VIRUS-L Digest Tuesday, 18 Jun 1991 Volume 4 : Issue 105 Today's Topics: Review of Victor Charlie 4.01 (PC) Review of IBM VIRSCAN version 2.00.01 (PC) Review of VirAway (PC) Antivirus contact list (mostly PC) VIRUS-L is a moderated, digested mail forum for discussing computer virus issues; comp.virus is a non-digested Usenet counterpart. Discussions are not limited to any one hardware/software platform - diversity is welcomed. Contributions should be relevant, concise, polite, etc. Please sign submissions with your real name. Send contributions to VIRUS-L@IBM1.CC.LEHIGH.EDU (that's equivalent to VIRUS-L at LEHIIBM1 for you BITNET folks). Information on accessing anti-virus, documentation, and back-issue archives is distributed periodically on the list. Administrative mail (comments, suggestions, and so forth) should be sent to me at: krvw@CERT.SEI.CMU.EDU. Ken van Wyk ---------------------------------------------------------------------- Date: Mon, 17 Jun 91 21:11:09 -0700 From: p1@arkham.wimsey.bc.ca (Rob Slade) Subject: Review of Victor Charlie 4.01 (PC) [Ed. My apologies for the length of this digest. The reviews below, and the vendor list, are available on cert.sei.cmu.edu for anonymous FTP in the pub/virus-l/docs/reviews directory. Thanks once again to Rob Slade for all of this work which he is making available to all of us!] Comparison Review Company and product: Delta Base Enterprises 9800A - 140th St. Surrey, B. C. V3T 4M5 604-582-15922 Fax: (604) 582-0101 CIS# 72137,603 Bangkok Security Associates BBS: 662-255-5981 Victor Charlie 4.0 Summary: Change detection with self generating "bait" files and viral signature capture Cost $99 Cdn Rating (1-4, 1 = poor, 4 = very good) "Friendliness" Installation 2 Ease of use 3 Help systems 4 Compatibility 2 Company Stability 3 Support 3 Documentation 3 Hardware required 4 Performance 2 Availability 2 Local Support 2 General Description: Victor Charlie is a series of batch and data files that generate a number of programs for trapping of viral infections. There is also provision for the capture of viral signatures. Utilities are included for viewing of boot sectors and recovery of hard disk system areas. Requires DEBUG.COM for some operations. Version 5.0 has, as of this writing, been released, but has not yet been received for review. Due to the novelty of the program, and its relative anonymity in North America and Europe, I am releasing this review now, with some notes about version 5.0, rather than wait for the next version. Comparison of features and specifications User Friendliness Installation The installation procedure outlined in the manual starts "earlier" in the process than any other reviewed so far. Not only does it recommend booting from a floppy, but it suggests that you SYS and replace the COMMAND.COM file on the hard disk before doing anything else. An initial "Quick Start" section of the manual relies on an intermediate knowledge of MS-DOS by the user, but this is stated at the beginning. (Unfortunately, it does not immediately point novice users to the later, and more detailed, VINSTALLATION chapter, nor does it point out the possible dangers of replacing the operating system on the hard disk. Also, although there is some discussion is the alter chapter about the DOS disk, some discussion of the importance of write protection of the original disks might avoid possibilities for infection at this point.) Installation of VC is not foolproof by any means. Almost all error messages are hidden from the user, and a lack of file space or an incorrect assumption regarding drive specifications will cause the installation to fail to complete. This, however, is not communicated to the user, and may not be obvious. To the novice this can be dangerous, in that the user may consider that the system is protected when, in fact, it is not. Experienced users will be able to custom tailor the installation to their own needs, since everything is done through batch files. Although the documentation does indicate that the package can be run on floppy only systems, installations onto floppies is problematic. If the command VINSTALL A: is given, the system will determine that A: is not a hard drive, and install only a portion of the full set of files. If, however, the command VINSTALL A:\VC is given, the program will not determine that A: is a floppy. When installing to a floppy drive, the boot sector and other system areas are "protected" (VC will detect an infection by a BSI), but not reparable (the back file of the boot sector is not generated.) A floppy installation program, FINSTALL.BAT, is provided, but it does not seem to work properly unless called from VINSTALL. Even then, on every attempt to install the program terminated with an error message about an improper drive or path specification. Although not mentioned in the manual until page 64, DEBUG.COM is required by a number of VC's programs. It should be on the computer, and in a directory in the active path. Options in regard to installation are legion, but should be performed only by experienced users, as they are not necessarily well explained for the novice. Path and directory settings are vitally important, and it is quite possible to generate additional copies of the program which no longer will trap changes to programs. Ease of use The ability to use the programs effectively is very much dependent upon the installation chosen. With proper installation, occasional virus checks can be as simple as a single keystroke (Alt-V). The program can, however, give conflicting messages. When the Stoned virus was active, it correctly detected that something had happened to the boot sequence. On a floppy system it was not able to recover the boot sector, but finished the sequence with a message that "Right now, you have NO active virus on this computer." Help systems There is help of various sorts provided for, but in testing the program very often "lost" its help file, even when installed as directed. When a virus is detected, the messages that appear give a useful explanation of what has happened and why. The steps to take, and optional explanations of what has happened are realistic, and should be clear even to a novice. Compatibility Although no part of the package is "resident", it warns against having TSR's active during installation. Company Stability The program is produced by Bangkok Security Associates (programmer John DeHaven, technical writer Alan Dawson, marketing director Simon Royle and financial director Ramesh Indhewat). BSA is a Thai company registered in the British Virgin Islands from Hong Kong. Company Support In Australia, where the product has had its major success to date, the product is supported by Combat Software. Otherwise company support is provided by the BBS listed above. Documentation The manual is entertainingly written, and contains a great deal of information on viral programs in general. Parts of the manual explain computer operations to the novice in great detail. There are, however, other parts that give out brief, or even misleading, information. (A note on this business of directions to novice users. It may seem like a "fractal" type of problem, in that no matter how much you explain, there is still more to do. For example, TBSCAN's documentation suggests write protecting diskettes, and explains how to do it on a 3.5" diskette, but not on a 5.25". Victor Charlie does explain that you should put a "... sticker ... over the notch at the right-hand side of the disk when you look at it from the front." However, failing to mention that the notch is *square*, on the *side* of the disk cover and that you cannot see the magnetic disk through it might allow some to permanently read *and* write protect the disk by placing the sticker over the drive head access slot. Still, in many cases Victor Charlie gives the best explanation to novice users yet reviewed.) The tone of the documentation (both hardcopy and on disk) varies between jingoism ("... ultimate security ... defeat any current or future virus") and realism, while ultimately falling somewhat short in terms of actual details. In testing the system, I came to the conclusion that, while suitable for any users as a warning system, technical personnel will need more details as to the ultimate effectiveness, and how far to trust the package. Hardware Requirements MS-DOS 2.0 or higher and a minimum 64K of RAM. Performance Unfortunately, even at this point, I am unable to state the performance of the system with confidence. It will find viral infections of programs, and of boot sectors. (In spite of the difficulties encountered in installing the system to a floppy, it had no difficulty in identifying "Stoned" infections on floppy. Further testing revealed that it was, somehow, detecting a change in the boot sector, rather than memory. Although the program checks memory and the system areas of the disk, the "signatures" of the original system are not stored with program file signatures.) The actions of the package as a whole, regenerating itself from batch and data files, are quite fascinating. The program is a radical departure from any other reviewed system, and should be a valuable extra component for system security. The change detection of the signature list may possibly be bypassed by a sophisticated virus, as it depends upon file length and checksum, rather than some of the more rigourous mathematical methods. However, the checksum is described by the company as "double-encrypted", and the method of calculation and protection, while not user definable, is not uniform throughout any release of the product. The program, as it stands, is most useful against memory resident, program file infecting viri. Specific identification of sources of infection is not strong. Local Support In Australia, provided by Combat Software. Support Requirements Installation of the program is possible for novice users with standard computer configurations, but should likely be supported for any non- standard systems. Novice or intermediate users will require assistance to identify the source of infection if a virus is detected. General Notes This package is quite fascinating in its novel approach to virus detection. There are numerous shortcomings, but the approach could be a valuable adjunct to current methods. While the current implementation has significant shortcomings, particularly in non-standard configurations, the concept is a valuable one and, hopefully, future development will make the package more valuable as a stand alone product. Version 5.0 is said to be a major rewrite and upgrade. The virus signature library, which contains only two signatures in version 4.01, will identify all viral programs identified as "common" in the Hoffman Summary listing (the date of the listing is not specified.) The library will also "accumulate" signatures as new viral programs are encountered. Changes effective in version 5.0 will include a new interface and installation process. New utilities will be added, and protection against "stealth" viri will be enhanced. System requirements will increase to 256K RAM and DOS 3.0 or higher, but the use of DEBUG.COM will be dropped. The documentation will include a 200 page book on computer viral operations, with separate version specific technical references. copyright Robert M. Slade, 1991 PCVC.RVW 910617 ============= Vancouver p1@arkham.wimsey.bc.ca | "If you do buy a Institute for Robert_Slade@mtsg.sfu.ca | computer, don't Research into (SUZY) INtegrity | turn it on." User Canada V7K 2G6 | Richards' 2nd Law Security | of Data Security ------------------------------ Date: Mon, 17 Jun 91 23:57:37 -0700 From: p1@arkham.wimsey.bc.ca (Rob Slade) Subject: Review of IBM VIRSCAN version 2.00.01 (PC) Comparison Review Company and product: IBM High Integrity Computing Lab Thomas J. Watson Research Center P. O. Box 218 Yorktown Heights, New York USA 10598 Bill Arnold, author David Chess CHESS@YKTVMV.IBM.COM, CHESS@YKTVMV.BITNET VIRSCAN 2.00.01 dated 910307 Summary: Non-resident scanner with user extensible signature file. Cost $35 US for original license, $10 for upgrades, enterprise wide license Rating (1-4, 1 = poor, 4 = very good) "Friendliness" Installation 3 Ease of use 3 Help systems 3 Compatibility 3 Company Stability 3 Support 2 Documentation 3 Hardware required 4 Performance 3 Availability 2 Local Support 1 General Description: IBM's VIRSCAN product appears to fall somewhat oddly between commercial software and shareware. Although IBM retains all rights to the program (in a license agreement written as only IBM can), there is no printed documentation, and the package is available on either single disks or via the IBMLINK service. The price is reasonable for an individual, but almost absurdly low given the "enterprise wide" license. VIRSCAN is a non-resident scanner with a non-encrypted and user extensible signature file. Command line switches can be used to obtain a variety of information about the system. The program makes no attempt to disinfect or delete infections. Recommended for any situation, but particularly for medium to large companies and for intermediate to advanced users. Comparison of features and specifications User Friendliness Installation VIRSCAN, when supplied on disk, is shipped on "non-writable" diskettes. IBM does not suggest installation on the hard drive at all. The suggested use of the program is to boot from a protected floppy, and run the program from the floppy disk. The documentation does give directions on how to prepare a bootable floppy with the scanning program on it. These directions are very complete. (Directions are even given on how to write protect a 3 1/2" floppy disk, although they are not as explicit for 5 1/4" disks.) An explanation of "resident" viri is given, and directions for booting from the original system floppy are given. The directions do assume that you have original IBM equipment and operating system disks, but should be clear for most systems, even for novice users. The documentation is written with the novice user in mind, and is, in places, excellent. Some "obvious" steps are missing in the directions, but by and large they are very clear, and cover ground often missing in the documentation of other products. Ease of use As the product has evolved, a number of command line switches have been added. The default settings, however, are very well chosen, and novice users should not need to know the various options. Advanced users will be able to use them without problems. One possible problem is that by default the scan proceeds to conclusion even when the screen has filled with warning messages. This should not be a problem in normal operation, but may be of concern in scanning a heavily infected system. (The "-Z" switch will, however, cause the program to pause at each signature found and this may be an acceptable alternative.) Help systems Two levels of help are available from the command line, called by switches. (Somewhat counterintuitively, the "?" switch gives more extensive and complicated assistance than does the "??" switch.) As the program is run from the command line only, "onscreen help" is not an issue. Compatibility VIRSCAN will run under both DOS and OS/2, and will examine drives with both DOS/FAT and HPFS file structures. The structure of the signature file is outlined in the manual, and at least one other scanning program obtained for evaluation (Thunderbyte Scan from Frans Veldman) uses this same file format as a standard. This allows the use of additional signature information with the program, and also allows users to add new signatures to update the package, or their own signatures if a new virus is found. Mention is made in the documentation of a switch to disable "high memory" checking, which appears to indicate that the program will check high memory by default. The extent of this is not, however, clearly specified in the documentation. In a communication from David Chess, it was explained that "high memory" is defined as the area between 640K and 1 meg. No scanning is done above 1 meg. (Note that when run from OS/2, the program does *not* check system memory. Memory is only checked when the program is run from DOS or the DOS compatibility box.) Company Stability They'll probably be around for a while. Company Support Those on the Internet and Usenet who receive VIRUS-L/comp.virus will have access to David Chess' postings and email address. IBMLINK subscribers will have access to upgrades and information. Documentation The documentation is available only in softcopy on the disk. While sections are excellent, the presentation and order of the manual (VIRSCAN.DOC) would likely be daunting to the novice. A major strength is the discussion of the weaknesses of the program, and a warning against trusting it too far. Hardware Requirements The documentation does not state any minimum requirements for operation. Performance While VIRSCAN does not search for as many viri as FPROT or SCAN, it catches all common viri. Speed of operation is neither the slowest nor the fastest tested, and is quite acceptable. Note that VIRSCAN makes no attempt to disinfect or delete infected files. Local Support Local support, even from IBM staff, is unfortunately undependable. There are numerous instances of those staff who should, presumably, be familiar with the product being unaware of its particulars and availability, or even giving out false information. (I was twice contacted by IBM staff who *offered* to get me copies of the program for evaluation, and then were unable to find it themselves.) There have been a number of cases of IBM local representatives giving versions intended for internal use only to outside clients. Support Requirements The program should be suitable for any user. Support staff will find additional functions that novice users would not use. If, however, an infection is detected, additional support will be required. It is likely that only advanced users would be able to take effective action, and even then would likely require other antiviral packages to correct the situation. General Notes This product is an excellent value for any company. It is easy to see that IBM could lose control over the integrity of the product if it were to be distributed as shareware or "freeware". It is also reasonable that IBM be allowed to make some return on the resources devoted to this product. That said, I still could wish for some attempt to make the product more available to the general user community. The lack of support available through IBM representatives is disturbing. Against, while it is understandable that not all staff can be expert in all products, the lack of support for a product of such universal importance is to be regretted. In comparison to other scanners, the lack of disinfection would tend to make this product an adjunct rather than the only tool used. It is still, though, a high quality tool, and could easily be chosen as the primary virus alert product. copyright Robert M. Slade, 1991 PCIBMSCN.RVW 910617 ============= Vancouver p1@arkham.wimsey.bc.ca | "If you do buy a Institute for Robert_Slade@mtsg.sfu.ca | computer, don't Research into (SUZY) INtegrity | turn it on." User Canada V7K 2G6 | Richards' 2nd Law Security | of Data Security ------------------------------ Date: Wed, 12 Jun 91 17:37:07 -0700 From: p1@arkham.wimsey.bc.ca (Rob Slade) Subject: Review of VirAway (PC) Comparison Review Company and product: T.C.P. Techmar Computer Products 97 - 77 Queens Blvd. Rego Park, NY 11374 USA 800-922-0015 718-997-6800 718-997-6666 fax: 718-520-0170 VirAway scanner version 1.46 dated 910128 Summary: Non resident scanner Cost $49 US Rating (1-4, 1 = poor, 4 = very good) "Friendliness" Installation 2 Ease of use 3 Help systems 1 Compatibility 2 Company Stability 3 Support 2 Documentation 1 Hardware required 4 Performance 2 Availability 2 Local Support 1 General Description: VirAway is identical to the CURE program shipped with AntiVirus Plus from Techmar. The program is recommended only to "backstop" other systems, and should not be depended upon as the only means of antivirus protection in its current form. Comparison of features and specifications User Friendliness Installation VirAway, as shipped to me, comes completely unprotected. This may not be the usual form, as the disk documentation contains a READ.ME file which states that no changes have been made to the documentation, while I received no documentation with the package. An installation program is provided, which will only install from drive A: to the C: drive in a directory called \VIRAWAY. However, as installation consists solely of copying three files (and one "startup" batch file to the root directory), it is not difficult for the intermediate user to perform a "custom" installation. Ease of use Although VirAway came with no documentation, it responds to the same command line switches as does CURE. (Not terribly surprising: not only are the files identical in size, but CURE, when run, identifies itself as version 1.46 of VirAway.) Again, if no switches are used, the program will present a menu of options. However, command line switches seem to be only able to "add" to the default options. (For example, one cannot turn off the display of final statistics from the command line invocation.) There is an annoying bug in the program when allowed to disinfect: it appears to count both the infection detected, and the cleaning process, as an infection. The final statistics will indicate that 1 file virus was found, and one cleaned, but will show the virus named as having caused two infections. (If two files are, in fact, infected, the display shows only two infections.) Help systems None provided. Compatibility As stated in the review of AntiVirus Plus, VirAway will find most common viri, but will not find the AIDS virus. VirAway will find viri active in memory, and, in testing, rendered them inactive. However, sufficient traces remained in memory to set off alarms from other virus scanners. Company Stability Techmar is the distributor of IRIS products (from Israel) in the United States. Company Support The evaluation copy of AntiVirus Plus was shipped in good time, although Techmar had not properly filled in the customs declaration. The copy of VirAway came unsolicited, which seems to indicate an active marketing group if nothing else. Documentation Not supplied. Hardware Requirements MS-DOS 2.0 or higher, 256K memory. The promotional material states that a dual floppy system is necessary, which conflicts with the installation batch file. Performance Detection of viral programs appears to be sufficient for most situations. Disinfection of memory appears effective, with the proviso noted above about false alarms from other scanners. (According to memory mapping utilities, the memory is also still "reserved".) Disinfection of boot sector viri appears to be effective. Disinfection of program files appears effective as to the virus removal, but may leave programs damaged. During testing, the memory was infected with the Jerusalem B virus (which VirAway reports as "Black Friday #1"). When VirAway was run, the virus was rendered inactive in memory, but it had already infected the VirAway program file. VirAway then disinfected itself, but increased in size from 81835 to 81840 bytes on disk. Subsequent runs with the program against test sets of viri showed some odd behaviour and an inability to identify all previously identified viri. Also, subsequent runs of VirAway in memory showed a lack of ability to remove infections from memory. Local Support None provided. Support Requirements The program, while fairly simple to run, would not necessarily be suitable for novice users. Disinfection of viral infections is probably best left to experienced staff (and possibly other programs.) General Notes As it stands, the program cannot be highly recommended. The number of viri detected are low even by the standards of other (admittedly more expensive) programs. The disinfection ability is somewhat questionable, and therefore undependable. copyright Robert M. Slade, 1991 PCVIRAWY.RVW 910612 ============= Vancouver p1@arkham.wimsey.bc.ca | "If you do buy a Institute for Robert_Slade@mtsg.sfu.ca | computer, don't Research into (SUZY) INtegrity | turn it on." User Canada V7K 2G6 | Richards' 2nd Law Security | of Data Security ------------------------------ Date: Tue, 11 Jun 91 23:35:59 -0700 From: p1@arkham.wimsey.bc.ca (Rob Slade) Subject: Antivirus contact list (mostly PC) As before .... Sandy Jenish, Dave Reid (VP Marketing) Advanced Gravis Computer Technology 7033 Antrim Avenue Burnaby, B. C. V5J 4M5 604-434-7274 Telecopier: (604) 434-7809 Advanced Security for PC and Mac Brightwork Development Inc. 766 Shrewsbury Ave. Jerral Center West Tinton Falls, NJ 07724 USA 201-530-0440 800-552-9876 (US only) fax: 201-530-0622 Sitelock, Novell add-on operation restricting software $495 product not available British Computer Virus Research Centre 12 Guildford Street, Brighton, East Sussex, BN1 3LS, England Tel: 0273-26105 Joe Hirst Virus Simulation Suite, Eliminator/Virus Monitor/Virus Clean see also ICVI Carmel Software Engineering EPG International Hans-Stiessberger-Strasse 3 D-8013 Haar by Muenchen head office Israel? Turbo Anti-Virus Set, scanner vaccine and change checker (including boot) product not available Central Point Software 15220 N. W. Greenbrier Parkway #200 Beaverton, OR 97006 USA 503-690-8090 Central Point Anti-Virus Certus International 13110 Shaker Square Cleveland, Ohio 44120 USA 216-752-8181 216-752-8183 Technical Support BBS 216-752-8134 fax 216-752-8188 800-722-8737 Mike Mytnick, Cleveland Michael Blumenthald (?), Anaheim Peter Trippett, 4295370 on MCI mail operation restricting software, particularly for LANs ComNETco, Inc. 29 Olcott Square Bernardsville, NJ 07924 USA VirusSafe-Anti-Viral Software (cf EliaShim, also Enigma SafeWord (R) Virus-Safe) mail undeliverable CSM Management and Consulting 3031 Main St. Vancouver, B. C. V5T 3G8 604-879-4162 Telecopier: 604-874-1668 Overlord product not available Cylink 110 S. Wolfe Road Sunnyvale, CA 94086 USA 408-735-5800 telecopier: 408-738-8269 SecurePC - half card DES encryptor product not available PROGRAM CHAIRPERSON: DPMA Virus Conference, 1991 Richard G. Lefkon NYU, DPMA Fin. Ind. Ch. 609 West 114th Street New York, NY 10025 (212) 663-2315 Data Fellows Ltd Finland Ari Hypponen, hyde@ng.fi hyde%daredevil.hut.fi@santra.hut.fi data security consulting Delta Base Enterprises 9800A - 140th St. Surrey, B. C. V3T 4M5 604-582-1592 Fax: (604) 582-0101 CIS# 72137,603 Victor Charlie 4.0 - change detection Digital Dispatch, Inc. 1580 Rice Creek Road Minneapolis, MN 55432 mail undeliverable 55 Lakeland Shores St. Paul Minn 55043 612-436-1000 800-221-8091 Antigen, Data Physician, Novirus-Anti-viral software product not available Director Technologies Inc. 906 University Place Evanston, IL 60201 USA Disk Defender-Half-Slot Virus Write-Interrupt Device product not available Dynamics Security Inc. Cambridge, MA USA mail undeliverable EliaShim Microcomputers 520 W. Hwy. 436, #1180-30 Altamonte Springs, Florida USA 407-682-1587 VirusSafe - TSR scanner (cf ComNETco?) Bob Bosen Enigma Logic Inc. 2151 Salvio Street, #301 Concord, CA 94565 USA Tel: (415) 827-5707 (800) 333-4416 (not from Canada) FAX: (415) 827-2593 Internet: 71435.1777@COMPUSERVE.COM Safeword - change detection software Fink Enterprises 11 Glen Cameron Road, Unit 11 Thornhill, Ontario L3T 4N3 416-764-5648 Telecopier: 416-764-5649 IRIS Antivirus (from Israel, cf Techmar) FoundationWare 2135 Renrock Rd. Cleveland, OH 44118 USA Vaccine 1.2-Anti-viral software mail undeliverable, now Certus Gee Wiz Software Company c/o Mrs. Janey Huie 10 Manton Avenue East Brunswick, NJ 08816 USA Dprotect-Anti-Trojan Software product not available Patricia M. Hoffman 1556 Halford Avenue, #127 Santa Clara, CA 95051 Voice: 1-408-246-3915 FAX : 1-408-246-3915 BBS : 1-408-244-0813 Virus Summary Document also distributed by: Roger Aucoin Vacci Virus 84 Hammond Street Waltham, MA 02154 Voice: 1-617-893-8282 FAX : 1-617-969-0385 Denny Kirk Hyper Technologies 211 - 3030 Lincoln Coquitlam, B. C. 604-464-8680 Integrity still in production, not yet available IBM High Integrity Computing Lab Thomas J. Watson Research Center P. O. Box 218 Yorktown Heights, New York USA 10598 Bill Arnold, author David Chess CHESS@YKTVMV.IBM.COM, CHESS@YKTVMV.BITNET VIRSCAN IMSI Software San Rafael, CA 415-454-7101 BBS 415-454-2893 VirusCure Plus product not available International Computer Virus Institute 1257 Siskiyou Boulevard, Suite 179 Ashland, OR 97520 USA 503-488-3237 503-482-3284 BBS 503-488-2251 Eliminator anti-viral, virus simulators plus books and consulting see also British Computer Virus Research Centre, Joe Hirst Interpath Corporation Cylene-4-Anti-Viral software, no longer produced defunct, cf McAfee IP Technologies Virus Guard address no longer valid Lasertrieve, Inc. 395 Main Street Metuchen, NJ 08840 USA Viralarm-Anti-Viral Software product not available LeeMah DataCom Security Corp. 3948 Trust Way Hayward, CA 94545 USA 415-786-0790 product not available Leprechaun Software Pty Ltd PO Box 134 Lutwyche Queensland 4003 Australia Lindsay Hough +61 7 2524037 Leprechaun International 2284 Pine Warbler Way Marietta Georgia 30062 USA 404 971 8900 fax 404 971 8988 Virus Buster product not available Look Software Cliff Livingstone Ottawa, Ontario 613-820-9450 Start - VIRUSCAN front end Paul Mace Software 400 Williamson Way Ashland, OR 97520 USA tech support 503-488-0224 fax: 503-488-1549 sold and supported through: Fifth Generation Systems, Inc. 10049 N. Reiger Rd. Baton Rouge, Louisiana USA 70809 1-800-873-4384 sales and info 504-291-7283 tech support 504-291-7221 admin telecopier: 504-292-4465 Mace Vaccine-Anti-viral software. McAfee Associates 4423 Cheeney Street Santa Clara, CA 95054 USA 408-988-3832 Viruscan-Scans disk and RAM for viri. Morgan Schweers - mrs@netcom.com Aryeh Goretsky,Tech Sup.|voice(408)988-3832|INTERNET McAfee Associates | fax(408)970-9727|aryehg@ozonebbs.uucp 4423 Cheeney Street | BBS(408)988-4004|aryehg@tacom-emh1.army.mil Santa Clara, CA 95054 | UUCP apple!netcom!nusjecs!ozonebbs!aryehg aryehg@darkside.com cynic!van-bc!apple.com!uuwest!aryehg mcafee@netcom.com cynic!van-bc!uunet!mimsy!ames!netcom.netcom.com!mcafee Mike McCune MMCCUNE@SCTNVE.... FTP from mibsrv.mib.eng.ua.edu in pub/ibm-antivirus/innoc.zip INNOC Boot Virus Immunizer, boot sector overlay renders non-booting Microcom Software Division 3700-B Lyckan Parkway Durham, NC 27717 USA also Norwood, MA 919-490-1277 800-822-8224 Virex-PC, also Virex for Mac - scanner Mary Hughes Glenn Jordan - beta list Fidonet: 1:155/223 see also Software Concepts Design Micronyx Inc 1901 N. Central Expressway Richardson, TX USA 75080 800-634-8786 fax: 214-690-0595 Triumph security package (PC and LAN) product not available Computer Security Division National Computer Systems Laboratory National Institute of Standards and Technology (NIST) 225/A216 United States Department of Commerce Gaithersburg, Maryland 20899 USA 310-975-3411 BBS 2400 bps 301-948-5717 BBS 9600 bps 301-948-5140 John P. Wack Marianne Swanson (sysop) csrc@nist.gov JWack@nist.gov wack@csmes cynic!van-bc!csmes.ncsl.nist.gov!wack dds@csmes.ncsl.nist.gov (Dennis D. Steinauer) steinauer.ncsl.nist.gov (CSME1.NCSL.NIST.GOV) cynic!van-bc!csmes.ncsl.nist.gov!dds Orion Microsystems Quebec Panda Systems 801 Wilson Road Wimington, DE 19803 USA Dr. Panda Utilities-Anti-Viral Software product not available Parsons Technology 375 Collins Road NE Cedar Rapids, IA 52402 USA 319-395-9626 Virucide A. Padgett Peterson, Computer Network Security Orlando (407)356-4054, 6384 work (407)356-2010 FAX (407)352-6007 cynic!van-bc!uvs1.orl.mmc.com!tccslr.dnet!padgett padgett%tccslr.dnet@uvs1.orl.mmc.com [host unknown] note: To: "Robert_Slade@mtsg.sfu.ca"%UVS1.dnet@uvs1.orl.mmc.com cynic!van-bc!uvs1.orl.mmc.com!tccslr.dnet!padgett@dinl.den.mmc.com uvs1.orl.mms.com!padgett%tccslr.dnet@cs.utexas.edu Received: from TCCSLR.DECnet MAIL11D_V3 by uvs1.orl.mmc.com DISKSECURE PKWare, Inc. 7545 North Port Washington Road Glendale, WI 53217-3442 USA PKZIP, PKSFX-File compression utilities with encryption option Prime Factors 1470 East 20th Avenue Eugene, OR 97403 USA VI-Raid-Anti-Viral Software product not available Publisher One Baltimore, Maryland Chris - HU349C%GWUVM.BITNET@gwuvm.gwu.edu virus protection book (Jan '92?) PYRAMID Development Corp 20 Hurlbut Street, West Hartford, CT 06110 203-953-9832 Fax: 203-953-3435 PC/DACS retail $249.00. product not available Quaid Software Ltd. 45 Charles Street East Toronto, ON M4Y 1S2 416-961-8243 Antidote-Anti-Viral Software product not available RG Software Systems Inc 6900 East Camelback Road Suite 630 Scotsdale AZ 85251 +1 602 423 8000 Diskwatcher 2.0, ViSpy product not available Fridrik Skulason Box 7180 IS-127 Reykjavik Iceland frisk@rhi.hi.is F-PROT-Virus detection/protection/disinfection and utilities Ross Greenburg Software Concepts Design 594 Third Avenue New York, NY 10016 USA Flushot-Anti-Viral Software. see also Microcom S&S International Ltd. Berkley Court, Mill Street Berkhamsted, Herts. HP4 2HB England Phone: +44 442 877 877 Fax: +44 442 877 882 BBS: +44 494 724 946 (used to be -- still valid??) E-Mail: Dr. Alan Solomon Dr. Solomon's Anti-Virus Toolkit (SHERLOCK and HOLMES?) Vendor: perComp Verlag GmbH Holzmuhlenstrasse 84 2000 Hamburg 70 Germany Phone: +49 40 693 2033 Fax: +49 40 695 9991 E-Mail: Gunter Musstopf product not available Luis Bernardo Chicaiza Sandoval Phone: (91)2 02 23 78 Universidad de los Andes Bogota, Colombia mail address: Compucilina US$70, adds self check module review copies not available SECTRA Teknikringen 2 S-583 30 Linkoping SWEDEN Telephone: +46 13 235214 FAX: +46 13 212185 tommyp@sectra.se TCell unix change checker Sophco P.O. Box 7430 Boulder, CO 80306 USA Vaccinate-Anti-Viral Software product not available Sophos Limited 20 Hawthorne Way Kidlington, Oxford, OX5 1EZ UK Vaccine-Anti-Viral Software product not available Swarthmore Software Systems 526 Walnut Lane Swarthmore, PA 19081 USA Bombsquad, Check-4-Bomb-Anti-Trojan software Stratford Software #2047-4710 Kingsway Burnaby, BC V5H 4M2 (604) 439-1311 SUZY Information System, INtegrity antivirus information network Symantec/Peter Norton 10201 Torre Avenue Cupertino, CA 95014 USA 408-253-9600 800-343-4714 800-441-7234 408-252-3570 416-923-1033 Norton AntiVirus Tacoma Software Systems 7526 John Dower Road W. Tacoma, WA 98467 VIRSTOP 1.05 T.C.P. Techmar Computer Products 97 - 77 Queens Blvd. Rego Park, NY 11374 USA 800-922-0015 718-997-6800 718-997-6666 fax: 718-520-0170 IRIS Antivirus (cf Fink), Antivirus Plus (purported "AI vaccine"), VirAway scanner Tomauri Inc. 30 West Beaver Creek Road, Unit 13 Richmond Hill, Ontario L4B 3K1 416-886-8122 Telecopier: 416-886-6452 PC Guard - password protection board, also for Mac product not available Trend Micro Devices Inc. 2421 W. 205th St., #D-100 Torrance, CA 90501 USA 213-782-8190 fax: 213-328-5892 PC-cillin - program change detection hardware/software University of Cincinnati Dep't. of Computer Engineering Mail Loc. 30 - 898 Rhodes Hall Cincinnati, OH 45221-0030 USA Cryptographic Checksum-Anti-Viral software Vacci Virus 84 Hammond Street Waltham, MA 02154 Voice: 1-617-893-8282 FAX : 1-617-969-0385 distributes Hoffman Virus Summary Document, other products unknown Vancouver Institute for Research into User Security 3118 Baird Road North Vancouver, B. C. V7K 2G6 604-984-9983 virus research archives, seminars, vendor contact list, product reviews, consulting Frans Veldman ESaSS B.V. P.o. box 1380 6501 BJ Nijmegen The Netherlands Tel: 31 - 80 - 787 771 Fax: 31 - 80 - 777 327 Data: 31 - 85 - 212 395 (2:280/200 @fidonet) c/o Jeroen W. Pluimers/Smulders P.O. Box 266 2170 AG Sassenheim The Netherlands work: +31-71-274245 9.00-17.00 CET home: +31-2522-11809 19:00-23:00 CET email: 2:281/521 or 2:281/515.3 email: PLUIMERS@HLERUL5.BITNET FTHSMULD@rulgl.LeidenUniv.nl ugw.utcs.utoronto.ca!rulgl.LeidenUniv.nl!FTHSMULD TBSCAN, TBRESCUE, TBSCANX, Thunderbyte card Mikael Larsson Virus Help Centre Box 7018 S-81107 SANDVIKEN SWEDEN Phone : +46-26 100518 Fax : +46-26 275720 BBS : +46-26 275710 (HST) FidoNet : 2:205/204 VirNet : 9:461/101 SigNet : 27:5346/108 (soon) Email : vhc@abacus.hgs.se Virus Test Center, Faculty for Informatics University of Hamburg Schlueterstr. 70, D2000 Hamburg 13, FR Germany Prof. Dr. Klaus Brunnstein, Simone Fischer-Huebner Contact: Margit Leuschner (VTC, secretary) Tel: (040) 4123-4158 (KB), -4175 (SFH), -4162 (ML) Email (EAN/BITNET): brunnstein@rz.informatik.uni-hamburg.dbp.de Computer Virus Catalog (MS-DOS, Mac, Amiga and Atari) Worldwide Software Inc. 20 Exchange Place, 27th Floor New York, NY 10005 USA 212-422-4100 Telecopier 212-422-1953 warren@worlds.com Vaccine Version 3.20 - Anti-Viral Software. ============= Vancouver p1@arkham.wimsey.bc.ca | "If you do buy a Institute for Robert_Slade@mtsg.sfu.ca | computer, don't Research into (SUZY) INtegrity | turn it on." User Canada V7K 2G6 | Richards' 2nd Law Security | of Data Security ------------------------------ End of VIRUS-L Digest [Volume 4 Issue 105] ****************************************** Downloaded From P-80 International Information Systems 304-744-2253