rommel@lan.informatik.tu-muenchen.dbp.de (Kai-Uwe Rommel) (08/21/90)
Tanguy Kervahut (kervahut@iro.umontreal.ca) reported to Michael Regoli at cica.cica.indiana.edu, that my screen saver EGAUTIL8 seems to be infected by the 1381 virus, but that SCAN V64 does only report this when using the /A switch (rather strange). I checked it out and it seems to be a bug in SCAN itself. SCAN reports the virus even in a virgin, just fresh assembled and linked executable. Also, virlist.txt says, that the 1381 virus attacks EXE files and overlays but not COM files (EGAUTIL8 is a COM file) and that increases the attacked file's size by 1381 bytes which is not true for the "infected" EGAUTIL8. That means, EGAUTIL8 is clean, this seems to be a bug in SCAN. The same virus is "found" in the new version EGAUTL83 which is also not infected. Kai Uwe Rommel -- /* Kai Uwe Rommel * Munich * rommel@lan.informatik.tu-muenchen.dbp.de */