VIRUS-L Digest Tuesday, 18 Jun 1991 Volume 4 : Issue 105
Today's Topics:
Review of Victor Charlie 4.01 (PC)
Review of IBM VIRSCAN version 2.00.01 (PC)
Review of VirAway (PC)
Antivirus contact list (mostly PC)
VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a non-digested Usenet counterpart.
Discussions are not limited to any one hardware/software platform -
diversity is welcomed. Contributions should be relevant, concise,
polite, etc. Please sign submissions with your real name. Send
contributions to
[email protected] (that's equivalent to
VIRUS-L at LEHIIBM1 for you BITNET folks). Information on accessing
anti-virus, documentation, and back-issue archives is distributed
periodically on the list. Administrative mail (comments, suggestions,
and so forth) should be sent to me at:
[email protected].
Ken van Wyk
----------------------------------------------------------------------
Date: Mon, 17 Jun 91 21:11:09 -0700
From:
[email protected] (Rob Slade)
Subject: Review of Victor Charlie 4.01 (PC)
[Ed. My apologies for the length of this digest. The reviews below,
and the vendor list, are available on cert.sei.cmu.edu for anonymous
FTP in the pub/virus-l/docs/reviews directory. Thanks once again to
Rob Slade for all of this work which he is making available to all of
us!]
Comparison Review
Company and product:
Delta Base Enterprises
9800A - 140th St.
Surrey, B. C.
V3T 4M5
604-582-15922
Fax: (604) 582-0101
CIS# 72137,603
Bangkok Security Associates
BBS: 662-255-5981
Victor Charlie 4.0
Summary:
Change detection with self generating "bait" files and viral signature
capture
Cost $99 Cdn
Rating (1-4, 1 = poor, 4 = very good)
"Friendliness"
Installation 2
Ease of use 3
Help systems 4
Compatibility 2
Company
Stability 3
Support 3
Documentation 3
Hardware required 4
Performance 2
Availability 2
Local Support 2
General Description:
Victor Charlie is a series of batch and data files that generate a
number of programs for trapping of viral infections. There is also
provision for the capture of viral signatures. Utilities are included
for viewing of boot sectors and recovery of hard disk system areas.
Requires DEBUG.COM for some operations.
Version 5.0 has, as of this writing, been released, but has not yet been
received for review. Due to the novelty of the program, and its
relative anonymity in North America and Europe, I am releasing this
review now, with some notes about version 5.0, rather than wait for the
next version.
Comparison of features and specifications
User Friendliness
Installation
The installation procedure outlined in the manual starts "earlier" in
the process than any other reviewed so far. Not only does it recommend
booting from a floppy, but it suggests that you SYS and replace the
COMMAND.COM file on the hard disk before doing anything else. An
initial "Quick Start" section of the manual relies on an intermediate
knowledge of MS-DOS by the user, but this is stated at the beginning.
(Unfortunately, it does not immediately point novice users to the later,
and more detailed, VINSTALLATION chapter, nor does it point out the
possible dangers of replacing the operating system on the hard disk.
Also, although there is some discussion is the alter chapter about the
DOS disk, some discussion of the importance of write protection of the
original disks might avoid possibilities for infection at this point.)
Installation of VC is not foolproof by any means. Almost all error
messages are hidden from the user, and a lack of file space or an
incorrect assumption regarding drive specifications will cause the
installation to fail to complete. This, however, is not communicated to
the user, and may not be obvious. To the novice this can be dangerous,
in that the user may consider that the system is protected when, in
fact, it is not. Experienced users will be able to custom tailor the
installation to their own needs, since everything is done through batch
files.
Although the documentation does indicate that the package can be run on
floppy only systems, installations onto floppies is problematic. If the
command VINSTALL A: is given, the system will determine that A: is not a
hard drive, and install only a portion of the full set of files. If,
however, the command VINSTALL A:\VC is given, the program will not
determine that A: is a floppy. When installing to a floppy drive, the
boot sector and other system areas are "protected" (VC will detect an
infection by a BSI), but not reparable (the back file of the boot sector
is not generated.) A floppy installation program, FINSTALL.BAT, is
provided, but it does not seem to work properly unless called from
VINSTALL. Even then, on every attempt to install the program terminated
with an error message about an improper drive or path specification.
Although not mentioned in the manual until page 64, DEBUG.COM is
required by a number of VC's programs. It should be on the computer,
and in a directory in the active path.
Options in regard to installation are legion, but should be performed
only by experienced users, as they are not necessarily well explained
for the novice.
Path and directory settings are vitally important, and it is quite
possible to generate additional copies of the program which no longer
will trap changes to programs.
Ease of use
The ability to use the programs effectively is very much dependent upon
the installation chosen. With proper installation, occasional virus
checks can be as simple as a single keystroke (Alt-V).
The program can, however, give conflicting messages. When the Stoned
virus was active, it correctly detected that something had happened to
the boot sequence. On a floppy system it was not able to recover the
boot sector, but finished the sequence with a message that "Right now,
you have NO active virus on this computer."
Help systems
There is help of various sorts provided for, but in testing the program
very often "lost" its help file, even when installed as directed.
When a virus is detected, the messages that appear give a useful
explanation of what has happened and why. The steps to take, and
optional explanations of what has happened are realistic, and should be
clear even to a novice.
Compatibility
Although no part of the package is "resident", it warns against having
TSR's active during installation.
Company Stability
The program is produced by Bangkok Security Associates (programmer John
DeHaven, technical writer Alan Dawson, marketing director Simon Royle
and financial director Ramesh Indhewat). BSA is a Thai company
registered in the British Virgin Islands from Hong Kong.
Company Support
In Australia, where the product has had its major success to date, the
product is supported by Combat Software. Otherwise company support is
provided by the BBS listed above.
Documentation
The manual is entertainingly written, and contains a great deal of
information on viral programs in general. Parts of the manual explain
computer operations to the novice in great detail. There are, however,
other parts that give out brief, or even misleading, information.
(A note on this business of directions to novice users. It may seem
like a "fractal" type of problem, in that no matter how much you
explain, there is still more to do. For example, TBSCAN's documentation
suggests write protecting diskettes, and explains how to do it on a 3.5"
diskette, but not on a 5.25". Victor Charlie does explain that you
should put a "... sticker ... over the notch at the right-hand side of
the disk when you look at it from the front." However, failing to
mention that the notch is *square*, on the *side* of the disk cover and
that you cannot see the magnetic disk through it might allow some to
permanently read *and* write protect the disk by placing the sticker
over the drive head access slot. Still, in many cases Victor Charlie
gives the best explanation to novice users yet reviewed.)
The tone of the documentation (both hardcopy and on disk) varies between
jingoism ("... ultimate security ... defeat any current or future
virus") and realism, while ultimately falling somewhat short in terms of
actual details. In testing the system, I came to the conclusion that,
while suitable for any users as a warning system, technical personnel
will need more details as to the ultimate effectiveness, and how far to
trust the package.
Hardware Requirements
MS-DOS 2.0 or higher and a minimum 64K of RAM.
Performance
Unfortunately, even at this point, I am unable to state the performance
of the system with confidence. It will find viral infections of
programs, and of boot sectors. (In spite of the difficulties
encountered in installing the system to a floppy, it had no difficulty
in identifying "Stoned" infections on floppy. Further testing revealed
that it was, somehow, detecting a change in the boot sector, rather than
memory. Although the program checks memory and the system areas of the
disk, the "signatures" of the original system are not stored with
program file signatures.)
The actions of the package as a whole, regenerating itself from batch
and data files, are quite fascinating. The program is a radical
departure from any other reviewed system, and should be a valuable extra
component for system security.
The change detection of the signature list may possibly be bypassed by a
sophisticated virus, as it depends upon file length and checksum, rather
than some of the more rigourous mathematical methods. However, the
checksum is described by the company as "double-encrypted", and the
method of calculation and protection, while not user definable, is not
uniform throughout any release of the product.
The program, as it stands, is most useful against memory resident,
program file infecting viri. Specific identification of sources of
infection is not strong.
Local Support
In Australia, provided by Combat Software.
Support Requirements
Installation of the program is possible for novice users with standard
computer configurations, but should likely be supported for any non-
standard systems. Novice or intermediate users will require assistance
to identify the source of infection if a virus is detected.
General Notes
This package is quite fascinating in its novel approach to virus
detection. There are numerous shortcomings, but the approach could be a
valuable adjunct to current methods. While the current implementation
has significant shortcomings, particularly in non-standard
configurations, the concept is a valuable one and, hopefully, future
development will make the package more valuable as a stand alone
product.
Version 5.0 is said to be a major rewrite and upgrade. The virus
signature library, which contains only two signatures in version 4.01,
will identify all viral programs identified as "common" in the Hoffman
Summary listing (the date of the listing is not specified.) The library
will also "accumulate" signatures as new viral programs are encountered.
Changes effective in version 5.0 will include a new interface and
installation process. New utilities will be added, and protection
against "stealth" viri will be enhanced. System requirements will
increase to 256K RAM and DOS 3.0 or higher, but the use of DEBUG.COM
will be dropped. The documentation will include a 200 page book on
computer viral operations, with separate version specific technical
references.
copyright Robert M. Slade, 1991 PCVC.RVW 910617
=============
Vancouver
[email protected] | "If you do buy a
Institute for
[email protected] | computer, don't
Research into (SUZY) INtegrity | turn it on."
User Canada V7K 2G6 | Richards' 2nd Law
Security | of Data Security
------------------------------
Date: Mon, 17 Jun 91 23:57:37 -0700
From:
[email protected] (Rob Slade)
Subject: Review of IBM VIRSCAN version 2.00.01 (PC)
Comparison Review
Company and product:
IBM High Integrity Computing Lab
Thomas J. Watson Research Center
P. O. Box 218
Yorktown Heights, New York
USA 10598
Bill Arnold, author
David Chess
[email protected],
[email protected]
VIRSCAN 2.00.01 dated 910307
Summary:
Non-resident scanner with user extensible signature file.
Cost $35 US for original license, $10 for upgrades, enterprise wide
license
Rating (1-4, 1 = poor, 4 = very good)
"Friendliness"
Installation 3
Ease of use 3
Help systems 3
Compatibility 3
Company
Stability 3
Support 2
Documentation 3
Hardware required 4
Performance 3
Availability 2
Local Support 1
General Description:
IBM's VIRSCAN product appears to fall somewhat oddly between commercial
software and shareware. Although IBM retains all rights to the program
(in a license agreement written as only IBM can), there is no printed
documentation, and the package is available on either single disks or
via the IBMLINK service. The price is reasonable for an individual, but
almost absurdly low given the "enterprise wide" license.
VIRSCAN is a non-resident scanner with a non-encrypted and user
extensible signature file. Command line switches can be used to obtain
a variety of information about the system. The program makes no attempt
to disinfect or delete infections.
Recommended for any situation, but particularly for medium to large
companies and for intermediate to advanced users.
Comparison of features and specifications
User Friendliness
Installation
VIRSCAN, when supplied on disk, is shipped on "non-writable" diskettes.
IBM does not suggest installation on the hard drive at all. The
suggested use of the program is to boot from a protected floppy, and run
the program from the floppy disk. The documentation does give
directions on how to prepare a bootable floppy with the scanning program
on it. These directions are very complete. (Directions are even given
on how to write protect a 3 1/2" floppy disk, although they are not as
explicit for 5 1/4" disks.)
An explanation of "resident" viri is given, and directions for booting
from the original system floppy are given. The directions do assume
that you have original IBM equipment and operating system disks, but
should be clear for most systems, even for novice users.
The documentation is written with the novice user in mind, and is, in
places, excellent. Some "obvious" steps are missing in the directions,
but by and large they are very clear, and cover ground often missing in
the documentation of other products.
Ease of use
As the product has evolved, a number of command line switches have been
added. The default settings, however, are very well chosen, and novice
users should not need to know the various options. Advanced users will
be able to use them without problems.
One possible problem is that by default the scan proceeds to conclusion
even when the screen has filled with warning messages. This should not
be a problem in normal operation, but may be of concern in scanning a
heavily infected system. (The "-Z" switch will, however, cause the
program to pause at each signature found and this may be an acceptable
alternative.)
Help systems
Two levels of help are available from the command line, called by
switches. (Somewhat counterintuitively, the "?" switch gives more
extensive and complicated assistance than does the "??" switch.) As the
program is run from the command line only, "onscreen help" is not an
issue.
Compatibility
VIRSCAN will run under both DOS and OS/2, and will examine drives with
both DOS/FAT and HPFS file structures.
The structure of the signature file is outlined in the manual, and at
least one other scanning program obtained for evaluation (Thunderbyte
Scan from Frans Veldman) uses this same file format as a standard. This
allows the use of additional signature information with the program, and
also allows users to add new signatures to update the package, or their
own signatures if a new virus is found.
Mention is made in the documentation of a switch to disable "high
memory" checking, which appears to indicate that the program will check
high memory by default. The extent of this is not, however, clearly
specified in the documentation. In a communication from David Chess, it
was explained that "high memory" is defined as the area between 640K and
1 meg. No scanning is done above 1 meg. (Note that when run from OS/2,
the program does *not* check system memory. Memory is only checked when
the program is run from DOS or the DOS compatibility box.)
Company Stability
They'll probably be around for a while.
Company Support
Those on the Internet and Usenet who receive VIRUS-L/comp.virus will
have access to David Chess' postings and email address. IBMLINK
subscribers will have access to upgrades and information.
Documentation
The documentation is available only in softcopy on the disk. While
sections are excellent, the presentation and order of the manual
(VIRSCAN.DOC) would likely be daunting to the novice.
A major strength is the discussion of the weaknesses of the program, and
a warning against trusting it too far.
Hardware Requirements
The documentation does not state any minimum requirements for operation.
Performance
While VIRSCAN does not search for as many viri as FPROT or SCAN, it
catches all common viri. Speed of operation is neither the slowest nor
the fastest tested, and is quite acceptable.
Note that VIRSCAN makes no attempt to disinfect or delete infected
files.
Local Support
Local support, even from IBM staff, is unfortunately undependable.
There are numerous instances of those staff who should, presumably, be
familiar with the product being unaware of its particulars and
availability, or even giving out false information. (I was twice
contacted by IBM staff who *offered* to get me copies of the program for
evaluation, and then were unable to find it themselves.) There have
been a number of cases of IBM local representatives giving versions
intended for internal use only to outside clients.
Support Requirements
The program should be suitable for any user. Support staff will find
additional functions that novice users would not use.
If, however, an infection is detected, additional support will be
required. It is likely that only advanced users would be able to take
effective action, and even then would likely require other antiviral
packages to correct the situation.
General Notes
This product is an excellent value for any company. It is easy to see
that IBM could lose control over the integrity of the product if it were
to be distributed as shareware or "freeware". It is also reasonable
that IBM be allowed to make some return on the resources devoted to this
product. That said, I still could wish for some attempt to make the
product more available to the general user community.
The lack of support available through IBM representatives is disturbing.
Against, while it is understandable that not all staff can be expert in
all products, the lack of support for a product of such universal
importance is to be regretted.
In comparison to other scanners, the lack of disinfection would tend to
make this product an adjunct rather than the only tool used. It is
still, though, a high quality tool, and could easily be chosen as the
primary virus alert product.
copyright Robert M. Slade, 1991 PCIBMSCN.RVW 910617
=============
Vancouver
[email protected] | "If you do buy a
Institute for
[email protected] | computer, don't
Research into (SUZY) INtegrity | turn it on."
User Canada V7K 2G6 | Richards' 2nd Law
Security | of Data Security
------------------------------
Date: Wed, 12 Jun 91 17:37:07 -0700
From:
[email protected] (Rob Slade)
Subject: Review of VirAway (PC)
Comparison Review
Company and product:
T.C.P. Techmar Computer Products
97 - 77 Queens Blvd.
Rego Park, NY 11374
USA
800-922-0015
718-997-6800
718-997-6666
fax: 718-520-0170
VirAway scanner version 1.46 dated 910128
Summary:
Non resident scanner
Cost $49 US
Rating (1-4, 1 = poor, 4 = very good)
"Friendliness"
Installation 2
Ease of use 3
Help systems 1
Compatibility 2
Company
Stability 3
Support 2
Documentation 1
Hardware required 4
Performance 2
Availability 2
Local Support 1
General Description:
VirAway is identical to the CURE program shipped with AntiVirus Plus
from Techmar. The program is recommended only to "backstop" other
systems, and should not be depended upon as the only means of antivirus
protection in its current form.
Comparison of features and specifications
User Friendliness
Installation
VirAway, as shipped to me, comes completely unprotected. This may not
be the usual form, as the disk documentation contains a READ.ME file
which states that no changes have been made to the documentation, while
I received no documentation with the package.
An installation program is provided, which will only install from drive
A: to the C: drive in a directory called \VIRAWAY. However, as
installation consists solely of copying three files (and one "startup"
batch file to the root directory), it is not difficult for the
intermediate user to perform a "custom" installation.
Ease of use
Although VirAway came with no documentation, it responds to the same
command line switches as does CURE. (Not terribly surprising: not only
are the files identical in size, but CURE, when run, identifies itself
as version 1.46 of VirAway.) Again, if no switches are used, the
program will present a menu of options.
However, command line switches seem to be only able to "add" to the
default options. (For example, one cannot turn off the display of final
statistics from the command line invocation.)
There is an annoying bug in the program when allowed to disinfect: it
appears to count both the infection detected, and the cleaning process,
as an infection. The final statistics will indicate that 1 file virus
was found, and one cleaned, but will show the virus named as having
caused two infections. (If two files are, in fact, infected, the
display shows only two infections.)
Help systems
None provided.
Compatibility
As stated in the review of AntiVirus Plus, VirAway will find most common
viri, but will not find the AIDS virus.
VirAway will find viri active in memory, and, in testing, rendered them
inactive. However, sufficient traces remained in memory to set off
alarms from other virus scanners.
Company Stability
Techmar is the distributor of IRIS products (from Israel) in the United
States.
Company Support
The evaluation copy of AntiVirus Plus was shipped in good time, although
Techmar had not properly filled in the customs declaration. The copy of
VirAway came unsolicited, which seems to indicate an active marketing
group if nothing else.
Documentation
Not supplied.
Hardware Requirements
MS-DOS 2.0 or higher, 256K memory. The promotional material states that
a dual floppy system is necessary, which conflicts with the installation
batch file.
Performance
Detection of viral programs appears to be sufficient for most
situations. Disinfection of memory appears effective, with the proviso
noted above about false alarms from other scanners. (According to
memory mapping utilities, the memory is also still "reserved".)
Disinfection of boot sector viri appears to be effective. Disinfection
of program files appears effective as to the virus removal, but may
leave programs damaged.
During testing, the memory was infected with the Jerusalem B virus
(which VirAway reports as "Black Friday #1"). When VirAway was run, the
virus was rendered inactive in memory, but it had already infected the
VirAway program file. VirAway then disinfected itself, but increased in
size from 81835 to 81840 bytes on disk. Subsequent runs with the
program against test sets of viri showed some odd behaviour and an
inability to identify all previously identified viri. Also, subsequent
runs of VirAway in memory showed a lack of ability to remove infections
from memory.
Local Support
None provided.
Support Requirements
The program, while fairly simple to run, would not necessarily be
suitable for novice users. Disinfection of viral infections is probably
best left to experienced staff (and possibly other programs.)
General Notes
As it stands, the program cannot be highly recommended. The number of
viri detected are low even by the standards of other (admittedly more
expensive) programs. The disinfection ability is somewhat questionable,
and therefore undependable.
copyright Robert M. Slade, 1991 PCVIRAWY.RVW 910612
=============
Vancouver
[email protected] | "If you do buy a
Institute for
[email protected] | computer, don't
Research into (SUZY) INtegrity | turn it on."
User Canada V7K 2G6 | Richards' 2nd Law
Security | of Data Security
------------------------------
Date: Tue, 11 Jun 91 23:35:59 -0700
From:
[email protected] (Rob Slade)
Subject: Antivirus contact list (mostly PC)
As before ....
Sandy Jenish, Dave Reid (VP Marketing)
Advanced Gravis Computer Technology
7033 Antrim Avenue
Burnaby, B. C.
V5J 4M5
604-434-7274
Telecopier: (604) 434-7809
Advanced Security for PC and Mac
Brightwork Development Inc.
766 Shrewsbury Ave.
Jerral Center West
Tinton Falls, NJ 07724
USA
201-530-0440
800-552-9876 (US only)
fax: 201-530-0622
Sitelock, Novell add-on operation restricting software $495
product not available
British Computer Virus Research Centre
12 Guildford Street, Brighton, East Sussex, BN1 3LS, England
Tel: 0273-26105
Joe Hirst
Virus Simulation Suite, Eliminator/Virus Monitor/Virus Clean
see also ICVI
Carmel Software Engineering
EPG International
Hans-Stiessberger-Strasse 3
D-8013 Haar by Muenchen
head office Israel?
Turbo Anti-Virus Set, scanner vaccine and change checker (including
boot)
product not available
Central Point Software
15220 N. W. Greenbrier Parkway #200
Beaverton, OR 97006
USA
503-690-8090
Central Point Anti-Virus
Certus International
13110 Shaker Square
Cleveland, Ohio 44120
USA
216-752-8181
216-752-8183 Technical Support
BBS 216-752-8134
fax 216-752-8188
800-722-8737
Mike Mytnick, Cleveland
Michael Blumenthald (?), Anaheim
Peter Trippett, 4295370 on MCI mail
operation restricting software, particularly for LANs
ComNETco, Inc.
29 Olcott Square
Bernardsville, NJ 07924
USA
VirusSafe-Anti-Viral Software (cf EliaShim, also Enigma SafeWord (R)
Virus-Safe)
mail undeliverable
CSM Management and Consulting
3031 Main St.
Vancouver, B. C.
V5T 3G8
604-879-4162
Telecopier: 604-874-1668
Overlord
product not available
Cylink
110 S. Wolfe Road
Sunnyvale, CA 94086
USA
408-735-5800
telecopier: 408-738-8269
SecurePC - half card DES encryptor
product not available
PROGRAM CHAIRPERSON: DPMA Virus Conference, 1991
Richard G. Lefkon
NYU, DPMA Fin. Ind. Ch.
609 West 114th Street
New York, NY 10025
(212) 663-2315
Data Fellows Ltd
Finland
Ari Hypponen,
[email protected] hyde%
[email protected]
data security consulting
Delta Base Enterprises
9800A - 140th St.
Surrey, B. C.
V3T 4M5
604-582-1592
Fax: (604) 582-0101
CIS# 72137,603
Victor Charlie 4.0 - change detection
Digital Dispatch, Inc.
1580 Rice Creek Road
Minneapolis, MN 55432
mail undeliverable
55 Lakeland Shores
St. Paul Minn 55043
612-436-1000
800-221-8091
Antigen, Data Physician, Novirus-Anti-viral software
product not available
Director Technologies Inc.
906 University Place
Evanston, IL 60201
USA
Disk Defender-Half-Slot Virus Write-Interrupt Device
product not available
Dynamics Security Inc.
Cambridge, MA
USA
mail undeliverable
EliaShim Microcomputers
520 W. Hwy. 436, #1180-30
Altamonte Springs, Florida
USA
407-682-1587
VirusSafe - TSR scanner (cf ComNETco?)
Bob Bosen
Enigma Logic Inc.
2151 Salvio Street, #301
Concord, CA 94565 USA
Tel: (415) 827-5707
(800) 333-4416 (not from Canada)
FAX: (415) 827-2593
Internet:
[email protected]
Safeword - change detection software
Fink Enterprises
11 Glen Cameron Road, Unit 11
Thornhill, Ontario
L3T 4N3
416-764-5648
Telecopier: 416-764-5649
IRIS Antivirus (from Israel, cf Techmar)
FoundationWare
2135 Renrock Rd.
Cleveland, OH 44118
USA
Vaccine 1.2-Anti-viral software
mail undeliverable, now Certus
Gee Wiz Software Company
c/o Mrs. Janey Huie
10 Manton Avenue
East Brunswick, NJ 08816
USA
Dprotect-Anti-Trojan Software
product not available
Patricia M. Hoffman
1556 Halford Avenue, #127
Santa Clara, CA 95051
Voice: 1-408-246-3915
FAX : 1-408-246-3915
BBS : 1-408-244-0813
Virus Summary Document
also distributed by:
Roger Aucoin
Vacci Virus
84 Hammond Street
Waltham, MA 02154
Voice: 1-617-893-8282
FAX : 1-617-969-0385
Denny Kirk
Hyper Technologies
211 - 3030 Lincoln
Coquitlam, B. C.
604-464-8680
Integrity
still in production, not yet available
IBM High Integrity Computing Lab
Thomas J. Watson Research Center
P. O. Box 218
Yorktown Heights, New York
USA 10598
Bill Arnold, author
David Chess
[email protected],
[email protected]
VIRSCAN
IMSI Software
San Rafael, CA
415-454-7101
BBS 415-454-2893
VirusCure Plus
product not available
International Computer Virus Institute
1257 Siskiyou Boulevard, Suite 179
Ashland, OR 97520
USA
503-488-3237
503-482-3284
BBS 503-488-2251
Eliminator anti-viral, virus simulators plus books and consulting
see also British Computer Virus Research Centre, Joe Hirst
Interpath Corporation
Cylene-4-Anti-Viral software, no longer produced
defunct, cf McAfee
IP Technologies
Virus Guard
address no longer valid
Lasertrieve, Inc.
395 Main Street
Metuchen, NJ 08840
USA
Viralarm-Anti-Viral Software
product not available
LeeMah DataCom Security Corp.
3948 Trust Way
Hayward, CA 94545
USA
415-786-0790
product not available
Leprechaun Software Pty Ltd
PO Box 134
Lutwyche Queensland 4003
Australia
Lindsay Hough +61 7 2524037
Leprechaun International
2284 Pine Warbler Way
Marietta Georgia 30062 USA
404 971 8900
fax 404 971 8988
Virus Buster
product not available
Look Software
Cliff Livingstone
Ottawa, Ontario
613-820-9450
Start - VIRUSCAN front end
Paul Mace Software
400 Williamson Way
Ashland, OR 97520
USA
tech support 503-488-0224
fax: 503-488-1549
sold and supported through:
Fifth Generation Systems, Inc.
10049 N. Reiger Rd.
Baton Rouge, Louisiana
USA 70809
1-800-873-4384 sales and info
504-291-7283 tech support
504-291-7221 admin
telecopier: 504-292-4465
Mace Vaccine-Anti-viral software.
McAfee Associates
4423 Cheeney Street
Santa Clara, CA 95054
USA
408-988-3832
Viruscan-Scans disk and RAM for viri.
Morgan Schweers -
[email protected]
Aryeh Goretsky,Tech Sup.|voice(408)988-3832|INTERNET
McAfee Associates | fax(408)970-9727|
[email protected]
4423 Cheeney Street | BBS(408)988-4004|
[email protected]
Santa Clara, CA 95054 | UUCP apple!netcom!nusjecs!ozonebbs!aryehg
[email protected]
cynic!van-bc!apple.com!uuwest!aryehg
[email protected]
cynic!van-bc!uunet!mimsy!ames!netcom.netcom.com!mcafee
Mike McCune
MMCCUNE@SCTNVE...<MM>.
FTP from mibsrv.mib.eng.ua.edu in pub/ibm-antivirus/innoc.zip
INNOC Boot Virus Immunizer, boot sector overlay renders non-booting
Microcom Software Division
3700-B Lyckan Parkway
Durham, NC 27717
USA
also Norwood, MA
919-490-1277
800-822-8224
Virex-PC, also Virex for Mac - scanner
Mary Hughes
Glenn Jordan - beta list Fidonet: 1:155/223
see also Software Concepts Design
Micronyx Inc
1901 N. Central Expressway
Richardson, TX
USA 75080
800-634-8786
fax: 214-690-0595
Triumph security package (PC and LAN)
product not available
Computer Security Division
National Computer Systems Laboratory
National Institute of Standards and Technology (NIST)
225/A216
United States Department of Commerce
Gaithersburg, Maryland 20899
USA
310-975-3411
BBS 2400 bps 301-948-5717
BBS 9600 bps 301-948-5140
John P. Wack
Marianne Swanson (sysop)
[email protected]
[email protected]
wack@csmes
cynic!van-bc!csmes.ncsl.nist.gov!wack
[email protected] (Dennis D. Steinauer)
steinauer.ncsl.nist.gov (CSME1.NCSL.NIST.GOV)
cynic!van-bc!csmes.ncsl.nist.gov!dds
Orion Microsystems
Quebec
Panda Systems
801 Wilson Road
Wimington, DE 19803
USA
Dr. Panda Utilities-Anti-Viral Software
product not available
Parsons Technology
375 Collins Road NE
Cedar Rapids, IA 52402
USA
319-395-9626
Virucide
A. Padgett Peterson, Computer Network Security
Orlando
(407)356-4054, 6384 work
(407)356-2010 FAX
(407)352-6007
cynic!van-bc!uvs1.orl.mmc.com!tccslr.dnet!padgett
padgett%
[email protected] [host unknown]
note: To: "
[email protected]"%
[email protected]
cynic!van-bc!uvs1.orl.mmc.com!tccslr.dnet!padgett@dinl.den.mmc.com
uvs1.orl.mms.com!padgett%
[email protected]
Received: from TCCSLR.DECnet MAIL11D_V3 by uvs1.orl.mmc.com
DISKSECURE
PKWare, Inc.
7545 North Port Washington Road
Glendale, WI 53217-3442
USA
PKZIP, PKSFX-File compression utilities with encryption option
Prime Factors
1470 East 20th Avenue
Eugene, OR 97403
USA
VI-Raid-Anti-Viral Software
product not available
Publisher One
Baltimore, Maryland
Chris - HU349C%
[email protected]
virus protection book (Jan '92?)
PYRAMID Development Corp
20 Hurlbut Street,
West Hartford, CT 06110
203-953-9832
Fax: 203-953-3435
PC/DACS retail $249.00.
product not available
Quaid Software Ltd.
45 Charles Street East
Toronto, ON M4Y 1S2
416-961-8243
Antidote-Anti-Viral Software
product not available
RG Software Systems Inc
6900 East Camelback Road
Suite 630
Scotsdale AZ 85251
+1 602 423 8000
Diskwatcher 2.0, ViSpy
product not available
Fridrik Skulason
Box 7180
IS-127 Reykjavik
Iceland
[email protected]
F-PROT-Virus detection/protection/disinfection and utilities
Ross Greenburg
Software Concepts Design
594 Third Avenue
New York, NY 10016
USA
Flushot-Anti-Viral Software.
see also Microcom
S&S International Ltd.
Berkley Court, Mill Street
Berkhamsted, Herts. HP4 2HB
England
Phone: +44 442 877 877
Fax: +44 442 877 882
BBS: +44 494 724 946 (used to be -- still valid??)
E-Mail: Dr. Alan Solomon <
[email protected]>
Dr. Solomon's Anti-Virus Toolkit (SHERLOCK and HOLMES?)
Vendor: perComp Verlag GmbH
Holzmuhlenstrasse 84
2000 Hamburg 70
Germany
Phone: +49 40 693 2033
Fax: +49 40 695 9991
E-Mail: Gunter Musstopf <
[email protected]>
product not available
Luis Bernardo Chicaiza Sandoval
Phone: (91)2 02 23 78
Universidad de los Andes Bogota, Colombia
mail address: <
[email protected]>
Compucilina US$70, adds self check module
review copies not available
SECTRA
Teknikringen 2
S-583 30 Linkoping
SWEDEN
Telephone: +46 13 235214
FAX: +46 13 212185
[email protected]
TCell unix change checker
Sophco
P.O. Box 7430
Boulder, CO 80306
USA
Vaccinate-Anti-Viral Software
product not available
Sophos Limited
20 Hawthorne Way
Kidlington, Oxford, OX5 1EZ
UK
Vaccine-Anti-Viral Software
product not available
Swarthmore Software Systems
526 Walnut Lane
Swarthmore, PA 19081
USA
Bombsquad, Check-4-Bomb-Anti-Trojan software
Stratford Software
#2047-4710 Kingsway
Burnaby, BC V5H 4M2
(604) 439-1311
SUZY Information System, INtegrity antivirus information network
Symantec/Peter Norton
10201 Torre Avenue
Cupertino, CA 95014
USA
408-253-9600
800-343-4714
800-441-7234
408-252-3570
416-923-1033
Norton AntiVirus
Tacoma Software Systems
7526 John Dower Road W.
Tacoma, WA 98467
VIRSTOP 1.05
T.C.P. Techmar Computer Products
97 - 77 Queens Blvd.
Rego Park, NY 11374
USA
800-922-0015
718-997-6800
718-997-6666
fax: 718-520-0170
IRIS Antivirus (cf Fink), Antivirus Plus (purported "AI vaccine"),
VirAway scanner
Tomauri Inc.
30 West Beaver Creek Road, Unit 13
Richmond Hill, Ontario
L4B 3K1
416-886-8122
Telecopier: 416-886-6452
PC Guard - password protection board, also for Mac
product not available
Trend Micro Devices Inc.
2421 W. 205th St., #D-100
Torrance, CA 90501
USA
213-782-8190
fax: 213-328-5892
PC-cillin - program change detection hardware/software
University of Cincinnati
Dep't. of Computer Engineering
Mail Loc. 30 - 898 Rhodes Hall
Cincinnati, OH 45221-0030
USA
Cryptographic Checksum-Anti-Viral software
Vacci Virus
84 Hammond Street
Waltham, MA 02154
Voice: 1-617-893-8282
FAX : 1-617-969-0385
distributes Hoffman Virus Summary Document, other products unknown
Vancouver Institute for Research into User Security
3118 Baird Road
North Vancouver, B. C.
V7K 2G6
604-984-9983
virus research archives, seminars, vendor contact list, product reviews,
consulting
Frans Veldman
ESaSS B.V.
P.o. box 1380
6501 BJ Nijmegen
The Netherlands
Tel: 31 - 80 - 787 771
Fax: 31 - 80 - 777 327
Data: 31 - 85 - 212 395
(2:280/200 @fidonet)
c/o Jeroen W. Pluimers/Smulders
P.O. Box 266
2170 AG Sassenheim
The Netherlands
work: +31-71-274245 9.00-17.00 CET
home: +31-2522-11809 19:00-23:00 CET
email: 2:281/521 or 2:281/515.3
email:
[email protected]
[email protected]
ugw.utcs.utoronto.ca!rulgl.LeidenUniv.nl!FTHSMULD
TBSCAN, TBRESCUE, TBSCANX, Thunderbyte card
Mikael Larsson
Virus Help Centre
Box 7018
S-81107 SANDVIKEN
SWEDEN
Phone : +46-26 100518
Fax : +46-26 275720
BBS : +46-26 275710 (HST)
FidoNet : 2:205/204
VirNet : 9:461/101
SigNet : 27:5346/108 (soon)
Email :
[email protected]
Virus Test Center, Faculty for Informatics
University of Hamburg
Schlueterstr. 70, D2000 Hamburg 13, FR Germany
Prof. Dr. Klaus Brunnstein, Simone Fischer-Huebner
Contact: Margit Leuschner (VTC, secretary)
Tel: (040) 4123-4158 (KB), -4175 (SFH), -4162 (ML)
Email (EAN/BITNET):
[email protected]
Computer Virus Catalog (MS-DOS, Mac, Amiga and Atari)
Worldwide Software Inc.
20 Exchange Place, 27th Floor
New York, NY 10005
USA
212-422-4100
Telecopier 212-422-1953
[email protected]
Vaccine Version 3.20 - Anti-Viral Software.
=============
Vancouver
[email protected] | "If you do buy a
Institute for
[email protected] | computer, don't
Research into (SUZY) INtegrity | turn it on."
User Canada V7K 2G6 | Richards' 2nd Law
Security | of Data Security
------------------------------
End of VIRUS-L Digest [Volume 4 Issue 105]
******************************************
Downloaded From P-80 International Information Systems 304-744-2253
