[comp.virus] 4096 Running Rampant At Wharton!

GREVE@wharton.upenn.edu (Michael Greve) (08/01/90)

    We thought we had rid ourselves of the 4096 virus.  Since I last wrote
   to this list the 4096 virus has re-infected the orginal 5 machines in
   our lab plus 4 more.  We seem to be losing the battle of 4096.  What
   I feel is wrong is that we probably have some students with infected
   com and exe files on their floppies (programs, games etc.).  They are
   using their programs and re-infecting our machines (unknowingly).  We
   are currently using Diskmanager as our hard disk protection software.
   Diskmanager isn't protecting the machine against 4096.  Is there a
   program, either shareware or by purchase, that will work with Diskmanager
   and protect the machine from 4096?  At this point we don't have the
   virus under control.  We don't have the capabilities to check students
   disks.  We are closing the lab and re-formatting all the machines. Another
   lab will be closed tomorrow for a entire lab check.  If this virus is on
   student diskettes then any machine could be infected and it could spread
   throughout Penn.  I don't mean to sound so negative, but I am concerned.

				Thanks again for any assistance.

					Michael Greve
					greve@wharton,upenn.edu
					The Wharton School
					University of Pa.

IMER400@INDYCMS.BITNET (martha rapp) (08/03/90)

Michael,

      You must find a way to check and remove the virus from
Students's or the lab will never completely get rid of the infection.
Get an old machine wit h the proper size drives and set it up near the
doorway and don't allow anyone to use the machines if their disks have
not be certified virus free.  I don't t hink that Diskmanager is a
anti-virus program.  Use and pay for Scan from McAfe e or something
similar and ensure that you can get updates easily.  The main it em is
that with hard drives on your machines you must constantly check for
viru sues.
                                    Martha Rapp
                                    Computing Services
                                    IUPUI

aslakson@uunet.UU.NET (Brian Aslakson) (08/03/90)

GREVE@wharton.upenn.edu (Michael Greve) writes:

>    We thought we had rid ourselves of the 4096 virus.  Since I last wrote
>   to this list the 4096 virus has re-infected the orginal 5 machines in
>   our lab plus 4 more.  We seem to be losing the battle of 4096.  What
>   I feel is wrong is that we probably have some students with infected
>   com and exe files on their floppies (programs, games etc.).  They are
>   using their programs and re-infecting our machines (unknowingly).  We
>   are currently using Diskmanager as our hard disk protection software.
>   Diskmanager isn't protecting the machine against 4096.  Is there a
>   program, either shareware or by purchase, that will work with Diskmanager
>   and protect the machine from 4096?  At this point we don't have the

DiskManager, by Ontrack Software (800)752-1333, is not anti-viral
software, has never claimed to be (I'll betcha) anti-viral, and if you
told them -- wait --, I'll tell them.
         I didn't have to finish asking my question about anti-viral
when the man said "No."  It isn't anti-viral, never claimed to be
anti-viral, it partions Harddisks.  That's what it does.  Okay?  "No.
No.  No."

Anyway, get either scan or fprot (or both), also get some memory
resident program like scanres or vshield.  Fprot may have something
like this in it (with it).  READ the documentation.  Try anonymous ftp
at mibsrv.mib.eng.ua.edu goto pub/ibm-antivirus and mget til you're
blue in the face.  There is some excellent stuff there.  scanv64.zip
fprot111.zip vshld64.zip and so on....

Try to download to a clean machine, read everything, then go for it.
Scanres you'll have to get from McAfee's BBS directly, if you want it.
The number's in the documentation for scan.  Fprot I'm checking out
tonite.

Good luck.

Brian Aslakson
- --
Macintosh related:  mac-admin@cs.umn.edu
All else:  aslakson@cs.umn.edu