[comp.virus] Viruscan Trojan

jmolini@nasamail.nasa.gov (JAMES E. MOLINI) (02/23/90)

IA88000 <IA88@PACE.BITNET> writes:

> Last night someone upload scanv58.zip to my bbs which contained a
> different version of validate by another author.
>...
> The only thing bogus about this whole matter is the fact that McAfee
> sent out a VALERT notice about it.
>...
> As I mentioned earlier SOURCER was used to disassemble the validate.exe
> and there is no evidence of any code which could damage a system.
>...
> It appears to be a shareware program and clearly states
> this when you run the program.

Then it should have been separately packaged as shareware.  John
McAfee has every right to disclaim any program not written by, or for
him.  Anyone finding the file ZIPed in with his programs would
certainly be reasonable in believing that McAfee had sponsored it.

But right now all we have is the word of an unidentified node on this
worldwide network that this is a harmless file.  (Next time, please
sign all of your correspondence to Virus-L.)

> ...I also feel that Mr. McAfee was in my opinion wrong in using valert
> to knock a another's product without justification. VALERT is ONLY
> supposed to be used (as I read the instructions) to notify the
> community of a trojan or a virus. Nothing, repeat nothing in the
> scanv58 archive file I received meets that criteria!

If this is true, I would absolutely agree.  I think we should ask the
moderator of V-ALERT to sponsor an objective investigation into this
potential abuse of the system.  There is more at stake here than the
credibility of a shareware supplier.

Jim Molini

[Ed. My PERSONAL feelings on the matter: I'm of the "better safe than
sorry" school; I believe that John McAfee found an altered version of
*HIS* shareware package and did his best to notify the community of
that.  If the author of this VALIDATE.EXE program had truly honorable
intentions, then s/he should have either released the package
separately - into either the public domain or shareware - or worked
with Mr. McAfee in officially incorporating the code into the next
SCAN release.  Regardless of whether the alteration to the SCAN
package was good or not, it was an unauthorized alteration, and John
had every right (perhaps even responsibility) to warn the community.

I also personally agree with Jim's request to sign VIRUS-L
correspondence.

As I said, these are my personal feelings.

Ken van Wyk
]