PCjs Machines
Home of the original IBM PC emulator for browsers.
PC-SIG Diskette Library (Disk #2749)
[PCjs Machine "ibm5170"]
Waiting for machine "ibm5170" to load....
FILE2749.TXT
Disk No: 2749
Disk Title: ShareDebate International #5
PC-SIG Version: S1
Program Title: ShareDebate International #5
Author Version: 4/91
Author Registration: Multiple Registraion plans form $5 and up.
Special Requirements: 384K RAM.
Issue 5's Headlines:
ShareDebate International's first double-disk issue
Featuring 11 popular authors including Jerry Pournelle &
the League for Programming Freedom!
Also, ShareDebate has gone Semi-Annual to half subscription costs!
Spring/Summer 1991 (Issue #5 & #6)
ShareDebate International, a ShareWare disk magazine, formerly a
quarterly, is now semi-annual starting with this double-disk issue (#5 &
6). It is a debate forum for computer users concerned about the present
& future carried by 544 to 1,444 BBSs or Shareware Dealers.
Debates & Articles in This Double Disk Issue
Prior to this issue there were 19 debate topics (named in issue #4).
Five new debate topics have been added. Three are related to the Gulf
War and the Palestinian problem. One is a catch-all topic, which is used
by Sysop-Attorney Paula Goldman in her coverage of recent FCC actions
that impact the computer industry. The other topic covers intellectual
property law and programming freedom. Four position papers of the League
for Programming Freeedom, including one written for ShareDebate
International, kick off this debate.
Benston and Kaufman review the history of S&Ls. Bova writes about
freedom of information over the satellite waves. General Graham writes
on the political limitations imposed on the Patriot. The 28 Americans
killed by the Scud missile didn't need to die. Pournelle discusses how
government hurts progress. Smith assesses the National Interest Project
level Stock market proposal. Schulman's Prometheus- winning novel,
Alongside Night, is excerpted (7 chapters). Martin writes on the Gulf
War and viruses. McAfee Associates' latest version of its virus detector
is included, SCAN76-C.
PC-SIG
1030D East Duane Avenue
Sunnyvale Ca. 94086
(408) 730-9291
(c) Copyright 1991 PC-SIG, Inc.
AGENTS.TXT
McAFEE ASSOCIATES AGENT LISTING
APRIL 8, 1991
McAfee Associates (408) 988-3832 office
4423 Cheeney Street (408) 970-9727 fax
Santa Clara, California 95054 (408) 988-4004 BBS 2400 bps
U.S.A. (408) 988-5138 BBS HST 9600
(408) 988-5190 BBS v32 9600
In order to provide the global community with anti-virus
coverage in a timely manner, McAfee Associates has established an
Agents program in place to provide service, sales and support for
McAfee Associates products around the world. If you do not see
your country listed, please contact McAfee Associates directly. A
listing of North American Agents has been added to the end of this
file.
ASIA
Acer Sertek Inc.
Address: 135 Sec. 2 Chien Kuo N. Road
Taipei 10479, Taiwan, ROC
Contact: Jack Hwang
Telephone: +886 (02) 501-0055
Fax: +886 (02) 501-2521
AUSTRALIA
Computer Virus Clinic
Address: P.O. Box 106
Moorebank, N.S.W. 2170
Contact: Colin Keeble
Telephone: +61 (02) 822-4303
Fax: +61 (02) 822-4304
AUSTRALIA
Computerware for Micros
Address: 23 Magill Road
Stepney, Adelaide, S.A. 5096
Contact: Priestly Hillam
Telephone: +61 (08) 362-8200
Fax: +61 (08) 363-1974
BBS: +61 (08) 363-4293
AUSTRALIA
Doctor Disk (Sydney Office)
Address: 64 Kippax Street
Surrey Hills, NSW 2010
Contact: Robin Edwards
Telephone: +61 (09) 328-2011
+61 (02) 281-2099
Fax: +61 (09) 328-9661
+61 (02) 281-9740
Toll-Free: (008) 999 755 (outside of Perth Metro Area)
AUSTRIA
Terramar Handelsges m.b.H.
Address: Nikolsdorfergaße 8/8
A-1050 Wien
Contact: Ronald Schmutzer
Telephone: +43 (1) 543-731
Fax: +43 (1) 543-339
BELGIUM
Impakt nv
Address: Ham 64
B-9000 Gent
Contact: Frank Lateur
Telephone: +32 (91) 25 35 49
Fax: +32 (91) 33 00 78
BELGIUM
Software Distributors
Address: Dynamicalaan 16
B-2601 Wilrijk
Contact: Arthur Schrey
Telephone: +32 (3) 830 59 92
Fax: +32 (3) 830 25 92
BRAZIL
COMPUSUL Consultoria e Comercio de Informatica Ltda.
Address: Rua Emboabas, 68-1o andar
04623-Sao Paulo, SP
Contact: Andre Pitrowski
Telephone: +55 (11) 533-7331
Fax: +55 (11) 530-6114
BRAZIL
Maple Informatica Ltda.
Address: R. Maranhao, 554 cj. 26
01240 Sao Paulo, SP
Contact: David Rotenberg
Telephone: +55 (11) 825-9390
Fax: +55 (11) 826-5375
BRAZIL
NUPEC Ltda
Address: Rua do Hospicio
981/172 - Boa Vista
CEP 50,060
Recife-PE
Contact: Anatolio de Paula Crespo
Telephone: +55 (81) 222-0698
Fax: +55 (81) 222-0698
CANADA
Concise Systems Corp.
Address: #25 - 1925 Bowen Road
Nanaimo, BC
CANADA V9S 1H1
Contact: Jeff Martin
Telephone: (604) 756-1604
Fax: (604) 756-0123
CANADA
Dolfin Development
Address: 709 Eaglemount Crescent
Mississauga, Ontario
CANADA L5C 1N8
Contact: Mike Cameron
Telephone: (416) 896-7731
Fax: (416) 896-1458
CANADA
Programmers Guild Products
Address: 4652 - 99th Street
Edmonton, Alberta
CANADA T6E 5H5
Contact: George Woycenko
Telephone: (403) 438-5897
Fax: (403) 434-3957
CANADA
Schultz Computers
Address: 1825 Woodward Drive
Ottawa, Ontario
CANADA K2C 0R4
Contact: John Schultz
Telephone: (613) 727-0589
Fax: (613) 727-1264
CHILE
Rigg S.A.
Address: Avda. Salvador 1068
P.O. Box 10.295
Santiago
Contact: Ricardo Gutierrez
Telephone: +56 (2) 225-0222
Fax: +56 (2) 225-0240
FINLAND
Nokia Data Systems
Address: P.O. Box 458
SF-00101 Helsinki
Contact: Kari Ilonen
Telephone: +358 (0) 567 4168
Fax: +358 (0) 567 4160
FINLAND
SAFECO OY
Address: Kirvuntie 22
02140 Espoo
Contact: Hannu Ohrling
Telephone: +358 (0) 512 1100
Fax: +358 (0) 515 151
FRANCE
VIF Micro
Address 12 Avenue des Andes
91940 Les Ulis CEDEX
Contact: Patrick Le Granche
Telephone: +33 (1) 69-07-8632
Fax: +33 (1) 64-46-6831
GERMANY
BFK edv-consulting GmbH
Address: Gerwigstraße 48
W-7500 Karlsruhe 1
Contact: Christoph Fischer
Telephone +49 (7) 2161-1519
Fax: +49 (7) 2162-1479
GERMANY
Die Deutsche Software Bibliothek
Alpenstraße 52
8038 Grobenzell
Contact: Nane Jurgensen
Telephone: +49 (8) 1425-3030
Fax: +49 (8) 1425-4641
GERMANY
Kirschbaum Software, GmbH
Address: Kronau 15
W 8091 Emmering b. Wbg.
Contact: Josef Kirschbaum
Telephone: +49 (0) 8067-1016
Fax: +49 (0) 8067-1053
GERMANY
K.H. Kitroschat, Ingenieurbuero für Neue Technik
Address: Naabstraße 9
W-4006 Erkrath
Contact: Karl-Heinz Kitroschat
Telephone: +49 (02) 1044-8626
Fax: +49 (02) 1044-8626
GERMANY
R. Bucker EDV
Address Nordhemmer Straße 94
W 4955 Hille 1
Contact: Peter Bucker
Telephone: +49 (0) 5703-3669
Fax: +49 (0) 5703-3648
GERMANY
NoVIR
Address: Schursdorfer Weg 10
2409 Scharbeutz 2
Contact: Peter Bohm
Telephone: +49 (0) 4524-1776
Fax: +49 (0) 4524-1419
HONG KONG
The Software Tree Limited
Address: Block E 15/F
Golden Bear Industrial Centre
62-84 Chaiwan Kok Street
Tsuen Wan N.T.
Contact: Isabel Chan
Telephone: +852 (0) 414-4241
Fax: +852 (0) 413-6078
HUNGARY
TOPSOFT Software House
Address: VEND u.3
H-1025 Budapest
Contact: Maria Pistar
Telephone: +36 (1) 135-52-10
Fax: +36 (1) 115-65-16
INDIA
LAN ESEDA Computer Training Centres
Address: 2nd Floor Ramanashree Arcade
18 M.G. Road
(Opposite Taj Residency)
Bangalore 560001
Contact: M.V. Kotappa
Telephone: +91 812 544306
Fax: +91 224 925508
INDONESIA
P.T. Yakin Aman
Address: #15-16, Block FX-1
Jalan Kelapa Gading Boulevard
Jakarta 14240
Contact: M.A. Sunadi
Telephone: +62 (21) 451-0072
Fax: +62 (21) 451-2731
IRELAND
Systemhouse Technology Group Ltd
Address: 39-40 Upper Mount Street
Dublin 2
Contact: Dermot Williams or Stephen Kearon
Telephone: +353 (1) 283-1922
Fax: +353 (1) 288-6224
BBS: +353 (1) 288-5634
+353 (1) 283-1908 HST
ITALY
Ultimobyte Editrice, SRL
Address: Via A. Manuzio, 15
20124 Milano
Contact: Adalberto Fontana
Telephone: +39 (2) 655-5306
Fax: +39 (2) 659-7693
JAMAICA
W.T.G Systems Ltd.
Address: "The Towers"
25 Dominca Drive
Kingston 5
Contact: Robert Davies
Telephone: (809) 929-9250
Fax: (809) 929-8296
MALAYSIA
MCSB Systems (M) Sdn Bhd
Address: 17th Floor Menara Bousted
Jalan Raja Chulan
50200 Kuala Lumpur
Contact: Mr. M.F. Leong
Telephone: +60 (3) 241 7400
Fax: +60 (3) 248 8010
MEXICO
Mundo PC, S.A.
Address: Rio San Lorenzo No. 507-A OTE
Garza Garcia
N.L. 66220
Contact: Roberto Herrera
Telephone: +52 (8) 378-34-48
Fax: +52 (8) 378-34-40
NEW ZEALAND
Computer Software Library of NZ, Ltd.
Address: R.D. 3
Timaru
Contact: Bill Strauss
Telephone: +63 (3) 615-9333
Fax: +63 (3) 615-9333
NETHERLAND ANTILLES
Micro Computer Consultants
Address: Fokkerweg 30
Muskus Building
Willemstad Curaco
Contact: Edison Maduro
Telephone: +599 (9) 61 31 61
Fax: +599 (9) 61 61 19
PORTUGAL
Fobis, Informatic e Gestao, Lda.
Address: Praca de Londres 3-1.Dt
P-1000 Lisboa
Contact: Luis Dias
Telephone: +351 (1) 848 31 84
Fax: +351 (1) 715 11 11
SAUDI ARABIA
Gulf Stars Computer Systems
Address: Suite #201/202,
Al Banafaea Building
Riyadh 11573
Contact: Anwah Qahwash
Telephone: +966 (1) 463-1098
Fax: +966 (1) 465-3156
SPAIN
DATAMON, SA
Address: Corcega, 485
08025 Barcelona
Contact: Carmen Navarro
Telephone: +34 (3) 207-2704
Fax: +34 (3) 257-1370
SWEDEN
Virus Help Center
Address: Box 1237
S 801 37 Gävle, Sweden
Contact: Mikael Larsson
Telephone: +46 (26) 100518
Fax: +46 (26) 275720
BBS: +46 (26) 275710
SWITZERLAND
Computer Concepts AG
Address: Postfach 104
CH-8606 Naenikon
Contact: Marcus Laubli
Telephone: +41 (1) 941-6229
Fax: +41 (1) 941-6229
UNITED ARAB EMIRATES
Al Bawardi Computers
Address: Flat 301, Third Floor, Grandstore Building
Hamdan Street, P.O. Box 4118
Abu Dhabi
Contact: Syed Rehan Aziz
Telephone: +971 (2) 721777
Fax: +971 (2) 727357
UNITED KINGDOM
International Data Security
Address: 37/41 Gower Street
London WC1E 6HH
Contact: Grace Fodor
Telephone: +44 (71) 631 0548
Fax: +44 (71) 580 1466
ZAMBIA
KBM Software Plaza
Address: P.O. Box 320139
Woodlands
Lusaka
Contact: (Ms.) Kasonde B. Mwila
Telephone: +260 (1) ?
Fax: +260 (1) 210400
UNITED STATES
AMI Data Systems
Address: 2778 Shasta Road
Berkeley, CA 94708
Contact: John Mace
Telephone: (415) 843-3204
Fax: (415) 843-3204
UNITED STATES
Blue Chip Computer Company
Address: 3085 Woodman Drive
Dayton, OH 45420
Contact: Larry Song
Telephone: (513) 299-4594
Fax: (513) 298-5798
UNITED STATES
CDT, Inc.
Address: 3110 Rhapsody Court
Colorado Springs, CO 80920
Telephone: (719) 260-0567
Fax: (719) 531-5256
UNITED STATES
Computer Security Plus, Inc.
Address: 200 East Robinson St., Suite 890
Orlando, FL 32801
Contact: Padgett Peterson
Telephone: (407) 648-0709
Fax: (407) 648-0733
UNITED STATES
Jetics Inc.
Address: 8229 Boone Blvd. Suite 860
Vienna, VA 22182
Contact: Wayne Carpenter
Telephone: (703) 893-4404
Fax: (703) 821-0710
UNITED STATES
Jim's Consulting Services
Address: 24 Frank Lloyd Wright Drive
Ann Arbor, MI 48106
Contact: Jim Shaeffer
Telephone: (313) 930-5838
Fax: (313) 429-1963
UNITED STATES
Microplus Systems Technologies
Address: 1020 East El Camino Real
Sunnyvale, CA 94087
Contact: Ralph Manildi or Bui Han
Telephone: (408) 737-2525
Fax: (408) 737-2402
UNITED STATES
MSB Computing Environments
Address: 626 Walnut Street, Suite 207
San Carlos, CA 94070
Contact: Fritz Schneider
Telephone: (415) 637-0119
Fax: (408) 739-3204
Internet: msb-ce@cup.portal.com
UNITED STATES
NetLAN
Address: 29 West 38th Street
New York, NY 10018
Contact: Al Berg
Telephone: (212) 768-2273
Fax: (212) 768-2201
UNITED STATES
OverFlow Corporation
Address: 5200 SW Macadam, Suite 320
Portland, OR 97201
Contact: Dean Warren
Telephone: (503) 228-7838
Fax: (503) 228-7908
UNITED STATES
Standard Systems Solutions, Inc.
Address: 410 West Commercial Street
East Rochester, NY 14445
Contact: Steve Smith
Telephone: (716) 586-2460
Fax: (716) 586-0936
UNITED STATES
TIEX Computer/Communications Products
Address: 13748 Neutron Road
Dallas, TX 75244
Contact: Bill Geiser
Telephone: (214) 392-0647
Fax: (214) 385-072
UNITED STATES
VacciVirus
Address: 84 Hammond Street
Waltham, MA 02154
Contact: Roger Aucoin
Telephone: (617) 893-8282
Fax: (617) 969-0385
REGISTER.DOC
USE OF McAFEE ASSOCIATES PROGRAMS
The McAfee Associates VIRUSCAN series is distributed as shareware
for home use, but must be licensed for use within a business,
corporation, or organization. This includes educational institutions
and government agencies. If you have or suspect computer virus
infection, you are allowed to use the software for five (5) days free of
charge to isolate and remove the computer virus or suspect computer
virus. We will provide you with assistance if requested.
If you are a shareware distributor, you may distribute all software
listed below in the registration form as long as you contact McAfee
Associates for permission first. You must distribute the all the
files intact and in unmodified form (duplicate files may be removed)
and may not charge more than a reasonable disk copying fee. You must
obtain updates from our BBS at the number below.
If you are a System Operator and run a publically-accessable BBS
for which their is no fee for use then you may use the software
free of charge--that's our way of saying thanks.
REGISTRATION FOR McAFEE ASSOCIATES PROGRAMS
Registration is required for the use of the VIRUSCAN, SHIELD
and CLEAN-UP program series in a home environment. This form
should be used to register a program.
Registered users of the VIRUSCAN programs receive free
technical support and assistance with virus infections in the form
of walk-throughs of virus removal. The nine line McAfee Associates
Bulletin Board (mail box) is available to access to the latest versions
of the VIRUSCAN series and for downloads of virus-related information.
Registered users obtain free upgrades for their registered
programs for a period of one year after registration, provided they
are downloaded from the BBS.
Diskettes are not mailed to registered users unless
specifically requested. Diskettes are mailed first class in the
U.S. and by airmail for foreign countries. For such mailings,
please add $9.00US. Only one mailing will be made to registered
users.
Corporate, business and organizational users require a site
license for the use of the VIRUSCAN programs. For site license
information please contact McAfee Associates at the address or
phone number below.
==CUT HERE===============================================CUT HERE==
REGISTRATION FORM For Individual Home Users
PROGRAM: # COPIES: AMOUNT:
CLEAN-UP ($35 per copy) _________ $______________
VIRUSCAN ($25 per copy) _________ $______________
VSHIELD ($25 per copy) _________ $______________
SENTRY ($25 per copy) _________ $______________
FSHIELD ($25 per copy) _________ $______________
VCOPY ($15 per copy) _________ $______________
- ADD - $9 for Diskette (5.25" 360K only) $______________
(All programs and documentation fit on one diskette)
TOTAL $______________
PAYMENT BY:
Check/Money Order No.__________ enclosed for $____________________
OR CHARGE: MasterCard ______ Visa ______
Card Number_______________________________________________________
Name on Card______________________________________________________
Exp. Date_________________________________________________________
Signature_________________________________________________________
MAILING ADDRESS:
NAME______________________________________________________________
ADDRESS LINE 1____________________________________________________
ADDRESS LINE 2____________________________________________________
CITY/STATE/PROVINCE_______________________________________________
COUNTRY/POSTAL CODE_______________________________________________
HOME PHONE________________________________________________________
OFFICE PHONE______________________________________________________
SEND TO: +----------------------------+
McAfee Associates | OR SEND TO ANY OF THE |
4423 Cheeney Street | THE AUTHORIZED AGENTS |
Santa Clara, California | LISTED IN THE ACCOMPANYING |
95054-0253 USA | AGENTS.TXT FILE. |
+----------------------------+
(408) 988-3832 Voice - Use this # for questions/bug reports
(408) 988-4004 BBS - Use this # for obtaining program upgrades
(408) 988-5138 BBS US Robotics HST 9600 (HST)
(408) 988-5190 BBS US Robotics HST 9600 Dual Standard (HST/v.32)
(408) 970-9727 FAX
==CUT HERE===============================================CUT HERE==
SCAN76-C.DOC
VIRUSCAN Version 7.2C76
Copyright (C) 1989, 1990, 1991 by McAfee Associates.
All rights reserved.
Documentation by Aryeh Goretsky.
McAfee Associates (408) 988-3832 office
4423 Cheeney Street (408) 970-9727 fax
Santa Clara, CA 95054-0253 (408) 988-4004 BBS 2400 bps
U.S.A. (408) 988-5138 BBS HST 9600
(408) 988-5190 BBS v32 9600
TABLE OF CONTENTS:
SYNOPSIS . . . . . . . . . . . . . . . . . . . . . . . . . . .2
- What VIRUSCAN is, system requirements
AUTHENTICITY . . . . . . . . . . . . . . . . . . . . . . . . .2
- Verifying the integrity of VIRUSCAN
WHAT'S NEW . . . . . . . . . . . . . . . . . . . . . . . . . .3
- Features, new viruses added in this release
OVERVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . .4
- Detailed description of VIRUSCAN
OPERATION. . . . . . . . . . . . . . . . . . . . . . . . . . .5
- How to use VIRUSCAN
EXAMPLES . . . . . . . . . . . . . . . . . . . . . . . . . . .8
- Samples of frequently-used options
EXIT CODES . . . . . . . . . . . . . . . . . . . . . . . . . .9
- For running VIRUSCAN from batch files
VIRUS REMOVAL. . . . . . . . . . . . . . . . . . . . . . . . .9
- How to manually remove a virus
REGISTRATION . . . . . . . . . . . . . . . . . . . . . . . . .10
- How to register VIRUSCAN
TECH SUPPORT . . . . . . . . . . . . . . . . . . . . . . . . .10
- Information you should have ready when calling
APPENDIX A . . . . . . . . . . . . . . . . . . . . . . . . . .11
- Creating a virus string file with the /EXT option
Page 1 VIRUSCAN Version 7.2C76 Page 2
SYNOPSIS
VIRUSCAN (SCAN) is a virus detection and identification
program for the IBM PC and compatible computers. VIRUSCAN will
search a PC for known computer viruses in memory, the boot sector,
the partition table, and the files of a PC and its disks. VIRUSCAN
will also detect the presence of unknown viruses.
SCAN works by searching the system for instruction sequences
or patterns that are unique to each computer virus, and then
reporting their presence if found. This method works for viruses
that VIRUSCAN recognizes. To detect unknown viruses, VIRUSCAN can
append a validation code or "CRC check" to .COM and .EXE files.
If the file has been modified in any way, SCAN will report that
infection may have occurred. VIRUSCAN can also look for new
viruses from a user-supplied list of virus search strings.
VIRUSCAN runs on any PC with 256Kb and DOS version 2.00 or
greater.
AUTHENTICITY
VIRUSCAN runs a self-test when executed. If SCAN has been
modified in any way, a warning will be displayed. The program will
still continue to check for viruses, though. If SCAN reports that
it has been damaged, it is recommended that a clean copy be
obtained.
VIRUSCAN versions 46 and above are packaged with the VALIDATE
program to ensure the integrity of the SCAN.EXE file. The
VALIDATE.DOC instructions tell how to use the VALIDATE program.
The VALIDATE program distributed with VIRUSCAN may be used to check
all further versions of SCAN.
The validation results for Version 76-C should be:
FILE NAME: SCAN.EXE
SIZE: 58,467
DATE: 04-09-1991
FILE AUTHENTICATION
Check Method 1: A9AB
Check Method 2: 158B
If your copy of SCAN.EXE differs, it may have been modified.
Always obtain your copy of VIRUSCAN from a known source. The
latest version of VIRUSCAN and validation data for SCAN.EXE can be
obtained off of McAfee Associates' bulletin board system at (408)
988-4004.
Beginning with Version 72, all McAfee Associates programs for
download are archived with PKWare's PKZIP Authentic File
Verification. If you do not see the "-AV" message after every file
is unzipped and receive the message "Authentic Files Verified!
# NWN405 Zip Source: McAFEE ASSOCIATES" when you unzip the files
then do not run them. If your version of PKUNZIP does not have
verification ability, then this message may not be displayed.
Please contact McAfee Associates if your .ZIP file has been
tampered with.
VIRUSCAN Version 7.2C76 Page 3
WHAT'S NEW
Version 76-C of SCAN fixes a false alarm with the Friday-13
virus.
Version 76 of VIRUSCAN adds 18 new viruses, bringing the
total number of known computer viruses to 239, for a total of 501
viruses including strains. The enclosed VIRLIST.TXT file outlines
the characteristics of the new viruses. For a comprehensive
discussion of each of the viruses, we recommend that you access the
VSUM document copyrighted by Patricia Hoffman. It is available on
most bulletin board systems.
In addition, two new command line options have been added to
improve batch mode operation of SCAN: The /NOPAUSE option turns
off the screen pause that occurs when SCAN fills up a screen with
messages. The /NOBREAK option will prevent SCAN from stopping when
a Control-C or Control-Break is issued.
VIRUSCAN Version 7.2C76 Page 4
OVERVIEW
VIRUSCAN scans diskettes or entire systems for pre-existing
computer virus infections. It will identify the virus infecting
the system, and tell what area of the system (memory, boot sector,
file) the virus occupies. An infected file can be removed with
the overwrite-and-delete option, /D which will erase the file.
The CLEAN-UP program is also available to automatically disinfect
the system and repair damaged areas whenever possible.
VIRUSCAN Version 76 identifies all 239 known computer viruses
along with their variants. Some viruses have been modified so that
more than one "strain" exists. Counting such modifications, there
are 501 virus variants. The ten most common viruses which account
for over 95% of all reported PC infections are also identified by
SCAN. The accompanying VIRLIST.TXT file lists describes all new,
public domain, and extinct computer viruses identified by SCAN.
The number of variants of each virus is listed in parentheses after
the virus name.
All known computer viruses infect one or more of the
following areas: the hard or fixed disk partition table [also
known as the master boot record]; the DOS boot sector of hard disks
and floppy disks; or one or more executable files within the
system. Executable files include operating system files, .COM
files, .EXE files, overlay files, or any other files loaded into
memory and executed. A virus that infects more than one area, such
as a boot sector and an executable file is called a multipartite
virus.
VIRUSCAN identifies every area or file that is infected, and
indicates both the name of the virus and CLEAN-UP I.D. code used
to remove it. SCAN will check the entire system, an individual
diskette, sub-directory, or individual files for existing viruses.
VIRUSCAN will also check for new, unknown viruses with the Add
Validation and Check Validation options. This is done by computing
a code for a file, appending it to the file, and then validating
the file against that code. If the file has been modified, the
check will no longer match, indicating that viral infection may
have occurred. SCAN uses two independently generated CRC (Cyclic
Redundancy Check) checks that are added to the end of program files
to do this. Files which are self-checking should not be validated
since this will "set off" the program's self-check. Files which
are self-modifying may have different values for the same program
depending upon the modifications. VIRUSCAN adds validation codes
to .COM and .EXE files only. The validation codes for the
partition table, boot sector, and system files, are kept in a
hidden file called SCANVAL.VAL in the root directory.
VIRUSCAN can also be updated to search for new viruses via
an External Virus Data File option, which allows the user to
provide the VIRUSCAN program with new search strings for viruses.
VIRUSCAN can display messages in either English or French.
VIRUSCAN works on stand-alone and networked PC's, but not on
a file server. For networks, the NETSCAN file server-scanning
program is required.
VIRUSCAN Version 7.2C76 Page 5
OPERATION
IMPORTANT NOTE: WRITE PROTECT YOUR FLOPPY DISK BEFORE SCANNING
YOUR SYSTEM TO PREVENT INFECTION OF THE VIRUSCAN PROGRAM.
VIRUSCAN will check each area or file on the designated
drive(s) that could be host to a virus. If a virus is found, a
message is displayed telling the name of the infected file or
system area and the name of the identified virus. SCAN will
examine files for viruses based on their extensions. The default
executable extensions supported by SCAN are .BIN, .COM, .EXE, .OV?,
.PGM, .PIF, .PRG, .SYS and .XTP. Additional extensions can be
added to SCAN or all files on disk can be selected for scanning.
To run VIRUSCAN type:
SCAN d1: ... d10: /A /AV /CV /D /E .xxx .yyy .zzz /EXT d:filename
/FR /MANY /NLZ /NOBREAK /NOMEM /NOPAUSE
/REPORT d:filename /RV
Options are:
\ - Scan root directory and boot area only
/A - Scan all files, including data, for viruses
/AV - Add validation codes to specified files
/CV - Check validation codes for files
/D - Overwrite and delete infected file
/E .xxx .yyy .zzz - Scan overlay extensions .xxx .yyy .zzz
/EXT d:filename - Scan using external virus information file
/FR - Display messages in French
/M - Scan memory for all viruses
(see below for specifics)
/MANY - Scan multiple floppies
/NLZ - Skip internal scan of LZEXE compressed files
/NOBREAK - Disable Ctrl-C / Ctrl-Brk during scanning
/NOMEM - Skip memory checking
/NOPAUSE - Disable screen pause when scanning
/REPORT d:filename - Create report of infected files
/RV - Remove validation codes from specified files
(d1: ... d10: indicate drives to be scanned)
The /A option will cause SCAN to check all files on the
referenced drive. This should only be used if a file-infecting
virus has already been detected. Otherwise the /A option should
only be used when checking a new program. The /A option will add
a substantial time to scanning. This option takes priority over
the /E option.
The /AV option allows the user to add validation codes to the
files being scanned. If a full drive is specified, SCAN will
create validation data for the partition table, boot sector, and
system files of the disk as well. Validation adds ten (10) bytes
to files; the validation data for the partition table, boot sector,
and system files is stored separately in a hidden file in the root
directory of the scanned drive.
VIRUSCAN Version 7.2C76 Page 6
The /CV option checks the validation codes inserted by the /AV
option. If the file has been changed, SCAN will report that the
file has been modified, and that viral infection may have occurred.
Using the /CV option adds about 25% more time to scanning.
NOTE: Some older Hewlett Packard and Zenith PC's modify the boot
sector or partition table each time the system is booted. This
will cause SCAN to continually notify the user of boot sector or
partition table modifications if the /CV switch is selected. Check
your system's manual to determine if your system contains
self-modifying boot code.
The /D option tells VIRUSCAN to prompt the user to overwrite
and delete an infected file when one is found. If the user selects
"Y" the infected file will be overwritten with hex code C3 [the
Return-to-DOS instruction] and then deleted. A file erased by the
/D option can not be recovered. If the McAfee Associates' CLEAN-
UP program is available, it is recommended that CLEAN be used to
remove the virus instead of SCAN, since in most cases it will
recover the infected file. Boot sector and partition table
infectors can not be removed by the /D option and require the
CLEAN-UP virus disinfection program.
The /E option allows the user to specify an extension or set
of extensions to scan. Extensions should include the period
character "." and be separated by a space after the /E and between
each other. Up to three extensions may be added with the /E. For
more extensions, use the /A option.
The /EXT option allows VIRUSCAN to search for viruses from a
text file containing user-created search strings. The syntax for
using the external virus data file is /EXT d:filename, where d: is
the drive name and filename is the name of the external virus data
file. For instructions on how to create an external virus data
file, refer to Appendix A.
NOTE: The /EXT option is intended for advanced users and computer
anti-virus researchers to add their own strings for detection of
computer viruses on an interim or emergency basis. When used with
the /D option, it will delete infected files. This option is not
recommended for general use and should be used with caution.
The /FR option tells VIRUSCAN to output all messages in French
instead of English.
The /M option tells VIRUSCAN to check system memory for all
known computer viruses that can inhabit memory. SCAN by default
only checks memory for critical and "stealth" viruses, which are
viruses which can cause catastrophic damage or spread the infection
during the scanning process. SCAN will check memory for the
following viruses in any case:
1554 1971 1253 2100
3445-Stealth 4096 512 Anthrax
Brain Dark Avenger Disk Killer Doom-2
EDV Fish6 Form Invader
Joshi Microbes Mirror Murphy
Nomenclature Phantom Plastique Polish-2
P1R (Phoenix) Taiwan-3 Whale Zero-Hunt
VIRUSCAN Version 7.2C76 Page 7
If one of these viruses is found in memory, SCAN will stop and
advise the user to power down, and reboot the system from a
virus-free system disk. Using the /M option with another
anti-viral software package may result in false alarms if the other
package does not remove its virus search strings from memory. The
/M option will add 6 to 20 seconds to the scanning time.
The /MANY option is used to scan multiple diskettes placed in
a given drive. If the user has more than one floppy disk to
check for viruses, the /MANY option will allows the user to check
them without having to run SCAN multiple times. If a system has
been disinfected, the /MANY and /NOMEM options can be used to speed
up scanning of disks.
The /NLZ option tells VIRUSCAN not to look inside files
compressed with the LZEXE file compression program. SCAN will
still check the programs for external infections.
The /NOBREAK option disables Control-C or Control-Break from
stopping VIRUSCAN while running.
The /NOMEM option is used to turn off all memory checking for
viruses. It should only be used when a system is known to be free
of viruses.
The /NOPAUSE option disables the "More..." prompt that appears
when SCAN fills up a screen with data. This allows VIRUSCAN to run
on a machine with multiple infections without requiring operator
intervention when the screen fills up with messages from the SCAN
program.
The /REPORT option is used to generate a listing of infected
files. The resulting list is saved to disk as an ASCII text file.
To use the report option, specify /REPORT on the command line,
followed by the device and filename [See EXAMPLES below for
samples].
The /RV option is used to remove validation codes from a file
or files. It can be used to remove the validation code from a
diskette, subdirectory, or file(s). Using /RV on a disk will
remove the partition table, boot sector, and system file
validation. This option can not be used with the /AV option.
VIRUSCAN Version 7.2C76 Page 8
EXAMPLES
The following examples are shown as they would be typed in.
SCAN C:
To scan drive C:
SCAN A:R-HOOPER.EXE
To scan file "R-HOOPER.EXE" on drive A:
SCAN A: /A
To scan all files on drive A:
SCAN B: /D /A
To scan all files on drive B:, and prompt for erasure of
infected files.
SCAN C: D: E: /AV /NOMEM
To add validation codes to files on drives C:, D:, and
E:, and skip memory checking.
SCAN C: D: /M /A /FR
To scan memory for all known and extinct viruses, as well
as all files on drives C: and D:, and output all messages
in French.
SCAN C: D: /E .WPM .COD
To scan drives C: and D:, and include files with the
extensions .WPM and .COD
SCAN A: /CV
To check for known and unknown viruses (via the
validation codes) on drive A:
SCAN C: /EXT A:SAMPLE.ASC
To scan drive C: for known computer viruses and also for
viruses added by the user via the external virus data
file option.
SCAN C: /M /REPORT A:INFECTN.RPT
To scan for all viruses in memory and drive C:, and
create a log on drive A: called INFECTN.RPT
SCAN C: D: /NOPAUSE /REPORT B:VIRUS.RPT
To scan drives C: and D: for viruses without stopping,
and
create a log on drive B: called VIRUS.RPT
VIRUSCAN Version 7.2C76 Page 9
EXIT CODES
VIRUSCAN will set the DOS ERRORLEVEL upon program termination
to:
ERRORLEVEL | DESCRIPTION
-----------+--------------------------
0 | No viruses found
1 | One or more viruses found
2 | Abnormal termination (program error)
If a user stops the scanning process, SCAN will set the ERRORLEVEL
to 0 or 1 depending on whether or not a virus was discovered prior
to termination of the SCAN. The /NOBREAK option can be used to
prevent scanning from being stopped.
VIRUS REMOVAL
What do you do if a virus is found? You can contact McAfee
Associates for assistance with manually removing the virus, for
disinfection utilities, and for more information about the virus.
The CLEAN-UP universal virus disinfection program is available and
will disinfect the majority of reported computer viruses. It is
updated frequently to remove new viruses. The CLEAN-UP program can
be downloaded from McAfee Associates BBS.
It is strongly recommended that you get experienced help in
dealing with viruses, especially critical viruses that can damage
or destroy data [for a listing of critical viruses, see the /M
option under OPTIONS, above] and partition table or boot sector
infecting viruses, as improper removal of these viruses could
result in the loss of all data and use of the disk(s).
IF CLEAN-UP IS NOT AVAILABLE, THEN FOR:
BOOT SECTOR INFECTORS
Power down the infected system and boot off of an uninfected,
write-protected diskette. Use the DOS SYS command to attempt
to overwrite the boot sector. This works in many cases. Run
VIRUSCAN to see if the virus has been eradicated. If this
does not work, do a file-by-file backup of the system (in
other words, do not backup the boot sector) and do a low-level
format of the disk. For a floppy diskette, copy the files off
of the infected diskette using the DOS COPY command, not XCOPY
or DISKCOPY which will transfer the virus. Reformat or
discard the infected floppy disk.
FILE INFECTORS
Power down the infected system and boot off of an uninfected,
write-protected diskette. Run VIRUSCAN with the /D and /A
options. Scan all original disks for viruses and replace
programs from them if clean.
VIRUSCAN Version 7.2C76 Page 10
PARTITION TABLE INFECTORS
Power down the infected system and boot off of an uninfected,
write-protected diskette. Proceed to do a file-by-file backup
of the system (in other words, do not backup the partition
table). Then do a low-level format of the disk.
Disinfection utilities are available for the majority of reported
computer viruses, these programs can be downloaded from McAfee
Associates' BBS at (408) 988-4004.
REGISTRATION
A registration fee of $25.00US is required for the use of
VIRUSCAN by individual home users. Registration is for one year
and entitles the holder to unlimited free upgrades off of McAfee
Associates BBS. Diskettes are not mailed unless requested. Add
$9.00US for diskette mailings. Only one diskette mailing will be
made.
Registration is for home users only and does not apply to
businesses, corporations, organizations, government agencies, or
schools, who must obtain a license for use. Contact McAfee
Associates for more information.
Outside of America, registration and support may be obtained
from the Agents listed in the accompanying AGENTS.TXT file.
TECH SUPPORT
For fast and accurate help, please have the following
information
prepared when you contact McAfee Associates:
- Program name and version number.
- Type and brand of computer, hard disk, plus any
peripherals.
- Version of DOS you are running, plus any TSRs or device
drivers in use.
- Printouts of your AUTOEXEC.BAT and CONFIG.SYS files.
- The exact problem you are having. Please be as specific
as possible. Having a printout of the screen and/or
being at your computer will help also.
McAfee Associates can be contacted by BBS or fax twenty-four hours
a day, or call our business office at (408) 988-3832, Monday
through Friday, 8:30AM to 6:00PM Pacific Standard Time.
McAfee Associates (408) 988-3832 office
4423 Cheeney Street (408) 970-9727 fax
Santa Clara, CA 95054-0253 (408) 988-4004 BBS 2400 bps
U.S.A (408) 988-5138 BBS HST 9600
(408) 988-5190 BBS v32 9600
If you are overseas, please refer to the AGENTS.TXT file for
a listing of McAfee Associates Agents for support or sales.
VIRUSCAN Version 7.2C76 Page 11
APPENDIX A: Creating a Virus String File with the /EXT Option
The External Virus Data file should be created with an editor
or a word processor and saved as an ASCII text file. Be sure each
line ends with a CR/LF pair.
NOTE: The /EXT option is intended for emergency and research use
only. It is an temporary method for identifying new viruses prior
to the subsequent release of SCAN. A sound understanding of
viruses and string-search techniques is advised as a prerequisite
for using this option.
The virus string file uses the following format:
#Comment about Virus_1
"aabbccddeeff..." Virus_1_Name
#Comment about Virus_2
"gghhiijjkkll..." Virus_2_Name
.
.
"uuvvwwxxyyzz..." Virus_n_Name
Where aa, bb, cc, etc. are the hexadecimal bytes that you wish to
scan for. Each line in the file represents one virus. The Virus
Name for each virus is mandatory, and may be up to 25 characters
in length. The double quotes (") are required at the beginning and
end of each hexadecimal string.
SCAN will use the string file to search memory, the Partition
Table, Boot Sector, System files, all .COM and .EXE files, and
Overlay files with the extension .BIN, .OV?, .PGM, .PIF, .PRG, .SYS
and .XTP.
Virus strings may contain wild cards. The two wildcard
options are:
FIXED POSITION WILDCARD
The question mark "?" may be used to represent a wildcard in
a fixed position within the string. For example, the string:
"E9 7C 00 10 ? 37 CB"
would match "E9 7C 00 10 27 37 CB", "E9 7C 00 10 9C 37 CB", or any
other similar string, no matter what byte was in the fifth place.
RANGE WILDCARD
The asterisk "*", followed by range number in parentheses "("
and ")" is used to represent a variable number of adjoining random
bytes. For example, the string:
"E9 7C *(4) 37 CB"
would match "E9 7C 00 37 CB", "E9 7C 00 11 37 CB", and
"E9 7C 00 11 22 37 CB". The string "E9 7C 00 11 22 33 44 37 CB"
would not match since the distance between 7C and 37 is greater
than four bytes. You may specify a range of up to 99 bytes.
VIRUSCAN Version 7.2C76 Page 12
Up to 10 different wildcards of either kind may be used in one
virus string.
COMMENTS
A pound sign "#" at the begining of a line will denote that
it is a comment. Use this for adding notes to the external virus
data file. For example:
#New .COM virus found in file FRITZ.EXE from
#Schneiderland on 01-22-91
"53 48 45 45 50" Fritz-1 [F-1]
Could be used to store a description of the virus, name of the
original infected file, where and when it was received, and so
forth.
VALIDATE.DOC
VALIDATE Version 0.3
From McAfee Associates
(408) 988-3832
VALIDATE is a file-authentication program that may be used to
check other programs for signs of tampering. VALIDATE uses two
discrete methods to generate Cyclic Redundancy Checks (CRC's),
which are then displayed for the user to compare against the known
value for the program(s) validated. The known validation data can
be published by the author of the program or be obtained from a
trusted information database. The dual CRC checking provides a
high degree of security.
The Computer Virus Industry Association (CVIA) provides an
online database of validation values for shareware authors at no
cost. You are encouraged to call the CVIA's BBS at (408) 988-4004
to access current validation data for McAfee Associates' VIRUSCAN,
California Software Concepts' SHEZ, Vern Berg's LIST, and other
shareware programs.
To confirm that a program is in its original, untampered
state, run the VALIDATE program on it, record the validation data
produced, and compare it against the record in the online database.
If they match, than it is highly improbable (less than one in
sixty-four quadrilion) that the program has been modified.
To run VALIDATE, type:
VALIDATE d:\path\filename.ext
The VALIDATE program will then display the following information:
Size: (#/bytes)
Date: (file creation date)
File Authentication
Check Method 1: (a four digit CRC)
Check Method 2: (a four digit CRC)
The VALIDATE program may be copied and distributed at no charge as
long as it is distributed whole and intact and unmodified in any
way, along with this file. Please report virus infections and
reports of program tampering to:
Computer Virus Industry Association
4423 Cheeney Street
Santa Clara, CA 95054-0253
USA
(408) 727-4559 telephone answering machine
The validation data for VALIDATE.COM is:
WITH CRC WITHOUT
CHECKING CHECKING
Size: 6495 6485
Date: 10-31-1989 10-31-1989
File Authentication
Check Method 1: 4637 CB21
Check Method 2: 1214 13B7
If you have an older version of VALIDATE, it may be ten (10)
bytes shorter. This is because it was not processed by VIRUSCAN's
CRC-checking feature, added in Version 66 of VIRUSCAN. The
validation code can be removed from VALIDATE.COM by running
VIRUSCAN against it with the /RV Remove Validation option.
However, this is not recommended.
VIRLIST.TXT
VIRUS CHARACTERISTICS LIST V76
Copyright 1989, 1990, 1991 McAfee Associates
All Rights Reserved.
(408) 988-3832
The following list outlines the major characteristics of the known
IBM PC and compatible virus strains identified by SCAN. The number
of known varients of each virus is also listed. This number is listed
in parenthesis beside the name of the strain. The total number of
known viruses is summed at the end of the list. The Clean-Up virus I.D.
code is included in brackets. An asterisk ("*") in front of a virus name
denotes an extinct computer virus.
==========================================================================
A Infects Fixed Disk Partition Table-A-------------------+
9 Infects Fixed Disk Boot Sector-----9-----------------+ |
8 Infects Floppy Diskette Boot-------8---------------+ | |
7 Infects Overlay Files--------------7-------------+ | | |
6 Infects EXE Files------------------6-----------+ | | | |
5 Infects COM files------------------5---------+ | | | | |
4 Infects COMMAND.COM----------------4-------+ | | | | | |
3 Virus Installs Self in Memory------3-----+ | | | | | | |
2 Virus Uses Self-Encryption---------2---+ | | | | | | | |
1 Virus Uses STEALTH Techniques------1-+ | | | | | | | | |
| | | | | | | | | | Increase in
| | | | | | | | | | Infected
| | | | | | | | | | Program's
| | | | | | | | | | Size
1 2 3 4 5 6 7 8 9 A |
| | | | | | | | | | |
Virus Disinfector V V V V V V V V V V V Damage
-----------------------------------------------------------------------------
Staf [Staf] Clean-Up . . x x x . . . . . 2083 O,P,L
Mix2 [MX2] Clean-Up . . x x x x x . . . 2280 O,P
Brain Slayer [Slay] Clean-Up . . x . x x x . . . 5120 O,P,L,D
Striker [Str] Clean-Up . . x x x . . . . . 461 O,P,F
Guppy [Guppy] Clean-Up . . x x x . . . . . 152 O,P
Arab Virus [Ar] Clean-Up . . x . x . . . . . 834 O,P
V-801 [V801] Clean-Up . . x x x x x . . . 801 O,P,L
Terror [Ter] Clean-Up . . x x x x x . . . 1085 O,P,F
S-847 [S847] Clean-Up . . x . x . . . . . 850 O,P
Frogs [Frogs] Clean-Up . . x x x . . . . . 1500 O,P
Enigma [Enigma] Clean-Up . x x . . x x . . . 1755 O,P
AGI-Plan [AGI] Clean-Up . . . x x . . . . . 1536 O,P,L
Crash [Crash] Clean-Up . . . . . . . . . . (See footnote)
Hymn-2 [H-2] Clean-Up . . x x x x x . . . 1962 O,P,L
Tester [TV] Clean-Up . . x x x . . . . . 1000 O,P
453 [453] Clean-up . . x x x . . . . . 453 O,P
Curse Boot [Curse] M-Disk . . x . . . . x x . N/A B,O
Striker [STR] Clean-Up . . . . x . . . . . 461 D,O,B,L
Azusa [Azusa] Clean-Up . . x . . . . x . x N/A D,O,B,L
Lazy [Lazy] Clean-Up . . x x x . . . . . 720 O,P
V-555 [555] Clean-Up . . x x x x x . . . 555 O,P,L
Phantom [Phant] Clean-Up . . x x x . . . . . 2253 O,P
V-299 [V299] Clean-Up . . . . x . . . . . 299 O,P,D
Cancer [Cn] Clean-Up . . . . x . . . . . 1480 O,P,D
1575/1591 [15xx] (2) Clean-Up . . x x x x . . . . vary O,P,L
USSR 492 [U492] Clean-Up . . . . x . . . . . 492 O,P
USSR 1049 [U1049] Clean-Up . . x . x x . . . . 1049 O,P,L
Skism [Skism] Clean-Up . . x . x x x . . . 1815 O,P
Holocaust (3) [Holo] Clean-Up x . x x x . . . . . 3784 O,P,L,D
Stone-90 [S90] Clean-Up . . . x x . . . . . 961 O,P
903 [903] Clean-Up . . x x x . . . . . 903 O,P
Dir-Vir [DVir] Clean-Up x . x x x . . . . . 691 O,P,D
Hybrid [Hybrid] Clean-Up . . . x x . . . . . 1306 O,P,L
IKV528 [I528] Clean-Up . . . x x . . . . . 528 O,P
Iraqi Warrior [Iwar] Clean-Up . . . x x . . . . . 777 O,P,L,D
Little Pieces [LP] Clean-Up . . x . x x . . . . 1374 O,P
Saddam [Saddam] Clean-Up . . x x x . . . . . 919 O,P,D,L
Monxla-B [MonB] Clean-Up . . . x x . . . . . 535 O,P,L
Plague [Plague] Clean-Up . . . . x x . . . . Overwriting
Sentinel [Sent] Clean-Up . . x x x x x . . . 4625 L,O,P,D
Swiss 143 [S143] Clean-Up . . . x x . . . . . 143 O,P,D
Voronezh [Voro] Clean-Up . x x x x x x . . . 1600 O,P,D
V-961 [V961] Clean-Up . . x x x . . . . . 961 O,P
USSR311 [U311] Clean-Up . . . . x . . . . . 321 O,P
USSR830 [U830] Clean-Up . . x x x . . . . . 830 O,P
USSR529 [U529] Clean-Up . . x x x . . . . . 529 O,P
USSR516 [U516] Clean-Up . . x x x . . . . . 516 O,P
USSR2144 [U2144] Clean-Up . x x x x x x . . . 2144 L,O,P,D
USSR1049 [U1049] Clean-Up . . x x x . . . . . 1049 O,P
Tiny-133 [T133] Clean-Up . . . x x . . . . . 133 O,P
Sverdlov [Sverd] Clean-Up . . x x x x x . . . 1962 O,P
Label [Label] Clean-Up . . x x x . . . . . Overwrites
Kukaturbo [Kuka] Clean-Up . . x x x . . . . . Overwrites
Justice [Just] Clean-up . . x x x . . . . . 1242 O,P
Hymn [Hymn] Clean-Up . . x x x x x . . . 642 O,P,D
Happy New Year [HNew] Clean-Up . . x x x x x . . . 1865 O,P
Destructor [Dest] Clean-Up . . x x x x x . . . 1150 O,P
Leapfrog Virus (3) [Leap] Clean-Up . . x x x . . . . . 516 O,P,D
MGTU Virus (4) [MGTU] Clean-Up . . . x x . . . . . 273 O,P,D
Nina [Nina] Clean-Up . . x x x . . . . . 256 O,P,D
Lozinsky (4) [Loz] Clean-Up . . . x x . . . . . 1023 O,P,D
BeBe [BeBe] Clean-Up . . . x x . . . . . 1004 O,P,D
Best Wish [BWish] Clean-Up . . . x x x x . . . 1024 O,P,D
Beeper (2) [Beep] Clean-Up . . x . x . . . . . 482 O,P,D
Parity [Parity] Clean-Up . . . x x . . . . . 441 O,P,D
F-Word [FW] Clean-Up . . x x x . . . . . 417 O,P,D
USSR-948 [U948] Clean-Up . x . . x x x . . . 948 O,P,D
USSR-711 [U711] Clean-Up . x . . x . . . . . 711 P,D
USSR-707 [U707] Clean-Up . x . x x . . . . . 707 P,D
USSR-696 [U696] Clean-Up . x . . x . . . . . 696 P,D
USSR-600 [U600] Clean-Up . x . x x . . . . . 600 P,D
USSR-394 [U394] Clean-Up . x . x x . . . . . 394 P,D
USSR-257 [U257] Clean-Up . x . x x . . . . . 257 P,D
USSR-256 (2) [U256] Clean-Up . x . x x . . . . . 256 P,D
Christmas Violater [CVio] Clean-Up . . . x x . . . . . ???? O,P,D
Off Stealth [Off] Clean-Up x . x x x x x . . . 1689 O,P,D
Jeff (3) [Jeff] Clean-Up . . . x x . . . . . 828 O,P,D,F
Bloody! [Bloody] Clean-Up . x x . . . . x . x N/A B,O
ZeroHunt [Hunt] Clean-Up x x x . x . . . . . N/A O,P,D
Music Bug (3) [MBug] Clean-Up . . x . . . . x . x N/A B,O
Dot Killer [Dot] Clean-Up . . x x x . . . . . 944 O,P
Father Christmas [FC] Clean-Up . . . x x . . . . . 1881 O,P
3445 [3445] Clean-Up x x x . x x . . . . 3445 O,P,D,L
Mirror (2) [Mirror] Clean-Up . . x . . x . . . . 928 O,P
Polish-2 [P-2] Clean-Up . . x x x . . . . . 512 O,P,D
Polish 217 [P-217] Clean-Up . . . x x . . . . . 217 O,P,D
Happy Day [Happy] Clean-Up . . . x x . . . . . 453 O,P
Monxla (3) [Monxla] Clean-Up . . . x x . . . . . 939 O,P
USSR (4) [USSR] Clean-Up . x . . . x . . . . 575 O,P
Polimer [Polimer] Clean-Up . . . x x . . . . . 512 O,P,D
DataLock [Data] Clean-Up . . x x x x x . . . 920 O,P
Carioca (6) [Carioca] Clean-Up . . x . x . . . . . 951 O,P
529 [529] Clean-Up . . x x x . . . . . 529 O,P,D
Spyer (3) [Spyer] Clean-Up . . x . x x x . . . 1181 O,P
Taiwan4 [T4] Clean-Up . . x x x x x . . . 2576 O,P,D
Keypress (3) [Key] Clean-Up . . x x x x . . . . 1232 O,P,D
Casper (2) [Casper] Clean-Up . x . x x . . . . . 1200 L,O,P,D
1605 (2) [1605] Clean-Up . . x x x x . . . . 1605 L,O,P,D
Violator (5) [Vio] Clean-Up . . . x x . . . . . 1055 O,P,D
Blood-2 [B-2] Clean-Up . . . . x . . . . . 427 O,P,D
Wisconsin (3) [Wisc] Clean-Up . x . x x . . . . . 825 O,P,D
Christmas-J [C-J] Clean-Up . . x x x x . . . . 600 O,P
Burger (3) [Burger] Clean-Up . . . x x x . . . . Overwrites
Leprosy-B [LepB] Clean-Up . . . x x x . . . . Overwrites
Whale (3) [Whale] Clean-Up x x x x x x x . . . 9216 L,O,P,D
Invader (4) [Invader] Clean-Up . x x . x x x x x . 4096 B,L,O,P,D
Scott's Valley [SVal] Clean-Up . x x . x x x . . . 2133 L,O,P,D
Black Monday (2) [BMon] Clean-Up . . x x x x x . . . 1055 L,O,P,D
Nomenclature (4) [Nom] Clean-Up . . x x x x x . . . 1024 O,P,D
Anthrax - Boot (2) [Atx] M-Disk . . x . . . . . . x N/A O,P,D
Anthrax - File (4) [Atx] Clean-Up . . x x x x . . . . 1206 O,P,D
651 [651] Clean-Up . . x . x . . . . . 651 O,P,D
Paris [Paris] Clean-Up . . . x x x x . . . 4909 O,P,D,L
Leprosy (5) [Lep] Clean-Up . . x x x x x . . . Overwrites
Mardi Bros. (3) [Mardi] Clean-Up . . x . . . . x x . N/A B,O
1253 - Boot [1253] M-DISK . . x . . . . x x x N/A O,P,D,L
1253 - COM [1253] Clean-Up . . x x x . . . . . 1253 O,P,D,L
AirCop (3) [AirCop] Clean-Up . . x . . . . x . . N/A B,O
400 (5) [400] Clean-Up . . x . x . . . . . Vary O,P,D
P1 (7) [P1r] Clean-Up . x x . x . . . . . Vary O,P,D,L
Ontario [Ont] Clean-Up . x x x x x . . . . Vary O,P,D
V2100 (2) [2100] Clean-Up . . x . x x . . . . 2100 O,P,D,L
Plastique (9) [P1q] Clean-Up . . x x x x x . . . 3012 O,P,D
Wolfman (2) [Wolf] Clean-Up . . x x x x . . . . 2064 O,P
Doom2 [Dm2] Clean-Up . . x . x x . . . . 2504 O,P,D,L
Flip (4) [Flip] Clean-Up . x x x x x x . . . 2343 O,P,D,L
Fellowship (3) [Fellow] Clean-Up . . x . . x . . . . 1022 O,P,D,L
Flash [Flash] Clean-Up . . x x x x . . . . 688 O,P,D,L
1008 [1008] Clean-Up . x x x x . . . . . 1008 O,P,D,L
Taiwan3 [T3] Clean-Up . . x x x x x . . . 2905 O,P,D,L
Armagedon (3) [Arma] Clean-Up . . x x x . . . . . 1079 O,P
1381 [1381] Clean-Up . . . . . x x . . . 1381 O,P
Tiny (13) [Tiny] Clean-Up . . . x x . . . . . 163 O,P
Subliminal (3) [Sub] Clean-Up . . x x x . . . . . 1496 O,P
Sorry [Sorry] Clean-Up . . x x x . . . . . 731 O,P
RedX (2) [Redx] Clean-Up . . . x x . . . . . 796 O,P
1024 (2) [1024] Clean-Up . . x x x . . . . . 1024 O,P
Joshi (4) [Joshi] Clean-Up x . x . . . . x x x N/A B,O,D
Microbes [Micro] M-DISK . . x . . . . x x . N/A B,O,D
Print Screen (2) [PrtScr] M-DISK . . x . . . . x x . N/A B,O,D
Form (2) [Form] M-DISK . . x . . . . x x . N/A B,O,D
July 13th [J13] Clean-Up . x . . . x . . . . 1201 O,P,D,L
5120 (3) [5120] Clean-Up . . . x x x x . . . 5120 O,P,D,L
Victor (2) [Victor] Clean-Up . . x x x x x . . . 2458 P,D,L
JoJo (3) [JoJo] Clean-Up . . x . x . . . . . 1701 O,P
W-13 (4) [W13] Clean-Up . . . . x . . . . . 532 O,P
Slow (5) [Slow] Clean-Up . x x . x x x . . . 1721 O,P,L
Frere Jacques [Frere] Clean-Up . . x . x x x . . . 1811 O,P
Liberty (2) [Liberty] Clean-Up . . x x x x x . . . 2862 O,P
Fish-6 (2) [Fish] Clean-Up x x x x x x x . . . 3584 O,P,L
Shake [Shake] Clean-Up . . x . x . . . . . 476 O,P
Murphy [Murphy] Clean-Up . . x x x x x . . . 1277 O,P
V800 (3) [V800] Clean-Up x x x . x . . . . . none O,P,L
Kennedy (3) [Kennedy] Clean-Up . . x . x . . . . . 308 O,P
8 Tunes/1971 (2) [1971] Clean-Up . . x . x x x . . . 1971 O,P
Yankee - 2 [Doodle2] Clean-Up . . . . x x . . . . 1961 O,P
June 16th [June16] Clean-Up . . . x x . . . . . 1726 F,O,P,L
XA1 [XA1] Clean-Up . x . . x . . . . . 1539 F,O,P,L
1392 [1392] Clean-Up . . x x x x . . . . 1392 O,P,L
1210 [1210] Clean-Up . . x . x . . . . . 1210 O,P,L
1720 (3) [1720] Clean-Up . . x . x x x . . . 1720 F,O,P,L
Saturday 14th (3) [Sat14] Clean-Up . . x . x x x . . . 685 F,O,P,L
Korea (4) [Korea] Clean-Up . . . . . . . x x . N/A B,O
Vcomm (5) [Vcomm] Clean-Up . . . . . x . . . . 1074 O,P,L
ItaVir [Ita] Clean-Up . . . . . x . . . . 3880 O,P,L,B
Solano (3) [Solano] Clean-Up . . x . x . . . . . 2000 O,P,L
V2000 (3) [2000] Clean-Up . . x x x x x . . . 2000 O,P,L
1559 [1559] Clean-Up . . x x x x . . . . 1554 O,P,L
512 (5) [512] Clean-Up x . x x x . . . . . none O,P,L
EDV (2) [EDV] Clean-Up x . x . . . . x x x N/A B,O
Joker [Joke] Clean-Up . . x x x . . . . . O,P
Icelandic-3 [Ice-3] Clean-Up . . x . . x . . . . 853 O,P
Virus-101 [101] Clean-Up . x x x x x x x . . 2560 P
1260 (3) [1260] Clean-Up . x . . x . . . . . 1260 P
Perfume (2) [Fume] Clean-Up . . . . x . . . . . 765 P
Taiwan (3) [Taiwan] Clean-Up . . . . x . . . . . 708 P
Chaos [Chaos] MDISK . . x . . . . x x . N/A B,O,D,F
Virus-90 [90] Clean-Up . . x . x . . . . . 857 P
Oropax (5) [Oro] Clean-Up . . x . x . . . . . 2773 P,O
4096 (4) [4096] Clean-Up x . x x x x x . . . 4096 D,O,P,L
Devil's Dance (2) [Dance] Clean-Up . . x . x . . . . . 941 D,O,P,L
Amstrad (5) [Amst] Clean-Up . . . . x . . . . . 847 P
Payday (2) [Payday] Clean-Up . . x . x x x . . . 1808 P
Datacrime II-B [Crime-2] Clean-Up . x . x x x . . . . 1917 P,F
Sylvia/Holland [Holland] Clean-Up . . . . x . . . . . 1332 P
Do-Nothing [Nothing] Clean-Up . . x . x . . . . . 608 P
Sunday (4) [Sunday] Clean-Up . . x . x x x . . . 1636 O,P
Lisbon (2) [Lisb] Clean-Up . . . . x . . . . . 648 P
Typo/Fumble [Typo] Clean-Up . . x . x . . . . . 867 O,P
Dbase [Dbase] Clean-Up . . x . x . . . . . 1864 D,O,P
Ghost Boot [Ghost] Clean-Up . . x . . . . x x . N/A B,O
Ghost COM [Ghost] Clean-Up . . . . x . . . . . 2351 B,P
Alabama (3) [Alabama] Clean-Up . . x . . x . . . . 1560 O,P,L
Yankee Doodle (6) [Doodle] Clean-Up . . x . x x . . . . 2885 O,P
2930 [2930] Clean-Up . . x . x x . . . . 2930 P
AIDS (4) [Aids] Clean-Up . . . . x . . . . . Overwrites
Disk Killer (4) [Killer] Clean-Up . . x . . . . x x . N/A B,O,P,D,F
1536/Zero Bug [Zero] Clean-Up . . x . x . . . . . 1536 O,P
MIX1 [Ice] Clean-Up . . x . . x . . . . 1618 O,P
Dark Avenger (4) [Dav] Clean-Up . . x x x x x . . . 1800 O,P,L
3551/Syslock [Syslock] Clean-Up . x . . x x . . . . 3551 P,D
VACSINA (5) [Vacs] Clean-Up . . x . x x x . . . 1206 O,P
Typo Boot [TBoot] Clean-Up . . x . . . . x x . N/A O,B
Swap Boot [Swap] M-DISK . . x . . . . x . . N/A B
Datacrime II [Crime-2] Clean-Up . x . . x x . . . . 1514 P,F
Icelandic II [Ice-2] Clean-Up . . x . . x . . . . 661 O,P
Pentagon [Pentagon] M-DISK . . . . . . . x . . N/A B
Traceback (3) [3066] Clean-Up . . x . x x . . . . 3066 P
Datacrime-B [Crime-B] Clean-Up . x . . x . . . . . 1168 P,F
Icelandic (3) [Ice] Clean-Up . . x . . x . . . . 642 O,P
405 [405] Clean-Up . . . . x . . . . . Overwrites
Fu Manchu (4) [Fu] Clean-Up . . x . x x x . . . 2086 O,P
Datacrime (2) [Crime] Clean-Up . x . . x . . . . . 1280 P,F
1701/Cascade (12) [170x] Clean-Up . x x . x . . . . . 1701 O,P
Stoned (8) [Stoned] Clean-Up . . x . . . . x . x N/A O,B,L
Ping Pong-B (7) [Ping] Clean-Up . . x . . . . x x . N/A O,B
Den Zuk (4) [DenZuk] Clean-Up . . x . . . . x . . N/A O,B
Lehigh [Lehigh] Clean-Up . . x x . . . . . . Overwrites P,F
Vienna/648 (19) [Vienna] Clean-Up . . . . x . . . . . 648 P
Alameda (2) [Alameda] Clean-Up . . x . . . . x . . N/A B
Friday 13th COM [Fri13] Clean-Up . . . . x . . . . . 512 P
Jerusalem (24) [Jeru] Clean-Up . . x . x x x . . . 1808 O,P
SURIV02 [SurivA] Clean-Up . . x . . x . . . . 1488 O,P
SURIV01 [SurivA] Clean-Up . . x . x . . . . . 897 O,P
Brain (4) [Brain] Clean-Up . . x . . . . x . . N/A B
Total Known Viruses - 501
LEGEND:
Size Increase:
N/A - Virus does not attach to files.
None - Virus does not change file size (attaches to tag end of file)
Overwrites - Virus overwrites beginning of file, no file size change
All Others - The length in bytes by which a file will increase when infected.
Damage Fields:
B - Corrupts or overwrites the boot sector
D - Corrupts data files
F - Formats or overwrites all/part of disk
L - Directly or indirectly corrupts file linkage
O - Affects system run-time operation
P - Corrupts program or overlay files
Characteristics:
x - Yes
. - No
Disinfectors:
CLEAN-UP - CLEAN-UP universal virus disinfector
SCAN /D - VIRUSCAN with /D option
SCAN /D /A - VIRUSCAN with /D and /A options
MDISK /P - MDISK with "P" option
All Others - The name of disinfecting program
NOTE: The SCAN /D options will overwrite and then delete the
entire infected program. The program must then be
replaced from the original program diskette. If you wish
to try and recover an infected program, then use the
above-named disinfector if available.
If a virus infects Overlay Files (Item 7) Clean-Up should
be used with the /A option when removing the virus.
Footnote: The 'crash' virus (in all implementations we have encountered)
crashes when run. It is included since it is possible that
under other architectures than those tested, it might flourish.
Directory of PC-SIG Library Disk #2749
Volume in drive A has no label
Directory of A:\
READ ME 1458 4-19-91 10:46p
DBATE005 BAT 868 4-22-91 12:07a
DBATE005 BW 452 4-22-91 12:07a
DBATE005 CFG 486 4-22-91 12:07a
DBATE005 COL 486 4-22-91 12:07a
DBATE005 HDR 12914 4-22-91 12:08a
DBATE005 MRK 11914 4-22-91 12:07a
DBATE005 NEW 64 4-28-91 3:04p
DBATE005 OLD 70 4-22-91 12:07a
DBATE005 PGE 129142 4-22-91 12:07a
DEZIP EXE 13246 4-19-91 10:32p
DEZIPDOC EXE 3963 4-19-91 10:32p
INQUIRY COM 208 4-19-91 10:32p
IRIS EXE 65606 4-19-91 10:32p
IRIS MSG 7472 4-19-91 10:32p
SCAN76-C ZIP 67170 4-16-91 10:04p
SI005FLS BW 452 4-22-91 12:19a
SI005FLS CFG 486 4-22-91 12:19a
SI005FLS COL 486 4-22-91 12:19a
SI005FLS MRK 3074 4-22-91 12:19a
SI005FLS PGE 9035 4-22-91 12:19a
FILE2749 TXT 2172 8-01-91 2:31a
GO BAT 826 8-08-91 5:22a
23 file(s) 332050 bytes
17408 bytes free