you think may have a bearing.

  Don't take action, then ask if that was the right action - if it
  wasn't, it's too late.

  Don't just ask "I've got xyz virus, can anyone help me".

-------------------------------------------------------------------------

Table of Contents
*****************

----->  Part 1
        ------

----->  (1)     I have a virus - what do I do?
----->  (2)     Minimal glossary
----->  (3)     What is a virus (Trojan, Worm)?
----->  (4)     How do viruses work?
----->  (5)     How do viruses spread?
----->  (6)     How can I avoid infection?
----->  (7)     How does antivirus software work?

        Part 2
        ------

        (8)     What's the best anti-virus software
                      (and where do I get it)?
        (9)     Where can I get further information?
        (10)    Does anyone know about
                * Mac viruses?
                * UNIX viruses?
                * macro viruses?
                * the AOLGold virus?
                * the PKZip300 trojan virus?
                * the xyz PC virus?
                * the Psychic Neon Buddha Jesus virus?
                * the blem wit virus
		* The Irina Virus
		* Ghost
++		* General Info on Hoaxes/Erroneous Alerts
        (11)    Is it true that...?
        (12)    Favourite myths
                * DOS file attributes protect executable files from
                  infection
                * I'm safe from viruses because I don't use bulletin
                  boards/shareware/Public Domain software
                * FDISK /MBR fixes boot sector viruses
                * Write-protecting suspect floppies stops infection
                * The write-protect tab always stops a disk write
                * I can infect my system by running DIR on an infected
                  disk
        Part 3
        ------

        (13) What are the legal implications of computer viruses?

        Part 4
        ------

        (14)    Miscellaneous

        Are there anti-virus packages which check zipped files?
        What's the genb/genp virus?
        Where do I get VCL and an assembler, & what's the password?
        Send me a virus.
        It said in a review......
        Is it viruses, virii or what?
        Where is alt.comp.virus archived?
++      What about firewalls?
        Viruses on CD-ROM.
        Removing viruses.
        Can't viruses sometimes be useful?
        Do I have a virus, and how do I know?
        What should be on a (clean) boot disk?
        How do I know I have a clean boot disk?
        What other tools might I need?
        What are rescue disks?
        Are there CMOS viruses?
        How do I know I'm FTP-ing 'good' software?
        What is 386SPART.PAR?
++      Can I get a virus to test my antivirus package with?
        When I do DIR | MORE I see a couple of files with funny names...
        Reasons NOT to use FDISK /MBR
        Why do people write/distribute viruses?
        Where can I get an anti-virus policy?
        Are there virus damage statistics?
        What is NCSA approval?
++	What language should I write a virus in?
++	No, seriously, what language are they written in?
++	[DRD], Doren Rosenthal, the Universe and Everything
++	What are CARO and EICAR?
        Placeholders

Supplement: Virus-related FAQs vs. 1.02b

* The alt.comp.virus FAQ
* The comp.virus/Virus-L FAQ
* The macro-virus FAQ
* The alt.comp.virus mini-FAQ
* The Antiviral Software Evaluation FAQ

-------------------------------------------------------------------------

(1) I have a virus problem - what do I do?
==========================================

The following guidelines will, one hopes, be of assistance. However,
you may get better use out of them if you read the rest of this
document before acting rashly...

If you think you may have a virus infection, *stay calm*. Once
detected, a virus will rarely cause (further) damage, but a
panic action might. Bear in mind that not every one who thinks s/he
has a virus actually does (and a well-documented, treatable virus
might be preferable to some problems!). Reformatting your hard disk
is almost certainly unnecessary and very probably won't kill the
virus.

If you've been told you have something exotic, consider the
possibility of a false alarm and check with a different package.

If you have a good antivirus package, use it. Better still, use more
than one. If there's a problem with the package, use the publisher's
tech support and/or try an alternative package. If you don't have a
package, get one (see section on sources below). If you're using
Microsoft's package (MSAV) get something less out-of-date.

Follow the guidelines below as far as is practicable and applicable
to your situation.

Try to get expert help *before* you do anything else. If the problem
is in your office rather than at home there may be someone whose job
includes responsibility for dealing with virus incidents.

Follow the guidelines below as far as is practicable and applicable.

* Do not attempt to continue to work with an infected system, or let
  other people do so.
* Generally, it's considered preferable to switch an infected
  system off until a competent person can deal with it: don't allow
  other people to use it in the meantime. If possible, close down
  applications, Windows etc. properly and allow any caches/buffers
  to flush, rather than just hit the power switch.
* If you have the means of checking other office machines for
  infection, you should do so and take appropriate steps if an
  infection is found.
* If you are unable to check other machines, assume that all
  machines are infected and take all possible steps to avoid
  spreading infection any further.
* If there are still uninfected systems in the locality, don't use
  floppy disks on them [except known clean write-protected DOS boot
  floppies]
* users of infected machines should not *under any circumstances *
  trade disks with others until their systems and disks are cleaned.
* if the infected system is connected to a Novell network, Appleshare
  etc., it should be logged off all remote machines unless someone
  knowledgeable says different. If you're not sure how to do this,
  contact whoever is responsible for the administration of the
  network. You should in any case ensure that the network administrator
  or other responsible and knowledgeable individual is fully aware of
  the situation.
* No files should be exchanged between machines by any other means
  until it's established that this can be done safely.
* Ensure that all people in your office and anyone else at risk are
  aware of the situation.
* Get *all* floppy disks together for checking and check every one.
  This includes write-protected floppies and program master disks.
  Check all backups too (on tape or file servers as well as on floppy).

(2) Minimal Glossary
====================

[There is room for improvement and expansion here. Contributions
will be gratefully accepted.]

* AV   - AntiVirus. Sometimes applied as a shorthand term for
         anti-virus researchers/programmers/publishers - may include
         those whose work is not AV research, but includes
         virus-control. (See also Vx.)
* BSI  - Boot Sector Infector (= BSV - Boot Sector Virus)
* BIOS - Basic Input Output System
* CMOS - Memory used to store hardware configuration information
* DBR  - DOS Boot Record
* DBS  - DOS Boot Sector
* False Positive - When an antivirus program incorrectly reports a
                   virus in memory or infecting a file. Scanners in
                   heuristic mode and integrity checkers are, by
                   definition, somewhat more prone to these.
* False Negative - Essentially, a virus undetected by an antivirus
                   program.
* In-the-wild    - describes viruses known to be spreading
                   uncontrolled to real-life systems, as opposed to
                   those which exist only in controlled situations
                   such as anti-virus research labs. Virus code
                   which has been published but not actually found
                   spreading out of control is not usually regarded
                   as being in-the-wild.
* MBR  - Master Boot Record (Partition Sector)
* TSR  - A memory-resident DOS program, i.e one which remains in
         memory while other programs are running. A good TSR should
         at least detect all known in-the-wild viruses and a good
         percentage of other known viruses. Generally, TSRs are not
         so good with polymorphic viruses, and should not be relied on
         exclusively.
* vx   - Those who study, exchange and write viruses, not necessarily
         with malicious intentions (So I'm frequently told here...)  B-)
* VxD  - A Windows program which can run in the background. A scanner
         implemented as a VxD has all the advantages of a DOS TSR, but
         can have additional advantages: for instance, a good VxD will
         scan continuously *and* for all the viruses detected by a
         command-line scanner.
* Zoo  - suite of viruses used for testing.

See the comp.virus FAQ for fuller definitions of some of these terms and
others which aren't addressed here.

Here are some commonly referred to anti-virus packages, including
acronyms (hence their inclusion in this section). [Suggestions for
expansion are, again, welcomed.]

* AVP - AntiViral Toolkit Pro
* AVTK - Dr. Solomon's AntiVirus ToolKit
* CPAV - Central Point AntiVirus
* The Doctor (Not Dr. Solomon!)
* Disinfectant (Mac)
* DSAVTK - Dr. Solomon's AntiVirus ToolKit
* F-Prot
* FindViru(s) - DSAVTK scanner
* Gatekeeper (Mac)
* Invircible
* MSAV - MicroSoft AntiVirus
* McAfee
* NAV - Norton AntiVirus
* SCAN - ViruScan (McAfee's scanner)
* Sweep - Scanner by Sophos
* TBAV - Thunderbyte AntiVirus
* VET

(3) What is a virus (and what are Trojans and Worms)?
=====================================================

A (computer) virus is a program (a block of executable code) which
attaches itself to, overwrites or otherwise replaces another program
in order to reproduce itself without the knowledge of the PC user.

Most viruses are comparatively harmless, and may be present for
years with no noticeable effect: some, however, may cause random
damage to data files (sometimes insidiously, over a long period)
or attempt to destroy files and disks. Others cause unintended
damage. Even benign viruses (apparently non-destructive viruses)
cause significant damage by occupying disk space and/or main
memory, by using up CPU processing time, and by the time and expense
wasted in detecting and removing them.

A Trojan Horse is a program intended to perform some covert
and usually malicious act which the victim did not expect or want.
It differs from a destructive virus in that it doesn't reproduce,
(though this distinction is by no means universally accepted).

A dropper is a program which installs a virus or Trojan, often
covertly.

A worm is a program which spreads (usually) over network
connections. Unlike a virus, it does not attach itself to a
host program. In practice, worms are not normally associated
with personal computer systems. There is an excellent
and considerably longer definition in the Mk. 2 version of the
Virus-L FAQ.

(The following is a slightly academic diversion)

A lot of bandwidth is spent on precise definitions of some of
the terms above. I have Fridrik Skulason's permission to include
the following definition of a virus, which I like because it
demonstrates most of the relevant issues.

     #1 A virus is a program that is able to replicate - that is, create
        (possibly modified) copies of itself.

     #2 The replication is intentional, not just a side-effect.

     #3 At least some of the replicants are also viruses, by this
        definition.

     #4 A virus has to attach itself to a host, in the sense that execution
        of the host implies execution of the virus.

  --

  #1 is the main definition, which distinguishes between viruses and Trojans
  and other non-replicating malware.

  #2 is necessary to exclude for example a disk-copying program copying a
  disk, which contains a copy of itself.

  #3 is necessary to exclude "intended" not-quite-viruses.

  #4 is necessary to exclude "worms", but at the same time it has to be broad
  enough to include companion viruses and .DOC viruses.

(4) How do viruses work?
========================

A file virus attaches itself to a file (but see the section below
or the comp.virus FAQ on the subject of companion viruses), usually
an executable application (e.g. a word processing program or a DOS
program). In general, file viruses don't infect data files. However,
data files can contain embedded executable code such as macros, which
may be used by virus or trojan writers. Text files such as batch files,
postscript files, and source code which contain commands that can be
compiled or interpreted by another program are potential targets for
malware (malicious software), though such malware is not at present
common.

Boot sector viruses alter the program that is in the first sector
(boot sector) of every DOS-formatted disk. Generally, a boot
sector infector executes its own code (which usually infects the boot
sector or partition sector of the hard disk), then continues the PC
bootup (start-up) process. In most cases, all write-enabled floppies
used on that PC from then on will become infected.

Multipartite viruses have some of the features of both the above
types of virus. Typically, when an infected *file* is executed, it
infects the hard disk boot sector or partition sector, and thus
infects subsequent floppies used or formatted on the target system.

The following virus types are more fully defined in the
comp.virus FAQs (see preamble):

* STEALTH VIRUSES - viruses that go to some length to
  conceal their presence from programs which might notice.
* POLYMORPHIC VIRUSES - viruses that cannot be detected by
  searching for a simple, single sequence of bytes in a
  possibly-infected file, since they change with every
  replication.
* COMPANION VIRUSES - viruses that spread via a file which
  runs instead of the file the user intended to run, and
  then runs the original file. For instance, the file
  MYAPP.EXE might be 'infected' by creating a file called
  MYAPP.COM. Because of the way DOS works, when the user
  types MYAPP at the C> prompt, MYAPP.COM is run instead of
  MYAPP.EXE. MYAPP.COM runs its infective routine, then
  quietly executes MYAPP.EXE. N.B. this is not the *only*
  type of companion (or 'spawning') virus.
* ARMOURED VIRUSES - viruses that are specifically written
  to make it difficult for an antivirus researcher to find
  out how they work and what they do.

(5) How do viruses spread?
==========================

A PC is infected with a boot sector virus (or partition sector
virus) if it is (re-)booted (usually by accident) from an infected
floppy disk in drive A. Boot Sector/MBR infectors are the most
commonly found viruses, and cannot normally spread across a network.
These (normally) spread by accident via floppy disks which may come
from virtually any source: unsolicited demonstration disks,
brand-new software (even from reputable sources), disks used on
your PC by salesmen or engineers, new hardware, or repaired hardware.

A file virus infects other files when the program to which it is
attached is run, and so *can* spread across a network (often very
quickly). They may be spread from the same sources as boot sector
viruses, but also from sources such as Internet FTP sites and
bulletin boards. (This applies also to Trojan Horses.)

A multipartite virus infects boot sectors *and* files. Often,
an infected file is used to infect the boot sector: thus, this is
one case where a boot sector infector could spread across a network.

(6) How can I avoid infection?
==============================

There is no way to guarantee that you will avoid infection. However,
the potential damage can be minimized by taking the following
precautions:

* make sure you have a clean boot disk - test with whatever (up-to-date!)
  antivirus  software you can get hold of and make sure it is (and stays)
  write-protected. Boot from it and make a couple of copies.
* use reputable, up-to-date and properly-installed anti-virus
  software regularly. (See below) If you use a shareware package
  for which payment and/or registration is required, do it. Not only
  does it encourage the writer and make you feel virtuous, it means
  you can legitimately ask for technical support in a crisis.
* do some reading (see below). If you're a home user, you may well
  get an infection sooner or later. If you're a business user, it'll
  be sooner. Either way you'll benefit from a little background.
  If you're a business user you (or your enterprise) need a policy.
* don't rely *solely* on newsgroups like this to get you out of
  trouble: it may be a while before you get a response (especially
  from a moderated group like comp.virus), and the first response
  you act upon may not offer the most appropriate advice for your
  particular problem.
* if you use a shareware/freeware package, make sure you have hard
  copy of the documentation *before* your system falls apart!
* always run a memory-resident scanner to monitor disk access and
  executable files before they're run.
* if you run Windows, a reputable anti-virus package which includes
  DOS *and* Windows components is likely to offer better protection
  than a DOS only package. If you run Windows 95, you need a proper
  Win95 32-bit package for full protection.
* make sure your home system is protected, as well as your work PC.
* check all new systems and all floppy disks when they're brought
  in (from *any* source) with a good virus-scanning program.
* acquire software from reputable sources: 2nd-hand software is
  frequently unchecked and sometimes infected. Bear in mind that
  shrinkwrapped software isn't necessarily unused. In any case,
  reputable firms have shipped viruses unknowingly.
* once formatted, keep floppies write-disabled except when you need
  to write a file to them: then write-disable them again.
* make sure your data is backed up regularly and that the procedures
  for restoring archived data *work* properly.
* scan pre-formatted diskettes before use.
* Get to know all the components of the package you're using and
  consider which bits to use and how best to use them. Different
  packages have different strengths: diversifying and mixing and
  matching can, if carefully and properly done, be a good antivirus
  strategy, especially in a corporate environment
* if your PC can be prevented with a CMOS setting from booting with a
  disk in drive A, do it (and re-enable floppy booting temporarily when
  you need to clean-boot).

CMOS settings
-------------

  Some CMOSes come with special anti-virus settings.  These are normally
  vague about what they do but typically they write-protect your hard
  disk's boot sector and partition sector (MBR).  This can be some use
  against boot sector viruses but may false alarm when you upgrade your
  operating system.

  One sensible setting to make (if your CMOS allows) is to adjust the
  boot sequence of your PC.  Changing the default boot-up drive order
  from  A: C: to C: will mean that the PC will attempt to boot from drive
  C: even if a floppy disk has been left in drive A:.  This way boot
  sector virus infection can often be avoided.  Remember, however, to set
  your CMOS back temporarily if you ever *do* want to boot clean from
  floppy (for example, when running a cryptographical checksummer
  after a cold boot).

  SCSI controllers have their own BIOS. On some systems, this will
  override the boot sequence set in CMOS. It's always a good idea
  to check with a (known clean) bootable floppy after you've
  disabled floppy booting that it really is disabled. I don't think
  it's necessary to use the Rosenthal Simulator to do this, thank
  you, Doren.

(7) How does antivirus software work?
-------------------------------------

* Scanner (conventional scanner, command-line scanner, on-demand
  scanner) - a program that looks for known viruses by checking for
  recognisable patterns ('scan strings', 'search strings',
  'signatures').
* TSR scanner - a TSR (memory-resident program) that checks for
  viruses while other programs are running. It may have some of
  the characteristics of a monitor and/or behaviour blocker.
* VxD scanner - a scanner that works under Windows or perhaps under
  Win 95, or both), which checks for viruses continuously while
  you work.
* Heuristic scanners - scanners that inspect executable files for
  code using operations that might denote an unknown virus.
* Monitor/Behaviour Blocker - a TSR that monitors programs while
  they are running for behaviour which might denote a virus.
* Change Detectors/Checksummers/Integrity Checkers - programs that
  keep a database of the characteristics of all executable files on
  a system and check for changes which might signify an attack by
  an unknown virus.
* Cryptographic Checksummers use an encryption algorithm to lessen
  the risk of being fooled by a virus which targets that particular
  checksummer.

---------------------------------------------------------------------

End of a.c.v. FAQ Part 1 of 4


subject: [alt.comp.virus] FAQ Part 2/4

text:
Archive-name: computer-virus/alt-faq/part2
Posting-Frequency: Fortnightly
URL: http://www.webworlds.co.uk/dharley/
Maintainer: Co-maintained by David Harley, Bruce Burrell, and George Wenzel

               alt.comp.virus (Frequently Asked Questions)
               *******************************************

                       Version 1.03: Part 2 of 4
                      Last modified 12th May 1997

                    ("`-''-/").___..--''"`-._
                     `6_ 6  )   `-.  (     ).`-.__.`)
                     (_Y_.)'  ._   )  `._ `. ``-..-'
                   _..`--'_..-_/  /--'_.' ,'
                  (il),-''  (li),'  ((!.-'

ADMINISTRIVIA
=============

Disclaimer
----------

This document is an honest attempt to help individuals with computer
virus-related problems and queries. It can *not* be regarded as being
in any sense authoritative, and has no legal standing. The authors
accept no responsibility for errors or omissions, or for any ill effects
resulting from the use of any information contained in this document.

Not all the views expressed in this document are mine, and those views
which *are* mine are not necessarily shared by my employer.

Copyright Notice
----------------

Copyright on all contributions to this FAQ remains with the authors
and all rights are reserved. It may, however, be freely distributed
and quoted - accurately, and with due credit. B-)

It may not be reproduced for profit or distributed in part or as
a whole with any product for which a charge is made, except with
the prior permission of the copyright holders. To obtain such permission,
please contact one of the co-maintainers of the FAQ.

        David Harley  <[email]>
        Bruce Burrell <[email]>
        George Wenzel <[email]>

--------------------------------------------------------------------

TABLE OF CONTENTS
=================

        Part 1
        ------

        (1)     I have a virus - what do I do?
        (2)     Minimal glossary
        (3)     What is a virus (Trojan, Worm)?
        (4)     How do viruses work?
        (5)     How do viruses spread?
        (6)     How can I avoid infection?
        (7)     How does antivirus software work?

----->  Part 2
        ------

----->  (8)     What's the best anti-virus software
                      (and where do I get it)?
----->  (9)     Where can I get further information?
----->  (10)    Does anyone know about
                * Mac viruses?
                * UNIX viruses?
                * macro viruses?
                * the AOLGold virus?
                * the PKZip300 trojan virus?
                * the xyz PC virus?
                * the Psychic Neon Buddha Jesus virus?
                * the blem wit virus
		* the Irina virus
		* Ghost
++		* General Info on Hoaxes/Erroneous Alerts
----->  (11)    Is it true that...?
----->  (12)    Favourite myths
                * DOS file attributes protect executable files from
                  infection
                * I'm safe from viruses because I don't use bulletin
                  boards/shareware/Public Domain software
                * FDISK /MBR fixes boot sector viruses
                * Write-protecting suspect floppies stops infection
                * The write-protect tab always stops a disk write
                * I can infect my system by running DIR on an infected
                  disk

        Part 3
        ------

        (13) What are the legal implications of computer viruses?

        Part 4
        ------

        (14)    Miscellaneous

        Are there anti-virus packages which check zipped files?
        What's the genb/genp virus?
        Where do I get VCL and an assembler, & what's the password?
        Send me a virus.
        It said in a review.....
        Is it viruses, virii or what?
        Where is alt.comp.virus archived?
++      What about firewalls?
        Viruses on CD-ROM.
        Removing viruses.
        Can't viruses sometimes be useful?
        Do I have a virus, and how do I know?
        What should be on a (clean) boot disk?
        How do I know I have a clean boot disk?
        What other tools might I need?
        What are rescue disks?
        Are there CMOS viruses?
        How do I know I'm FTP-ing 'good' software?
        What is 386SPART.PAR?
++      Can I get a virus to test my antivirus package with?
        When I do DIR | MORE I see a couple of files with funny names...
        Reasons NOT to use FDISK /MBR
        Why do people write/distribute viruses?
        Where can I get an anti-virus policy?
        Are there virus damage statistics?
        What is NCSA approval?
++      What language should I write a virus in?
++      No, seriously, what language are they written in?
++      [DRD], Doren Rosenthal, the Universe and Everything
++      What are CARO and EICAR?
        Placeholders

Supplement: Virus-related FAQs vs. 1.02b

* The alt.comp.virus FAQ
* The comp.virus/Virus-L FAQ
* The macro-virus FAQ
* The alt.comp.virus mini-FAQ
* The Antiviral Software Evaluation FAQ

-------------------------------------------------------------------

(8) What's the best antivirus software (and where do I get it)?
===============================================================

In case it's not absolutely clear from the following, I can't
possibly answer the first part of this question! There are,
however, some suggestions following for sources of software
and of information on particular packages, comparative reviews etc.
The danger of this approach is that sites, servers, and packages
come and go, and I haven't time to keep track of all these
variables. Some of these URLs have been passed on by trusted
sources, but I haven't the time to check them all out regularly.
If you run into problems, please let me know (by e-mail, please).

Most of the people who post here have their favourites: if you just
ask which is the best, you'll generally get either a subjective
"I like such and such", recommendation of a particular product by
someone who works for that company, or a request to be more specific
about your needs. Some of us who are heavily involved with virus
control favour using more than one package and keeping track of the
market. Don't trust anything you read in the non-technical press.
Don't accept uncritically reviews in the computing press, either:
even highly-regarded IT specialists often have little understanding
of virus issues, and many journalists are specialists only in
skimming and misinterpreting. Magazines like Virus Bulletin and
Secure Computing are much better informed and do frequent comparative
reviews, and are also informative about their testing criteria,
procedures and virus suites. Recently, a number of articles have been
posted here by people who've run their own tests on various packages.
These are often of interest, but should not be accepted uncritically.
(No-one's opinion should be accepted uncritically!)

Valid testing of antivirus software requires a lot of care and
thought, and not all those who undertake it have the resources,
knowledge or experience to do it properly.

You may get a more informed response if you specify what sort of system
you have - DOS, Windows, Win95? XT, AT, 386 or better? Is the system
networked, and are you asking about protecting the whole network?
(What sort of network?) Are you running NT, OS/2 or Win95, any of which
involve special considerations?  Be aware that there is more than one way
of judging the effectiveness of a package - the sheer number of viruses
detected; speed; tendency to false alarms; size (can you run it from a
single floppy when necessary?); types of virus detection & prevention
(not at all the same thing) offered (command-line scanning, TSR scanning,
behaviour blocking, checksumming, access-control, integrity shell etc.);
technical support etc.

One possible measure of a package's efficiency in terms of virus
detection is NCSA approval. Under the current testing protocol, a
scanner must detect all viruses on the Wild List plus 90% of NCSA's
full test suite.

DOS packages available from SimTel etc. include

        F-Prot
        AVP Lite
        McAfee
        TBAV

Most Shareware/Freeware packages can be obtained from SimTel or SimTelNet
via anonymous FTP or WWW, e.g.

  http://www.coast.net/SimTel/msdos/virus
  ftp://ftp.coast.net/SimTel/msdos/virus/
  ftp://ftp.simtel.net/pub/simtelnet/msdos/virus/

For information on mirror sites, a regularly-updated listing can
be found at

  http://www.SimTel.net/simtel.net/mirrors.txt

Mirror sites include:

USA:-
        ftp.cdrom.com
        uiarchive.cso.uiuc.edu
        oak.oakland.edu
        wuarchive.wustl.edu
        ftp.uoknor.edu
        ftp.pht.com

UK:-
        micros.hensa.ac.uk
        src.doc.ic.ac.uk
        ftp.demon.co.uk

as well as other sites in many other parts of the world.

There is some confusion at present regarding SimTel: you may find that
some mirrors are still pointing to the Coast to Coast collection while
others are pointing to SimTelnet (Walnut Creek).

Of course, such products can often be obtained direct from the
publisher's WWW or FTP sites too.

There is a shareware program for Win95 called the Doctor.
        Compuserve - GO NCSAVIRUS
        ftp://thomnet.com/
        http://www.tucows.com/files/doc9509.zip
        ftp://ftp.mindspring.com/users/rogert
        TNS BBS +1 (404) 971 8886

Finding an up-to-date version may be a problem, though, according to
reports.

ftp://ftp.mcafee.com/pub/antivirus/
http://thunderbyte.com/ftp/thunderbyte/
ftp://ftp.thunderbyte.com/

ChekMate is described by its author as a targeted integrity checker.
It's a potentially useful shareware supplement to a good virus scanner.

  Via anonymous ftp at:
        ftp.coast.net/SimTel/msdos/virus/cm211.zip
        ftp.demon.co.uk/pub/simtel/msdos/virus/cm211.zip
        ftp.demon.co.uk/antivirus/ibmpc/av-progs/cm211.zip
        ftp.gate.net/pub/users/ris1/cm211.zip

  At the World-Wide Web site:
        http://www.psnw.com/~joe/avdos.html

Commercial
----------

[vendors are invited to supply full contact details and indicate the range
of platforms their product range covers. Let's not overdo the hype, though,
guys.]

There is a pretty comprehensive list of anti-virus developers at

        http://www.virusbtn.com/AVLinks/

(NB Some of the following, though not shareware, can be obtained for
evaluation via anon FTP or WWW.

Please note, I have not tested or even seen all the packages listed
here, or all the contact data, come to that, and listing here does not
imply recommendation (though I won't list anything I *know* is
rubbish....).

DSAVTK (Dr Solomon's Anti-Virus ToolKit)
[DOS; DOS & Windows; DOS & Win95; NetWare; NT; OS/2; Unix; Mac]
Virus handling workshops.
Access-control, software audit and other packages.

UK Support: [email]
US Support: [email]
UK Tel: +44 (0)1296 318700
USA Tel: +1 617-273-7400
CompuServe: GO DRSOLOMON
Web: http://www.drsolomon.com
FTP: ftp://ftp.drsolomon.com
Evaluation copy of Findvirus Dos scanner available via the Web.

*************

F-Prot Pro (DOS, Windows 3.x, Win95, WinNT, NetWare)

There are two flavours, though I gather that Command Software and
Data Fellows are currently doing joint development.

Command Software Systems Inc.
1+407-575 3200
ftp://ftp.commandcom.com

Data Fellows Ltd.
[email]
ftp://ftp.DataFellows.com
http://www.DataFellows.com
http://www.Europe.DataFellows.com

UK:

Portcullis (for Data Fellows) 44-181-868-0098

Command Software UK 44-171-259-5710
[email]

More details inc. in ORDER-2.DOC, supplied with the shareware version.
[The filename is now PRO.DOC in recent versions]

************

IBM AntiVirus:
http://www.brs.ibm.com/ibmav.html
800-551-3579 (US only)
800-465-7999
fax: 800-267-5185

************

McAfee Associates
2710 Walsh Ave
Santa Clara, CA  95051
95054-3107  USA
Voice (408) 988-3832
FAX   (408) 970-9727
BBS   (408) 988-4004
CompuServe ID: 76702,1714 or GO MCAFEE
[email]
ftp://ftp.mcafee.com/pub/antivirus/
http://www.mcafee.com/
[DOS, Windows, Win95, NetWare, Unix, Mac, NT]

************

NAV (Norton AntiVirus)  [DOS, Windows, Win95, Mac (SAM), NT, NetWare]
http://www.symantec.com/ ftp://ftp.symantec.com
US Support:  541-465-8420                              AOL:  SYMANTEC
European Support:  31-71-353-111   Australian Support:  61-2-879-6577

************

AntiViral Toolkit Pro
AVP LITE

(1) USA

   Central Command Inc.
   P.O. Box 856
   Brunswick, Ohio 44212

Phone: 330-273-2820
FAX:   330-220-4129
BBS:   330-220-4036

WWW:   www.command-hq.com/command
ftp:   ftp.command-hq.com  pub/command/avp

email:  [email]
        [email]

(2) Switzerland

E-Mail:                     [email]

WWW:                        http://www.avp.ch/
 AVP Virus Encyclopedia:    http://www.avp.ch/avpve/
 AVP Updates & News:        http://www.avp.ch/E/avp-news.htm
 AVP Distributors List:     http://www.avp.ch/E/distrib.htm

BBS:   +41 (0)31 348 1331
FAX:   +41 (0)31 348 1335

************

Sweep   http://www.sophos.com/ ftp://ftp.sophos.com

************

Thunderbyte http://thunderbyte.com/ftp/thunderbyte/software/
            ftp://ftp.thunderbyte.com (?)

************

Invircible ftp://ftp.invircible.com
             ftp://ftp.datasrv.co.il/pub/usr/netz/
             http://invircible.com/

There is a growing tendency in the UK press to push InVircible as
a one-fits-all solution which renders known-virus scanning obsolete,
while Zvi Netiv and those who support his product have a tendency to
promote it by attacking the better-known scanners as being a
security risk. While my personal view is that there is a place for
both known-virus scanning and generic solutions, I would suggest
reading a couple of papers which take an opposing view before putting
all your eggs in the InVircible basket.

	http://www.primenet.com/~mwest/iv-toc.htm
	http://www.primenet.com/~mwest/iv-bill.txt

Discussion on these issues has generated a great deal of heat and
personal abuse. I have to advise caution when considering using a
product whose proponents are apt to descend to mudslinging and
unethical advertising practices.

************

Reflex Magnetics Ltd
31-33 Priory Park Road
London
NW6 7UP
United Kingdom

Tel+44 (0)171 372 6666
Fax+44 (0)171 372 2507
BBS+44 (0)171372 2584
[email]

http://www.reflex-magnetics.co.uk/

Disknet access-control/virus control
Diskette duplication.
Security/Virus-control training.

************

Reflex Magnetics Ireland

Unit 24 Johnstown Industrial Centre, Waterford, Ireland.
tel: +353-(0)51-841051 J fax: +353-(0)51-841052

        http://www.reflex.ie/

************

NH&A
577 Isham St. # 2-B
New York, NY 10034
Phone:  212-304-9660
Fax:  212-304-9759
CompuServe: 72115,661
Internet: [email]
URL: http://www.nha.com
BBS:  212-304-9759,,,,,,,3

************

Microsoft (Macro Virus fixes) - http://www.microsoft.com
For updates to MSAV, contact Symantec (but better to get a more
up-to-date package). CPAV updates from the same source.

There is a paper by Yisrael Radai which documents many of the problems
with MSAV.

   ftp://ftp.informatik.uni-hamburg.de/pub/virus/texts/viruses/msaveval.zip

************

ViruSafe, ViruSafe-95

I believe a version of this program was at one time marketed by
Xtree.

They also maintain a Virus Hot Line via their WWW site or
E-mail ([email]).

-------------------------------------------------------------
EliaShim, LTD.                  Computer Security Specialists
5 Haganim st. Haifa 35022                 Tel: +972-4-8516111
ISRAEL                                    Fax: +972-4-8528613
Email: [email]              BBS: +972-4-8516113
URL: http://www.eliashim.com
-------------------------------------------------------------

----------------------------------------------------------------------------

VirusNet PC (DOS, Win3.x, Win95) - (File: VNPC.EXE)
VirusNet LAN (DOS, Win3.x, Win95, All Networks) - (File: VNLAN.EXE)
StopLight PC (DOS, Win3.x) - (File: SLELS.EXE)
StopLight for Win95 (Win95, Win3.x, DOS) - (File: Check Site)
StopLight for OS/2 (OS/2, Dual Boot to DOS and Win3.x) - (File: sltmos2.exe)

Safetynet, Inc.
140 Mountain Ave.
Springfield, NJ 07081
201-467-1024 (Sales and Support)
800-OS2-SAFE (Sales and Support in US and Canada)
201-467-1611 (Fax)
201-467-1581 (BBS 28800,n,8,1)
Web: http://www.safe.net/safety/
FTP: ftp.safe.net /pub/safetynet/
EMail: [email]
CompuServe: GO CIS:SAFE

AntiVirus and security software evals and product updates are available from
the Safetynet Web, FTP, BBS and CompuServe sites.

*****************

MIMESweeper (Mail scanning 'firewall')

Integralis Ltd.
10 Brewery Court
Theale
Berkshire
RG7 5AH
+44(0) 1734 306060
Fax +44(0) 1734 302143
[email]

US Office in Kirkland, WA.
Phone 206-889-4724.

--------------------------------------

Cybersoft have antivirus products for a variety of Unix
platforms including detection for DOS, Mac and Amiga
malware.

CyberSoft, Inc.
1508 Butler Pike
Conshohoken, Pennsylvania 19428-1322 USA
Voice: +1 (610) 825-4748
Fax +1 (610) 825-6785
[email]
http://www.cyber.com

--------------------------------------

NetPro Computing
7150 E Camelback Rd, Suite 100
Scottsdale, AZ 85251 USA

Products:
* PC ScanMaster for Novell/Vines
* Server ScanMaster for Banyan Vines
(Use McAfee VirusScan engine)

General Office: 602.941.3600
Sales: 800.998.5090
International Sales: 602.941.3630
DS Expert Info Line: 800.998.1550
Technical Support: 602.941.3670
FAX: 602.941.3610

On Line:
BBS: 602.941.3620
FTP: ftp.netpro.com
HTTP: www.netpro.com
e-mail: [email] or 70524,[email]

-----------------------------------------------------------------------------

F/Win is a scanner which is intended as a supplement to your main
scanner: it detects Windows/macro viruses. There is a shareware version
available. More information at:

	http://www.gen.com/fwin/

-----------------------------------------------------------------------------

There is a comprehensive set of product reviews at:

        http://www.first.org/virus/virrevws/

and a number of reputable vendors include comparative reviews,
papers on testing etc. on their WWW/FTP servers.

Virus Bulletin comparative reviews are available from

        http://www.virusbtn.com/Comparatives/

and information is also available on their testing protocols.

Product reviews and other kewl stuff from Robert Slade:

        telnet://freenet.victoria.bc.ca
        login as guest, give the command "go virus"

For a list of scanners that have received the "NCSA Approved" rating
of the National Computer Security Association in the U.S.A. see

  http://www.ncsa.com/avpdcert.html

The page also explains the certification procedure.

There are links to just about every anti-virus site you ever heard of at

      http://www.club.innet.net/~ewillems/

In the event of a *real* tragedy, there are a number of firms which
specialise in data recovery. In the UK, there is

Ontrack Data Recovery Europe (0800-243996) - see below
Authentec (formerly Dr. Solomon's) - 0800-581263/fax 01296-318813
Vogon International - 0118-989-0042/fax 0118-989-0042

++In the US, there's Ontrack Computer Systems (parent company of Ontrack
...Europe).

++
Ontrack Data Recovery, Inc.
6321 Bury Drive, Suites 13-21
Eden Prairie, MN  55346
Phone: 612-937-5161
FAX: 612-937-5750
BBS: 612-937-0860
Toll free: 1-800-872-2599

++
UK
The Pavilions
1 Weston Road, Kiln Lane
Epsom
Surrey KT17 1JG
Toll Free:  0800 24 39 96 (UK only)
International: +44(0)181 974 5522
Fax:  011-441-372-741-441
Tech Support: 011-441-372-747-414

++
Japan:
Ontrack Data Recovery Japan
182 Shinkoh, Iruma,
Saitama, 358 Japan
Phone: 81 429 32-6365
Fax: 81 429 32-6370
Toll-Free From Japan: 0120-413-374

++
***NEW OFFICE***
Germany:
Ontrack Data Recovery GmbH
Hanns-Klemm-Strasse 5
71034 Boeblingen
Germany
Toll free: 0130.815.198
International: 011-49-7031-644-00
Fax: 011-49-7031-644-100

++
Compuserve: GO DATARECOVERY
W3: http:\\www.ontrack.com
Email: [email]

DataRescue:
        http://www.datarescue.com/
        [email]

Anti-virus/security training/workshops in the UK:

        S&S International (see above) - live virus workshops
        Sophos - 01235-544028 http://www.sophos.com
        Precise Publishing Ltd. 01384-560527
        Reflex Magnetics (see above) - live virus workshops,
          Internet security/hacking, DTI codes of practice.

        Information on similar resources in the US or elsewhere
        would be gratefully received.

(9) Where can I get further information?
========================================

[I haven't checked all these: please mail me if you find any errors]

I'm now intermittently posting details of virus-related FAQs to
alt.comp.virus. This will eventually be available by FTP/WWW
and include other security resources.]

ftp://ftp.informatik.uni-hamburg.de/pub/virus/texts/catalog/
ftp://ftp.informatik.uni-hamburg.de/pub/virus/texts/carobase/
ftp://ftp.informatik.uni-hamburg.de/pub/virus/texts/viruses/

[mirror sites]

ftp://ftp.uu.net/pub/security/virus/
ftp://sunsite.unc.edu/pub/docs/security/hamburg-mirror/virus/

+++http://www.SevenLocks.com/
Lots of virus descriptions and other security information. Well
worth a look.

http://all.net:8000/cgi-bin/all-search-2
Virus Text Search
 Search engine to check out documents in the following archives:
 VIRUS-L Forum, 40Hex Archives, Risks Forum, Privacy Forum, CERT Advisories,
 Internet RFCs, State Computer Crime Laws, The Telecom Privacy Digest,
 CIAC Advisories, Firewalls Digest.

 http://lipsmac.acs.unt.edu/Virus/virinfo.html
 http://www.psnw.com/~joe/avinfo.html
 http://www.primenet.com/~mwest/av.htm
 http://csrc.ncsl.nist.gov/virus
 http://www.jumbo.com/home/dos/virus
 http://www.psnw.com/~joe/top10.html
 ftp://ftp.uu.net/pub/virus/progs/virlab15.zip
 http://www.infi.net/~wtnewton/vinfo/master.html
@@ http://www.nc5.infi.net/~wtnewton/vinfo/master.html

Virus-List Archive (you can also pick up the Virus-L FAQ from here):

        ftp://cs.ucr.edu/pub/virus-l/

Virus Bulletin Home Page - vendor contact info, comparative reviews,
review protocol info etc.

        http://www.virusbtn.com

Dr. Solomon's Software: evaluation copy of FindVirus, product info,
virus encyclopedia on-line, papers, links to other sites etc.

        http://www.drsolomon.com/
        ftp://ftp.drsolomon.com/

ftp://ftp.sophos.com/
http://www.sophos.com/
Dr.Solomon's History of PC Viruses:
http://dbweb.agora.stm.it/webforum/virus/solomhis.htm
Robert Slade's Virus History:
http://dbweb.agora.stm.it/webforum/virus/sladehis.htm

http://www.club.innet.net/~ewillems/

http://www.thenet.ch/metro/

Nic Ferri has an expansive home page with many useful links

        http://www.agora.stm.it/htbin/wwx?fi^N.Ferri

Henri Delger's home page has much useful info and useful links

        HTTP://pages.prodigy.com/virushelp/

Norman De Forest has some antivirus links, among other nice
stuff.

	http://www.chebucto.ns.ca/~af380/Profile.html

http://www.DataFellows.com/
http://www.Europe.DataFellows.com/

http://www.datarescue.com/

VSUM (not highly-rated for its accuracy)
(Try SimTel mirrors, McAfee sites)

Tom Simondi has written a freeware virus tutorial (VTUTOR11.ZIP).

	http://www.cknow.com/

The Scanner is an AV newsletter also available online at

	http://diversicomm.com/scanner

Try antivirus online at

	http://www.av.ibm.com/current/FrontPage/

Doug Muth has not only AV links but geek code as well....

	http://www.ot.com/~dmuth/

Bob Rosenberger's Computer Virus Myths Page

	http://www.kumite.com/myths/

A few Amiga links:

	http://www.cybercity.dk/users/ccc2452/antivirus.html
	http://www.xs4all.nl/~keesh/virushelp.html
[You can pick up the latest VirusScanList from either link]
	http://ftp.uni-paderborn.de/aminet/dirs/util_virus.html
[Antivirus info and programs]

The WildList (List of viruses currently 'in the wild'
maintained by Joe Wells - doesn't include much description)

ftp://ftp.ncsa.com/pub/virus/wildlist
http://www.drsolomon.com/
http://www.symantec.com/virus/wl.html
http://www.innet.net/~ewillems/vwild.htm

AV Software Update Auto-Notification:
 http://www.primenet.com/~Emwest/up-form.htm

Most anti-virus packages include some information on common
viruses, too.

Virus Descriptions
------------------

 Dr Solomon's Virus Encyclopedia:
        http://www.drsolomon.com/virus/enc/enc.htm
 free-form searches from the datafellows F-Prot virus description database:
        http://www.datafellows.com/v-descs/
 The AVP database:
        http://www.datarescue.com/avpbase/
        http://www.metro.ch/avpve/

http://www.datafellows.com/vir-info/              Data Fellows Virus Database
http://www.symantec.com/avcenter/vinfodb.html     Symantec Virus Database
http://www.mcafee.com/support/techdocs/vinfo/#top McAfee Virus Database

also ftp://mcafee.com/pub/3rdparty/vsumx603.zip
[VSUM - not highly-rated for its accuracy]

Virus demonstrations
--------------------

 ftp://ftp.uu.net/pub/virus/progs/virsim1.zip

(I haven't checked this one out yet).

 AVP also includes some virus demonstrations, and I know that other
 publishers have demos available.

 There are also virus simulators, which are not quite the same thing.
 These are sometimes advocated as a means of testing antivirus packages,
 but there are dangers to this approach: after all, a package which
 detects one of these simulators as the virus it detects is, technically,
 false-alarming.

See section F6 of the Mark 2 Virus-L FAQ, which is rather good on
types and uses of virus simulation.

Books which may be of use:

        Robert Slade's Guide to Computer Viruses - Springer-Verlag
                Pretty good introduction & general resource. Watch out
                for the 2nd Edition.
        Computers Under Attack (ed. Denning) - Addison-Wesley
                Aging, but some classic texts
        Survivors' Guide to Computer Viruses (ed. Lammer) - Virus Bulletin
                Uneven, but includes useful stuff from Virus Bulletin
        Dr. Solomon's Virus Encyclopedia
                You may from time to time find copies of an older edition
                of this in bookshops, though it's better known as part of
                Dr. Solomon's AntiVirus ToolKit. It's a pretty good guide
                to some of the older viruses.
        A Short Course on Computer Viruses (F. Cohen) - Wiley
                By the man who 'invented' the concept of computer viruses.
                Some aspects are controversial, but a good introduction to
                his work.

The comp.virus FAQ includes pointers to some books.

Useful (but expensive) periodicals:

        Virus Bulletin

                Virus Bulletin Ltd
                21 The Quadrant
                Abingdon
                Oxfordshire
                OX14 3YS

                44 (0) 1234 555139
                Compuserve 100070,1340

        Computers and Security

                Elsevier Advanced Technology
                PO Box 150
                Kidlington
                Oxford
                OX5 1AS

                44 (0) 1865-843666
                [email]

Rather cheaper (though still expensive for the non-corporate
non-specialist in security) is the magazine Secure Computing.
West Coast are launching a corporate licence scheme which may
be of interest to corporate users

        Secure Computing

                West Coast Publishing Ltd.
                William Knox House
                Britannic Way
                Llandarcy
                Swansea
                SA10 6EL
                UK

                44 (0) 1792 324000
                Compuserve 70007,5406

Doubts have been expressed concerning the impartiality or otherwise
of Virus Bulletin, which is a sister company to Sophos, who market
Sweep and other antivirus/security products. VB uses an advisory board
of anti-virus experts from a wide variety of vendors and other
organisations, and its virus statistics are collated monthly from a
variety of sources, not only from Sophos.

Secure Computing, though formerly associated with S&S International, who
market Dr.Solomon's AntiVirus ToolKit and other security products, is
now an independent organization. SC also has input from experts associated
with various vendors and other organisations.

***************************************************************************
* As a regular and reasonably knowledgeable reader of both publications,  *
* I'm personally satisfied that neither displays editorial bias, nor do   *
* I believe that either publication intentionally weights its methodology *
* to the unfair advantage of an affiliated product [DH]                   *
***************************************************************************

The Disaster Recovery Journal (more info & on-line articles)

        http://www.drj.com

(10) Does anyone know about...
==============================

...Mac viruses?
---------------
+++
I have put together an FAQ on Mac/virus issues which expands
on this section at:

	http://www.webworlds.co.uk/dharley/
+++
It's much more up-to-date than this section.

There are around 35 Mac-specific viruses that I know of, though
Apple are, I've heard, quoting 2-300 hundred. I don't know if these
include every minor variant, hypercard infectors, trojans and
macro viruses, but I'll try to find out. There are virtually no
macro viruses which have a Mac-specific payload, but every one I know
of can infect on Macs (and any other platform which runs Word 6.x or
better).

The best single source of information on Mac viruses is the online
help included in the freeware package Disinfectant, which can be
obtained from

        ftp://ftp.acns.nwu.edu/pub/disinfectant
        CompuServe
        GEnie
        America Online
        Calvacom
        Delphi
        BIX
        sumex-aim.stanford.edu
        rascal.ics.utexas.edu
        comp.binaries.mac

Information on Mac viruses is also available from the AntiVirus Catalog/
CARObase (see above).

I've also noticed some Mac virus info at Symantec's web site
(www.symantec.com).

Disinfectant is an excellent anti-virus package: however, it doesn't catch
much in the way of hypercard infectors or trojans, nor does it detect
Word 6 macro viruses. McAfee have a scanner for the Mac which is based on
Disinfectant: version 2, however, includes detection of trojans, macro
viruses etc. You can get a 30-day evaluation copy from

	http://www.mcafee.com/

For other mac packages, try Info-Mac mirrors like:

        ftp://ftp.ucs.ubc.ca/pub/mac/info-mac/vir/

The University of Texas holds the latest versions of Disinfectant and
Gatekeeper, and some documentation on Mac viruses.

        http://wwwhost.ots.utexas.edu/mac/pub-mac-virus.html

Commercial packages include SAM (Symantec AntiVirus for Mac), Virex, and
Dr. Solomon's AntiVirus ToolKit for Macintosh. Dr. Solomon's for Mac has
the unusual capacity for detecting PC boot-sector viruses on DOS floppies,
which could be useful in a mixed environment.

++ ...UNIX viruses?
   ----------------

In general, there are virtually no non-experimental UNIX viruses.
There have been a few Worm incidents, most notably the Morris Worm
(a.k.a. the Internet Worm) of 1988.

There are products which scan some Unix systems for PC viruses,
though any machine used as a file server (Novell, Unix etc.) can be
scanned for PC viruses by a DOS scanner if it can be mounted as a
logical drive on a PC running appropriate network client software
such as PC-NFS.

Intel-based PCs running Unix (e.g. Linux, 386BSD, SCO Unix etc.)
can also be infected by a DOS boot-sector virus if booted from an
infected disk. The same goes for other PC-hosted operating systems
such as NetWare.

While viruses are not a major risk on Unix platforms, integrity
checkers and audit packages are frequently used by system administrators
to detect file changes made by other kinds of attack. However, Unix
security is outside the scope of this FAQ (see comp.security.unix).

In fact, such packages generally target PC viruses more than the
handful of Unix viruses.

CyberSoft sell products for a number of Unix platforms which include
scanning (VFInd) and cryptographic integrity checking. Scanning
includes PC, Mac and Amiga viruses.

	http://www.cyber.com/

Dr. Solomon's Software Ltd. (formerly S&S) have a scanner
which detects (primarily) DOS viruses on SCO Unix.

	http://www.drsolomon.com/

McAfee have a scanner for SunOS, Solaris, FreeBSD and Linux, and
offer downloadable evaluation copies.

	http://www.mcafee.com/

Sophos' Intercheck client-server technology requires a Unix
which is capable of running DOS emulation.

	http://www.sophos.com/

Some other out-and-out DOS scanners may work to some extent on a PC
running emulation, but this is not recommended unless the package is
specifically configurable to run under these circumstances.

[See also the Unix section in the Virus-L/comp.virus FAQ]

A useful book:

        Practical Unix Security (Garfinkel, Spafford) - O'Reilly

Make sure you get the 2nd edition (retitled "Practical Unix and
Internet Security")

...macro viruses?
-----------------

Macro viruses spread from files in applications which use
macros capable of being infected, and are limited to the
specific applications for which they were written.

The macro viruses which are receiving attention currently
are specific to Word 6/WordBasic and Excel: however, many
applications, not all of them Windows applications, have
potentially damaging and/or infective macro capabilities
too.

One, now widespread, infects macros attached to Word
6.0 for Windows, Word 6.0.1 for Macintosh, Word 6.0 for
Windows NT, and Word for Windows 95 documents.

What makes such a virus possible is that the macros
are created by WordBASIC, a program language which links
features used in Word to macros, and even allows DOS
commands to be run.

This virus, named "Concept," has no destructive
payload; it merely spreads, after a document containing the
virus is opened, copying itself to other documents as they
are saved, without affecting the contents of documents.
However, other macro viruses have been discovered, and some
of them contain destructive routines.

Microsoft suggests opening files without macros, to
prevent macro viruses from spreading, unless the user can
verify that the macros contained in the document will not
cause damage.  (This does NOT work for all macro viruses.)

For further info on macro viruses, you might like to try

        http://www.drsolomon.com/
        http://www.datafellows.com/macrovir.htm

Richard Martin is working on an FAQ on this subject.

        ftp.gate.net/pub/users/ris1/word.faq
        http://learn.senecac.on.ca/~jeashe/hsdemonz.htm

or mail to

        [email]

        Subject: PLEASE SEND FAQ

...The AOLgold virus
--------------------

This is actually a trojan. The following is extracted from the CIAC
bulletin (Number G-03).

Apparently, an e-mail message is being circulated that contains an attached
archive file named AOLGOLD.ZIP.  A README file that is in the archive
describes it as a new and improved interface for the AOL online service.
Note that there is no such program as AOLGOLD.  Also, simply reading an
e-mail message or even downloading an included file will not do damage to
your machine.  You must execute (or run) the downloaded file to release
the Trojan and have it cause damage.

If you unzip the archive, you get two files: INSTALL.EXE and README.TXT.
The README.TXT file again describes AOLGOLD as a new and improved interface
to the AOL online service.  The INSTALL.EXE program is a self-extracting ZIP
archive.  When you run the install program, it extracts 18 files onto your
hard drive.

The Trojan program is started by running the INSTALL.BAT file.  The
INSTALL.BAT file is a simple batch file that renames the VIDEO.DRV file to
VIRUS.BAT and then runs it.  VIDEO.DRV is an amateurish DOS batch file that
starts deleting the contents of several critical directories on your C:
drive.

When the batch file completes, it prints a crude message on the screen and
attempts to run a program named DoomDay.EXE.  Bugs in the batch file prevent
the DOOMDAY.EXE program from running.  Other bugs in the file cause it to
delete itself if it is run from any drive but the C: drive.  The programming
style and bugs in the batch file indicates that the Trojan writer appears
to have little programming experience.

You can get this and other CIAC notices from the CIAC Computer Security
Archive.

   World Wide Web:      http://ciac.llnl.gov/
   Anonymous FTP:       ciac.llnl.gov (128.115.19.53)

++...the PKZip trojan virus?
  --------------------------

Most of us prefer to distinguish between trojans and viruses (see Part
1). The threat described in recent warnings is definitely not a virus,
since it doesn't replicate by infection.

There have been at least two attempts to pass off Trojans as an upgrade
to PKZip, the widely used file compression utility. A recent example was
of the files PKZ300.EXE and PKZ300B.ZIP made available for downloading
on the Internet.  An earlier Trojan passed itself off as version 2.0.
For this reason, PKWare have never released a version 2.0 of PKZip:
presumably, if they ever do release another DOS version (unlikely, at
this date, in my opinion), it will not be numbered version 3.0(0).
In fact, there are hardly any known cases of someone downloading and
being hit by this Trojan, which few people have seen (though most
reputable virus scanners will detect it). As far as I know, this Trojan
was only ever seen on warez servers (specialising in pirated software).

There are recorded instances of a fake PKZIP vs. 3 found infected with
a real live in-the-wild file virus, but this too is very rare.
To the best of my knowledge, the latest version of PKZip is 2.04g,
or 2.50 for Windows.
.
+++There was a version 2.06 put together specifically for IBM internal
use only (confirmed by PKWare). If you find it in circulation, avoid
it. It's either illicit or potentially damaging.

The recent rash of resuscitated warnings about this is at least in part
a hoax. It's not a virus, it's a trojan. It doesn't (and couldn't)
damage modems, V32 or otherwise, though I suppose a virus or trojan might
alter the settings of a modem - if it happened to be on and connected....
I don't want to get into hypothetical arguments about programmable
modems right now. It appears to delete files, not destroy disks irrevocably.

It's certainly a good idea to avoid files claiming to be PKZip vs. 3,
but the real risk hardly justifies the bandwidth this alert has
occupied over the last year or so.

...xyz PC virus?
----------------

There are several thousand known PC viruses, and the number 'in the
wild' is in the hundreds. It is not practical to include information
about all of these in this FAQ. However, information about some or
most of those which regularly get asked about may shortly (Real Soon
Now) be available in a separate document. Meanwhile, sources of
information on specific viruses are included in the preceding sections.

There are rarely enquiries about viruses on other computing platforms
raised in alt.comp.virus, but there is some information concerning
viruses on most platforms available at the Virus Test Center in Hamburg.

ftp://ftp.informatik.uni-hamburg.de/pub/virus/texts/catalog/
ftp://ftp.informatik.uni-hamburg.de/pub/virus/texts/carobase/

The following sites also have virus descriptions listed alphabetically:

http://www.DataFellows.com/
http://www.drsolomon.com

...the Psychic Neon Buddha Jesus virus?
---------------------------------------

This is an allegedly humorous bit of javascript programming that found
its way onto a website. On clicking on a particular button, you may be
told that this virus has been detected.Javascript has many interesting
properties, but virus detection is not one of them. It's a joke.

...the blem wit virus?
----------------------

See the Virus-L FAQ. Basically, it's a mangled message that may come
up with older Novell drivers "[pro]blem wit[h]....."

++ The Irina Virus?
   ----------------

Publicity stunt generated by Penguin Books to promote their
'interactive novel'. More info in the 'Viruses and the Mac'
FAQ, a CIAC bulletin on hoax and semi-hoax viruses, the
Computer Virus Myths website, www.drsolomon.com and many other
sources.

++ GHOST
   -----

Just a screensaver...... More info in the CIAC bulletin
mentioned above. I'll fill in some details on Ghost and
Irina when time allows.

+++
General Info on Hoaxes/Erroneous Alerts
---------------------------------------

The CIAC updated bulletion mentioned several times above is
at:

        http://ciac.llnl.gov/ciac/bulletins/h-05.shtml

It includes info on the alerts mentioned below, some historical
background, and suggestions on validating hoaxes rather than
passing them on uncritically.

CIAC have now set up a hoaxes web page at:

	http://ciac.llnl.gov/ciac/CIACHoaxes.html

-----------------extract-------------------------------

                                           INFORMATION BULLETIN

H-05 Internet Hoaxes: PKZ300, Irina,
Good Times, Deeyenda, Ghost

November 20, 1996 16:00 GMT

PROBLEM:       This bulletin addresses the following hoaxes and erroneous
               warnings: PKZ300 Warning, Irina, Good Times, Deeyenda, and
               Ghost.exe
PLATFORM:      All, via e-mail
DAMAGE:        Time lost reading and responding to the messages
SOLUTION:      Pass unvalidated warnings only to your computer security
               department or incident response team. See below on how to
               recognize validated and unvalidated warnings and hoaxes.

VULNERABILITY   New hoaxes and warnings have appeared on the Internet and old
ASSESSMENT:     hoaxes are still being cirulated.

---------------------end extract--------------------------------

Mini-paper on "Dealing with Internet hoaxes":

	http://webworlds.co.uk/dharley/

(11) Is it true that....?
=========================

  (*or* some favourite hoaxes...)

(1) There is *no* Good Times virus that trashes your hard disk
    and launches your CPU into an nth-complexity binary loop when
    you read mail with "Good Times" in the Subject: field.

 You can get a copy of Les Jones' FAQ on the Good Times Hoax from:

  Via FTP:

  ftp://usit.net/pub/lesjones/good-times-virus-hoax-faq.txt
  ftp://members.aol.com/macfaq/good-times-virus-hoax-faq.txt

  On the World Wide Web:

[The URL at http://www.tcp.co.uk/etc. no longer works]
  http://www.nsm.smcm.edu/News/GTHoax.html

There's a Mini-FAQ available as:

  ftp://usit.net/pub/lesjones/Good-Times-Virus-Hoax-Mini-FAQ.txt

    There *is* at least one file virus christened Good Times
    by the individual who posted it in an attempt to cause
    confusion. It is more commonly referred to as GT-spoof.

(2) There is no modem virus that spreads via an undocumented
    subcarrier - whatever that means....

(3) Any file virus can be transmitted as an E-mail attachment.
    However, the virus code has to be executed before it actually
    infects. Sensibly configured mailers don't usually allow this
    by default and without prompting, but certainly some mailers
    can support this: for instance, cc:mail can, it seems, launch
    attachments straight into AmiPro.

[further information on this or other potentially dangerous
associations would be gratefully received]

    There's room for a lot of discussion here. The jury is still
    out on web browsers: Netscape can certainly be set up to do
    things I don't approve of, such as opening a Word document in
    Word without asking.

    Microsoft have made available a Word viewer which reads Word
    files, but doesn't run attached macros. If possible, use this
    instead.

    The term 'ANSI bomb' usually refers to a mail message or other
    text file that takes advantage of an 'enhancement' to the MS-DOS
    ANSI.SYS driver which allows keys to be redefined with an
    escape sequence, in this case to echo some potentially
    destructive command to the console. In fact, few systems
    nowadays run programs which need ANSI terminal emulation to run,
    and there's no guarantee that the program reading the file would
    pass such an escape sequence unfiltered to the console anyway.
    There are plenty of PD or shareware alternatives to ANSI.SYS that
    don't support keyboard redefinition, or allow it to be turned off.

    The term mail bomb is usually applied to the intentional
    bombardment of an e-mail address with multiple copies of a
    (frequently abusive) message, rather than to the above.

    See SimTel/keyboard on sites carrying a SimTel mirror.

(4) There is no known way in which a virus could sensibly be spread
    by a graphics file such as a JPEG or .GIF file, which does not
    contain executable code. Macro viruses work because the files to
    which they are attached are not 'pure' data files.

(5) In general, software cannot physically damage hardware - this
    includes viruses. There is a possibility that specific hardware
    may be damaged by specific code: however, a virus which drops
    a particular payload on the offchance that it's running on a
    system with a particular type of obsolete video card seems more
    than usually futile.

(12) Favourite myths
====================

* DOS file attributes protect executable files from infection

  File attributes are set by software, and can therefore be
  changed by software, including viruses. Many viruses reset a
  ReadOnly/System/Hidden file to Read/Write, infect it, and
  often reset it to the original attributes afterwards.

  This also applies to other software mechanisms such as
  simulating hardware write-protection on a hard disk.

  However, file protection rights in NetWare *can* help to
  contain virus infections, if set up properly, as can
  trustee rights. [Trustee assignments govern whether an
  individual user has right of access to a subdirectory: the
  Inherited Rights Mask governs the protection rights of
  individual files and (sub)directories.]

  Basically, a file virus has the same rights of access as the
  user who happens to inadvertantly activate it.

  Setting up these levels of security is really a function
  of the network Administrator, but you might like to check
  (politely) that yours is not only reassuringly paranoid but
  also knowledgeable about viruses as well as networks, since a
  LAN which is not, in this respect, securely configured, can
  result in very rapid infection and reinfection of files
  across the whole LAN. In particular, accounts with supervisor
  equivalence can, potentially, be the unwitting cause of very
  rapid dissemination of viruses.

  [See also the comp.virus FAQ (version 2) section D]

* I'm safe from viruses because I don't use bulletin boards/shareware/
  Public Domain software.

  Many of the most widely-spread viruses are Boot Sector Infectors,
  which can't normally infect over a serial or network connection.
  Writers of shareware, freeware etc. are no more prone to accidental
  infection than commercial publishers, and possibly less. The only
  'safe' PC is still in it's original wrapping (which doesn't mean
  it isn't already infected...) And don't forget that shrinkwrapped
  software may have been rewrapped.

* FDISK /MBR fixes boot sector viruses.

  The mark II comp.virus FAQ is worth reading on this (see Part 1
  of this FAQ).

  In brief, don't use FDISK /MBR *unless* you're *very* sure of what
  you're doing, as you may lose data. Note also that if you set up the
  drive with a disk manager such as EZDrive, you won't be able to access
  the drive until and unless you can reinstall it.

******************************************************************

(i) What does FDISK /MBR do?
    ------------------------

  It places "clean" partition code onto the partition of your hard disk.
  It does **not change the partition information, however.  The /MBR
  command-line switch is not officially documented and was introduced in
  DOS 5.0

[It does sometimes, and when it does it us usually fatal (for the
common user, anyway). FDISK /MBR will wipe the partition table data if
the last two bytes of the MBR are not 55 AA.]

(ii) What is the partition?
     ----------------------

  The partition sector is the first sector on a hard disk.  It contains
  information about the disk such as the number of sectors in each
  partition, where the DOS partition starts, plus a small program. The
  partition sector is also called the "Master Boot Record" (MBR).

  When a PC starts up it reads the partition sector and executes the
  code it finds there.  Viruses that use the partition sector modify
  this code.

  Since the partition sector is not part of the normal data storage
  part of a disk, utilities such as DEBUG will not allow access to it.

[Unless one assembles into memory]

  Floppy disks do not have a partition sector.

  FDISK /MBR will change the code in a hard disk partition sector.

(iii) What is a boot sector?
      ----------------------

  The boot sector is the first sector on a floppy disk.  On a hard disk
  it is the first sector of a partition. It contains information about
  the disk or partition, such as the number of sectors, plus a small
  program.

  When the PC starts up it attempts to read the boot sector of a disk in
  drive A:.  If this fails because there is no disk it reads the boot
  sector of drive C:.  A boot sector virus replaces this sector with its
  own code and usually moves the original elsewhere on the disk.

  Even a non-bootable floppy disk has executable code in its boot sector.
  This displays the "not bootable" message when the computer attempts to
  boot from the disk.  Therefore, non-bootable floppies can still contain
  a virus and infect a PC if it is inserted in drive A: when the PC
  starts up.

  FDISK /MBR will not change the code in a hard disk boot sector.  Most
  boot sector viruses infect the partition sector of hard disks and
  floppy disk boot sectors: most do not infect the boot sector of a hard
  disk - Form virus is an exception.

(iv) How can I remove a virus from my hard disk's partition sector?
     --------------------------------------------------------------

  There are two main alternatives: run an anti-virus product, or use
  FDISK /MBR.

  Most effective anti-virus products will be able to remove a virus from
  a partition sector, but some have difficulties under certain
  circumstances.  In these cases the user may decide to use FDISK /MBR.

  Unless you know precisely what you are doing this is unwise.  You may
  lose access to the data on your hard disk if the infection was done by
  a virus such as Monkey or OneHalf.

(v) Won't formatting the hard disk help?
    ------------------------------------

  No.  Formatting the hard disk can result in everything being wiped
  from the drive *apart* from the virus.  Format leaves the partition
  sector untouched.  There is always a better way of removing a
  virus infection than formatting the hard disk.

[Clarification: FORMAT alters the DOS partition, but leaves the
*partition sector*, aka MBR, alone.]

******************************************************************

* Write protecting suspect floppies stops infection.

This sounds so silly I hesitate to include it. I've never seen it said
on a.c.v., but I've heard it so often in other contexts, I've included
it anyway. Write-protecting a suspect floppy will only protect that
diskette from *re-infection*, if it's already infected. It won't stop
an infected floppy from infecting other (write-enabled) drives.

If you boot with a disk in drive A which is infected with a boot-sector
virus, the fact that the diskette is write-protected will make no
difference at all.

Write-protecting a *clean* floppy will indeed prevent it from being
infected (but see below!).

* The write protect tab always stops a disk write

Briefly, write protection is built into the hardware on the Mac and
on the PC (and most other systems, of course, but we can't cover
everything), and can't be circumvented in software.

However, it is possible for the hardware to fail: it's not common,
but it happens. Thus when I do a cleanup, I try to create a file on a
sacrificial floppy before risking my R/O boot disk. Sometimes, I
even remember....

Other caveats: a disk which you receive write-protected could have
been de-protected, infected, and re-protected. Even a 3.5" disk with
the write-enable tab removed can be written to by covering the hole
with (e.g.) masking tape. And, of course, shrink-wrapped software
could have been infected before the duplication process.

* I can infect my system by running DIR on an infected disk

If you have a clean PC system, you can't contract a boot sector virus
*or* a file virus just by listing the files on an infected floppy.
Of course, if your PC is infected, you may well infect a *clean* floppy
by using

        DIR A:

It *is* possible to have a scanner report a virus in memory after a
DIR of a floppy with an infected boot sector. The distinction here is
that the virus is *not* actually loaded into memory, so the PC has
*not* been infected.

-----------------------------------------------------------------------

End of a.c.v. FAQ part 2