Alan_J_Roberts@Sun.COM (08/22/89)
This is a forward from John McAfee:
=============================================================================
The VIRUSCAN version V35 now identifies the virus reported by
C. Fischer in Germany. As always, the trickiest problem is the name. We
can't very well use the host program length increment as the nomenclature
this time because the length can change anywhere from 1206 to 1353 bytes
(1206 min for COM files; 1221 + 132 max for EXE files). Using the bell sound
as a name is questionable since the virus appears to be a prototype version
and it seems likely that the bell sound may be removed and replaced in the
final? version. I don't like using Vacsina as the name because it is a data
string that can be trivially changed without materially affecting the virus.
However, conversations with Chris Fischer indicate that he wishes to call the
virus Vacsina, so that's what VIRUSCAN displays when the virus is present.
P.S. We are still struggling over the name of the "Israeli Boot/
Swap/Fat 12/Whatever" virus reported by Uval Tal. Y. Radai is adamant that
it be called the Swap virus. However, no-one that I am aware of has been
able to make the the "Swap..." message reported by Yuval replicate onto
another diskette. When the virus replicates, the area reported by Yuval to
contain the message insists on transferring itself as binary zeros. It seems
to me that someone merely placed the text message into the virus thinking
that it would replicate along with the virus. Until I am further
enlightened, I think that the VIRUSCAN descriptor for this virus should
remain as is.
John McAfee