[comp.virus] 1701/4 Disinfector

Alan_J_Roberts@Sun.COM (08/16/89)

Forward from John McAfee
=============================================================================

    Hi folks.  I've had a large number of panicky calls, and Ken van
Wyk has had at least one 'emergency' message about a possible 1701
virus in the M-1704.EXE disinfector program.  What's happening is
VIRUSCAN is identifying the 1701 virus code within the disinfector
product.  The 1701/4 disinfector is the only one of our disinfectors
that causes this problem, and because of the very small de-garbling
code within the 1701/4 virus, there is no practical way around it.
Our choices are: 1. Remove the 1701/4 disinfector from circulation and
let people disinfect manually; 2. Change VIRUSCAN to ignore the
program (it's the only non-virus program we know of that looks like a
virus to VIRUSCAN); or 3. Continue as is.  I definitely do not want to
change VIRUSCAN to start and 'exclusion' list.  This defeats the
purpose of the scan program and reduces its reliability.  I also
believe that the value of the disinfector outweighs the confusion
factor.  I have stated up front in the documentation for M-1704 that
the user should contact us BEFORE trying to use the program so that we
can verify over the phone whether there is a possibility that the
program really is infected (a slim probability if downloaded from
SIMTEL or other reputable source).
    A second point I'd like to bring up is that people do not need to
stockpile disinfector programs.  Many of these programs are dangerous
if used on uninfected systems and even in infected systems, certain
disinfectors can have unpleasant side effects if used improperly.  A
disinfector should be used AFTER an infection has been verified.  It
appears that many people are collecting disinfectors and trying them
out so that they are prepared for an infection if one occurs.  I don't
think this is a good idea.  My final recommendation is: Read the
documentation and follow the instructions.  If you're using the M-1704
program, then call before you do anything with it.

John McAfee