[comp.virus] New Virus Strain

D1660@AppleLink.Apple.COM (SoftPlus, Paul Cozza,PRT) (09/29/90)

For SAM 2.0 Users:

A new virus has been discovered in France. It is a strain of the ANTI
virus, and was named ANTI-ANGE by its discoverer. It is very similar
to ANTI. It attacks only applications, and generally exhibits the same
behaviour as ANTI.  It has certain bugs (which the previous ANTI does
not have) which can cause applications to crash once infected.

If you are using SAM 2.0 and have configured SAM Intercept in the
Standard, Advanced, or Custom levels, then SAM will alert you when
ANTI-ANGE attempts to change an application's code. Denying this
attempt keeps ANTI from spreading.

Using Virus Clinic you may also add a new virus definition to identify
this virus by name. The fields for the virus definition are:

   Virus Name: ANTI
Resource Type: CODE
  Resource ID: 1
Resource Size: Any
Search String: 000A317CFFFF000CA033303C0997A146     (hexadecimal)
Search Offset: Any   (or, for later versions of SAM, -886 will also work)

Paul Cozza
SAM Author

tyrell@milton.u.washington.edu (Blade Runner) (10/02/90)

D1660@AppleLink.Apple.COM (SoftPlus, Paul Cozza,PRT) writes:
>For SAM 2.0 Users:
>
>A new virus has been discovered in France. It is a strain of the ANTI
>virus, and was named ANTI-ANGE by its discoverer. It is very similar
>to ANTI. It attacks only applications, and generally exhibits the same

Did SAM 2.0 automatically check for the ANTI virus before (I'm
assuming there was/is such a virus judging from the message that this
virus derives from it) or did I miss some new information along the
way?