cpreston@Sun.COM (09/14/89)
Since there is sudden increased media attention concerning a "Columbus Day" virus, including warnings being sent out nationwide by government agencies, it may be time to mention again (VIRUS-L V2 #174) that the McAfee Associates VIRUSCAN V36 does successfully locate instances of the 1168 and 1280 (DATACRIME) virus. In addition to detecting the apparently original versions, which format cylinder 0 of a hard disk on or after October 13, the scan string in VIRUSCAN will locate the same viruses with a minor change, specifically, a different activation date. I used the network version of VIRUSCAN on a Novell network to search for and successfully locate a program infected with the 1168 virus. Only those network server areas normally accessible to the person running the program are checked, so it should be run by someone with appropriate privileges. The Homebase BBS number for VIRUSCAN (SCANV36.ARC) is 408-988-4004. For those who cannot obtain a copy of VIRUSCAN,and wish to use a program similar to Norton Utilities to search for these viruses, the search strings used by VIRUSCAN are the following: 1168 EB00B40ECD21B4 1280 00568DB43005CD21 These identifying strings are supplied with the permission of Mr. McAfee. Charles M. Preston 907-344-5164 Information Integrity MCI Mail 214-1369 Box 240027 BIX cpreston Anchorage, AK 99524 cpreston@cup.portal.com