Handbook of Infosec Terms 2.0/Handbook_of_Infosec_Terms_Version_2.0_ISSO.iso/text/virusl/vl04_105.txt

Internet Message Format | 1996-09-04 | 40.0 KB

From:       Kenneth R. van Wyk (The Moderator) <[e-mail]>
Errors-To: [e-mail]
To:       [e-mail]
Path:      cert.sei.cmu.edu!krvw
Subject:   VIRUS-L Digest V4 #105
Reply-To:  [e-mail]
--------
VIRUS-L Digest   Tuesday, 18 Jun 1991    Volume 4 : Issue 105

Today's Topics:

Review of Victor Charlie 4.01 (PC)
Review of IBM VIRSCAN version 2.00.01 (PC)
Review of VirAway (PC)
Antivirus contact list (mostly PC)

VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a non-digested Usenet counterpart.
Discussions are not limited to any one hardware/software platform -
diversity is welcomed.  Contributions should be relevant, concise,
polite, etc.  Please sign submissions with your real name.  Send
contributions to [e-mail] (that's equivalent to
VIRUS-L at LEHIIBM1 for you BITNET folks).  Information on accessing
anti-virus, documentation, and back-issue archives is distributed
periodically on the list.  Administrative mail (comments, suggestions,
and so forth) should be sent to me at: [e-mail].

   Ken van Wyk

----------------------------------------------------------------------

Date:    Mon, 17 Jun 91 21:11:09 -0700
From:    [e-mail] (Rob Slade)
Subject: Review of Victor Charlie 4.01 (PC)

[Ed. My apologies for the length of this digest.  The reviews below,
and the vendor list, are available on cert.sei.cmu.edu for anonymous
FTP in the pub/virus-l/docs/reviews directory.  Thanks once again to
Rob Slade for all of this work which he is making available to all of
us!]

                               Comparison Review

Company and product:

Delta Base Enterprises
9800A - 140th St.
Surrey, B. C.
V3T 4M5
604-582-15922
Fax: [phone]
CIS# 72137,603
Bangkok Security Associates
BBS: 662-255-5981
Victor Charlie 4.0

Summary:

Change detection with self generating "bait" files and viral signature
capture

Cost   $99 Cdn

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      2
            Ease of use       3
            Help systems      4
      Compatibility           2
      Company
            Stability         3
            Support           3
      Documentation           3
      Hardware required       4
      Performance             2
      Availability            2
      Local Support           2

General Description:

Victor Charlie is a series of batch and data files that generate a
number of programs for trapping of viral infections.  There is also
provision for the capture of viral signatures.  Utilities are included
for viewing of boot sectors and recovery of hard disk system areas.
Requires DEBUG.COM for some operations.

Version 5.0 has, as of this writing, been released, but has not yet been
received for review.  Due to the novelty of the program, and its
relative anonymity in North America and Europe, I am releasing this
review now, with some notes about version 5.0, rather than wait for the
next version.

                  Comparison of features and specifications



User Friendliness

Installation

The installation procedure outlined in the manual starts "earlier" in
the process than any other reviewed so far.  Not only does it recommend
booting from a floppy, but it suggests that you SYS and replace the
COMMAND.COM file on the hard disk before doing anything else.  An
initial "Quick Start" section of the manual relies on an intermediate
knowledge of MS-DOS by the user, but this is stated at the beginning.
(Unfortunately, it does not immediately point novice users to the later,
and more detailed, VINSTALLATION chapter, nor does it point out the
possible dangers of replacing the operating system on the hard disk.
Also, although there is some discussion is the alter chapter about the
DOS disk, some discussion of the importance of write protection of the
original disks might avoid possibilities for infection at this point.)

Installation of VC is not foolproof by any means.  Almost all error
messages are hidden from the user, and a lack of file space or an
incorrect assumption regarding drive specifications will cause the
installation to fail to complete.  This, however, is not communicated to
the user, and may not be obvious.  To the novice this can be dangerous,
in that the user may consider that the system is protected when, in
fact, it is not.  Experienced users will be able to custom tailor the
installation to their own needs, since everything is done through batch
files.

Although the documentation does indicate that the package can be run on
floppy only systems, installations onto floppies is problematic.  If the
command VINSTALL A: is given, the system will determine that A: is not a
hard drive, and install only a portion of the full set of files.  If,
however, the command VINSTALL A:\VC is given, the program will not
determine that A: is a floppy.  When installing to a floppy drive, the
boot sector and other system areas are "protected" (VC will detect an
infection by a BSI), but not reparable (the back file of the boot sector
is not generated.)  A floppy installation program, FINSTALL.BAT, is
provided, but it does not seem to work properly unless called from
VINSTALL.  Even then, on every attempt to install the program terminated
with an error message about an improper drive or path specification.

Although not mentioned in the manual until page 64, DEBUG.COM is
required by a number of VC's programs.  It should be on the computer,
and in a directory in the active path.

Options in regard to installation are legion, but should be performed
only by experienced users, as they are not necessarily well explained
for the novice.

Path and directory settings are vitally important, and it is quite
possible to generate additional copies of the program which no longer
will trap changes to programs.

Ease of use

The ability to use the programs effectively is very much dependent upon
the installation chosen.  With proper installation, occasional virus
checks can be as simple as a single keystroke (Alt-V).

The program can, however, give conflicting messages.  When the Stoned
virus was active, it correctly detected that something had happened to
the boot sequence.  On a floppy system it was not able to recover the
boot sector, but finished the sequence with a message that "Right now,
you have NO active virus on this computer."

Help systems

There is help of various sorts provided for, but in testing the program
very often "lost" its help file, even when installed as directed.

When a virus is detected, the messages that appear give a useful
explanation of what has happened and why.  The steps to take, and
optional explanations of what has happened are realistic, and should be
clear even to a novice.

Compatibility

Although no part of the package is "resident", it warns against having
TSR's active during installation.

Company Stability

The program is produced by Bangkok Security Associates (programmer John
DeHaven, technical writer Alan Dawson, marketing director Simon Royle
and financial director Ramesh Indhewat).  BSA is a Thai company
registered in the British Virgin Islands from Hong Kong.

Company Support

In Australia, where the product has had its major success to date, the
product is supported by Combat Software.  Otherwise company support is
provided by the BBS listed above.

Documentation

The manual is entertainingly written, and contains a great deal of
information on viral programs in general.  Parts of the manual explain
computer operations to the novice in great detail.  There are, however,
other parts that give out brief, or even misleading, information.

(A note on this business of directions to novice users.  It may seem
like a "fractal" type of problem, in that no matter how much you
explain, there is still more to do.  For example, TBSCAN's documentation
suggests write protecting diskettes, and explains how to do it on a 3.5"
diskette, but not on a 5.25".  Victor Charlie does explain that you
should put a "... sticker ... over the notch at the right-hand side of
the disk when you look at it from the front."  However, failing to
mention that the notch is *square*, on the *side* of the disk cover and
that you cannot see the magnetic disk through it might allow some to
permanently read *and* write protect the disk by placing the sticker
over the drive head access slot.  Still, in many cases Victor Charlie
gives the best explanation to novice users yet reviewed.)

The tone of the documentation (both hardcopy and on disk) varies between
jingoism ("... ultimate security ... defeat any current or future
virus") and realism, while ultimately falling somewhat short in terms of
actual details.  In testing the system, I came to the conclusion that,
while suitable for any users as a warning system, technical personnel
will need more details as to the ultimate effectiveness, and how far to
trust the package.

Hardware Requirements

MS-DOS 2.0 or higher and a minimum 64K of RAM.

Performance

Unfortunately, even at this point, I am unable to state the performance
of the system with confidence.  It will find viral infections of
programs, and of boot sectors.  (In spite of the difficulties
encountered in installing the system to a floppy, it had no difficulty
in identifying "Stoned" infections on floppy.  Further testing revealed
that it was, somehow, detecting a change in the boot sector, rather than
memory.  Although the program checks memory and the system areas of the
disk, the "signatures" of the original system are not stored with
program file signatures.)

The actions of the package as a whole, regenerating itself from batch
and data files, are quite fascinating.  The program is a radical
departure from any other reviewed system, and should be a valuable extra
component for system security.

The change detection of the signature list may possibly be bypassed by a
sophisticated virus, as it depends upon file length and checksum, rather
than some of the more rigourous mathematical methods.  However, the
checksum is described by the company as "double-encrypted", and the
method of calculation and protection, while not user definable, is not
uniform throughout any release of the product.

The program, as it stands, is most useful against memory resident,
program file infecting viri.  Specific identification of sources of
infection is not strong.

Local Support

In Australia, provided by Combat Software.

Support Requirements

Installation of the program is possible for novice users with standard
computer configurations, but should likely be supported for any non-
standard systems.  Novice or intermediate users will require assistance
to identify the source of infection if a virus is detected.

                                 General Notes

This package is quite fascinating in its novel approach to virus
detection.  There are numerous shortcomings, but the approach could be a
valuable adjunct to current methods.  While the current implementation
has significant shortcomings, particularly in non-standard
configurations, the concept is a valuable one and, hopefully, future
development will make the package more valuable as a stand alone
product.

Version 5.0 is said to be a major rewrite and upgrade.  The virus
signature library, which contains only two signatures in version 4.01,
will identify all viral programs identified as "common" in the Hoffman
Summary listing (the date of the listing is not specified.)  The library
will also "accumulate" signatures as new viral programs are encountered.

Changes effective in version 5.0 will include a new interface and
installation process.  New utilities will be added, and protection
against "stealth" viri will be enhanced.  System requirements will
increase to 256K RAM and DOS 3.0 or higher, but the use of DEBUG.COM
will be dropped.  The documentation will include a 200 page book on
computer viral operations, with separate version specific technical
references.

copyright Robert M. Slade, 1991   PCVC.RVW   910617


=============
Vancouver          [e-mail]   | "If you do buy a
Institute for      [e-mail] |  computer, don't
Research into      (SUZY) INtegrity         |  turn it on."
User               Canada V7K 2G6           | Richards' 2nd Law
Security                                    | of Data Security

------------------------------

Date:    Mon, 17 Jun 91 23:57:37 -0700
From:    [e-mail] (Rob Slade)
Subject: Review of IBM VIRSCAN version 2.00.01 (PC)

                               Comparison Review

Company and product:

IBM High Integrity Computing Lab
Thomas J. Watson Research Center
P. O. Box 218
Yorktown Heights, New York
USA      10598
Bill Arnold, author
David Chess [e-mail], [e-mail]
VIRSCAN 2.00.01 dated 910307


Summary:

Non-resident scanner with user extensible signature file.

Cost    $35 US for original license, $10 for upgrades, enterprise wide
license

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      3
            Ease of use       3
            Help systems      3
      Compatibility           3
      Company
            Stability         3
            Support           2
      Documentation           3
      Hardware required       4
      Performance             3
      Availability            2
      Local Support           1

General Description:

IBM's VIRSCAN product appears to fall somewhat oddly between commercial
software and shareware.  Although IBM retains all rights to the program
(in a license agreement written as only IBM can), there is no printed
documentation, and the package is available on either single disks or
via the IBMLINK service.  The price is reasonable for an individual, but
almost absurdly low given the "enterprise wide" license.

VIRSCAN is a non-resident scanner with a non-encrypted and user
extensible signature file.  Command line switches can be used to obtain
a variety of information about the system.  The program makes no attempt
to disinfect or delete infections.

Recommended for any situation, but particularly for medium to large
companies and for intermediate to advanced users.
                  Comparison of features and specifications



User Friendliness

Installation

VIRSCAN, when supplied on disk, is shipped on "non-writable" diskettes.

IBM does not suggest installation on the hard drive at all.  The
suggested use of the program is to boot from a protected floppy, and run
the program from the floppy disk.  The documentation does give
directions on how to prepare a bootable floppy with the scanning program
on it.  These directions are very complete.  (Directions are even given
on how to write protect a 3 1/2" floppy disk, although they are not as
explicit for 5 1/4" disks.)

An explanation of "resident" viri is given, and directions for booting
from the original system floppy are given.  The directions do assume
that you have original IBM equipment and operating system disks, but
should be clear for most systems, even for novice users.

The documentation is written with the novice user in mind, and is, in
places, excellent.  Some "obvious" steps are missing in the directions,
but by and large they are very clear, and cover ground often missing in
the documentation of other products.

Ease of use

As the product has evolved, a number of command line switches have been
added.  The default settings, however, are very well chosen, and novice
users should not need to know the various options.  Advanced users will
be able to use them without problems.

One possible problem is that by default the scan proceeds to conclusion
even when the screen has filled with warning messages.  This should not
be a problem in normal operation, but may be of concern in scanning a
heavily infected system.  (The "-Z" switch will, however, cause the
program to pause at each signature found and this may be an acceptable
alternative.)

Help systems

Two levels of help are available from the command line, called by
switches.  (Somewhat counterintuitively, the "?" switch gives more
extensive and complicated assistance than does the "??" switch.)  As the
program is run from the command line only, "onscreen help" is not an
issue.

Compatibility

VIRSCAN will run under both DOS and OS/2, and will examine drives with
both DOS/FAT and HPFS file structures.

The structure of the signature file is outlined in the manual, and at
least one other scanning program obtained for evaluation (Thunderbyte
Scan from Frans Veldman) uses this same file format as a standard.  This
allows the use of additional signature information with the program, and
also allows users to add new signatures to update the package, or their
own signatures if a new virus is found.

Mention is made in the documentation of a switch to disable "high
memory" checking, which appears to indicate that the program will check
high memory by default.  The extent of this is not, however, clearly
specified in the documentation.  In a communication from David Chess, it
was explained that "high memory" is defined as the area between 640K and
1 meg.  No scanning is done above 1 meg.  (Note that when run from OS/2,
the program does *not* check system memory.  Memory is only checked when
the program is run from DOS or the DOS compatibility box.)

Company Stability

They'll probably be around for a while.

Company Support

Those on the Internet and Usenet who receive VIRUS-L/comp.virus will
have access to David Chess' postings and email address.  IBMLINK
subscribers will have access to upgrades and information.

Documentation

The documentation is available only in softcopy on the disk.  While
sections are excellent, the presentation and order of the manual
(VIRSCAN.DOC) would likely be daunting to the novice.

A major strength is the discussion of the weaknesses of the program, and
a warning against trusting it too far.

Hardware Requirements

The documentation does not state any minimum requirements for operation.

Performance

While VIRSCAN does not search for as many viri as FPROT or SCAN, it
catches all common viri.  Speed of operation is neither the slowest nor
the fastest tested, and is quite acceptable.

Note that VIRSCAN makes no attempt to disinfect or delete infected
files.

Local Support

Local support, even from IBM staff, is unfortunately undependable.
There are numerous instances of those staff who should, presumably, be
familiar with the product being unaware of its particulars and
availability, or even giving out false information.  (I was twice
contacted by IBM staff who *offered* to get me copies of the program for
evaluation, and then were unable to find it themselves.)  There have
been a number of cases of IBM local representatives giving versions
intended for internal use only to outside clients.

Support Requirements

The program should be suitable for any user.  Support staff will find
additional functions that novice users would not use.

If, however, an infection is detected, additional support will be
required.  It is likely that only advanced users would be able to take
effective action, and even then would likely require other antiviral
packages to correct the situation.

                                 General Notes

This product is an excellent value for any company.  It is easy to see
that IBM could lose control over the integrity of the product if it were
to be distributed as shareware or "freeware".  It is also reasonable
that IBM be allowed to make some return on the resources devoted to this
product.  That said, I still could wish for some attempt to make the
product more available to the general user community.

The lack of support available through IBM representatives is disturbing.
Against, while it is understandable that not all staff can be expert in
all products, the lack of support for a product of such universal
importance is to be regretted.

In comparison to other scanners, the lack of disinfection would tend to
make this product an adjunct rather than the only tool used.  It is
still, though, a high quality tool, and could easily be chosen as the
primary virus alert product.

copyright Robert M. Slade, 1991   PCIBMSCN.RVW   910617


=============
Vancouver          [e-mail]   | "If you do buy a
Institute for      [e-mail] |  computer, don't
Research into      (SUZY) INtegrity         |  turn it on."
User               Canada V7K 2G6           | Richards' 2nd Law
Security                                    | of Data Security

------------------------------

Date:    Wed, 12 Jun 91 17:37:07 -0700
From:    [e-mail] (Rob Slade)
Subject: Review of VirAway (PC)

                               Comparison Review

Company and product:

T.C.P. Techmar Computer Products
97 - 77 Queens Blvd.
Rego Park, NY   11374
USA
800-922-0015
718-997-6800
718-997-6666
fax: [phone]
VirAway scanner version 1.46 dated 910128



Summary:

Non resident scanner

Cost    $49 US

Rating (1-4, 1 = poor, 4 = very good)
      "Friendliness"
            Installation      2
            Ease of use       3
            Help systems      1
      Compatibility           2
      Company
            Stability         3
            Support           2
      Documentation           1
      Hardware required       4
      Performance             2
      Availability            2
      Local Support           1

General Description:

VirAway is identical to the CURE program shipped with AntiVirus Plus
from Techmar.  The program is recommended only to "backstop" other
systems, and should not be depended upon as the only means of antivirus
protection in its current form.

                  Comparison of features and specifications



User Friendliness

Installation

VirAway, as shipped to me, comes completely unprotected.  This may not
be the usual form, as the disk documentation contains a READ.ME file
which states that no changes have been made to the documentation, while
I received no documentation with the package.

An installation program is provided, which will only install from drive
A: to the C: drive in a directory called \VIRAWAY.  However, as
installation consists solely of copying three files (and one "startup"
batch file to the root directory), it is not difficult for the
intermediate user to perform a "custom" installation.

Ease of use

Although VirAway came with no documentation, it responds to the same
command line switches as does CURE.  (Not terribly surprising: not only
are the files identical in size, but CURE, when run, identifies itself
as version 1.46 of VirAway.)  Again, if no switches are used, the
program will present a menu of options.

However, command line switches seem to be only able to "add" to the
default options.  (For example, one cannot turn off the display of final
statistics from the command line invocation.)

There is an annoying bug in the program when allowed to disinfect: it
appears to count both the infection detected, and the cleaning process,
as an infection.  The final statistics will indicate that 1 file virus
was found, and one cleaned, but will show the virus named as having
caused two infections.  (If two files are, in fact, infected, the
display shows only two infections.)

Help systems

None provided.

Compatibility

As stated in the review of AntiVirus Plus, VirAway will find most common
viri, but will not find the AIDS virus.

VirAway will find viri active in memory, and, in testing, rendered them
inactive.  However, sufficient traces remained in memory to set off
alarms from other virus scanners.

Company Stability

Techmar is the distributor of IRIS products (from Israel) in the United
States.

Company Support

The evaluation copy of AntiVirus Plus was shipped in good time, although
Techmar had not properly filled in the customs declaration.  The copy of
VirAway came unsolicited, which seems to indicate an active marketing
group if nothing else.

Documentation

Not supplied.

Hardware Requirements

MS-DOS 2.0 or higher, 256K memory.  The promotional material states that
a dual floppy system is necessary, which conflicts with the installation
batch file.

Performance

Detection of viral programs appears to be sufficient for most
situations.  Disinfection of memory appears effective, with the proviso
noted above about false alarms from other scanners.  (According to
memory mapping utilities, the memory is also still "reserved".)
Disinfection of boot sector viri appears to be effective.  Disinfection
of program files appears effective as to the virus removal, but may
leave programs damaged.

During testing, the memory was infected with the Jerusalem B virus
(which VirAway reports as "Black Friday #1").  When VirAway was run, the
virus was rendered inactive in memory, but it had already infected the
VirAway program file.  VirAway then disinfected itself, but increased in
size from 81835 to 81840 bytes on disk.  Subsequent runs with the
program against test sets of viri showed some odd behaviour and an
inability to identify all previously identified viri.  Also, subsequent
runs of VirAway in memory showed a lack of ability to remove infections
from memory.

Local Support

None provided.

Support Requirements

The program, while fairly simple to run, would not necessarily be
suitable for novice users.  Disinfection of viral infections is probably
best left to experienced staff (and possibly other programs.)

                                 General Notes

As it stands, the program cannot be highly recommended.  The number of
viri detected are low even by the standards of other (admittedly more
expensive) programs.  The disinfection ability is somewhat questionable,
and therefore undependable.

copyright Robert M. Slade, 1991   PCVIRAWY.RVW   910612


=============
Vancouver          [e-mail]   | "If you do buy a
Institute for      [e-mail] |  computer, don't
Research into      (SUZY) INtegrity         |  turn it on."
User               Canada V7K 2G6           | Richards' 2nd Law
Security                                    | of Data Security

------------------------------

Date:    Tue, 11 Jun 91 23:35:59 -0700
From:    [e-mail] (Rob Slade)
Subject: Antivirus contact list (mostly PC)

As before ....

Sandy Jenish, Dave Reid (VP Marketing)
Advanced Gravis Computer Technology
7033 Antrim Avenue
Burnaby, B. C.
V5J 4M5
604-434-7274
Telecopier: [phone]
Advanced Security for PC and Mac

Brightwork Development Inc.
766 Shrewsbury Ave.
Jerral Center West
Tinton Falls, NJ  07724
USA
201-530-0440
800-552-9876 (US only)
fax: [phone]
Sitelock, Novell add-on operation restricting software $495
product not available

British Computer Virus Research Centre
12 Guildford Street, Brighton, East Sussex, BN1 3LS, England
Tel: [phone]
Joe Hirst
Virus Simulation Suite, Eliminator/Virus Monitor/Virus Clean
see also ICVI

Carmel Software Engineering
EPG International
Hans-Stiessberger-Strasse 3
D-8013  Haar by Muenchen
head office Israel?
Turbo Anti-Virus Set, scanner vaccine and change checker (including
boot)
product not available

Central Point Software
15220 N. W. Greenbrier Parkway #200
Beaverton, OR   97006
USA
503-690-8090
Central Point Anti-Virus

Certus International
13110 Shaker Square
Cleveland, Ohio   44120
USA
216-752-8181
216-752-8183 Technical Support
BBS 216-752-8134
fax [phone]
800-722-8737
Mike Mytnick, Cleveland
Michael Blumenthald (?), Anaheim
Peter Trippett, 4295370 on MCI mail
operation restricting software, particularly for LANs

ComNETco, Inc.
29 Olcott Square
Bernardsville, NJ   07924
USA
VirusSafe-Anti-Viral Software (cf EliaShim, also Enigma SafeWord (R)
Virus-Safe)
mail undeliverable

CSM Management and Consulting
3031 Main St.
Vancouver, B. C.
V5T 3G8
604-879-4162
Telecopier: 604-874-1668
Overlord
product not available

Cylink
110 S. Wolfe Road
Sunnyvale, CA  94086
USA
408-735-5800
telecopier: 408-738-8269
SecurePC - half card DES encryptor
product not available

PROGRAM CHAIRPERSON: DPMA Virus Conference, 1991
Richard G. Lefkon
NYU, DPMA Fin. Ind. Ch.
609 West 114th Street
New York, NY 10025
[phone]

Data Fellows Ltd
Finland
Ari Hypponen, [e-mail] [e-mail]
data security consulting

Delta Base Enterprises
9800A - 140th St.
Surrey, B. C.
V3T 4M5
604-582-1592
Fax: [phone]
CIS# 72137,603
Victor Charlie 4.0 - change detection

Digital Dispatch, Inc.
1580 Rice Creek Road
Minneapolis, MN   55432
mail undeliverable
55 Lakeland Shores
St. Paul Minn   55043
612-436-1000
800-221-8091
Antigen, Data Physician, Novirus-Anti-viral software
product not available

Director Technologies Inc.
906 University Place
Evanston, IL   60201
USA
Disk Defender-Half-Slot Virus Write-Interrupt Device
product not available

Dynamics Security Inc.
Cambridge, MA
USA
mail undeliverable

EliaShim Microcomputers
520 W. Hwy. 436, #1180-30
Altamonte Springs, Florida
USA
407-682-1587
VirusSafe - TSR scanner (cf ComNETco?)

Bob Bosen
Enigma Logic Inc.
2151 Salvio Street, #301
Concord, CA   94565   USA
Tel: [phone]
     [phone] (not from Canada)
FAX: [phone]
Internet: [e-mail]
Safeword - change detection software

Fink Enterprises
11 Glen Cameron Road, Unit 11
Thornhill, Ontario
L3T 4N3
416-764-5648
Telecopier: 416-764-5649
IRIS Antivirus (from Israel, cf Techmar)

FoundationWare
2135 Renrock Rd.
Cleveland, OH   44118
USA
Vaccine 1.2-Anti-viral software
mail undeliverable, now Certus

Gee Wiz Software Company
c/o Mrs. Janey Huie
10 Manton Avenue
East Brunswick, NJ   08816
USA
Dprotect-Anti-Trojan Software
product not available

Patricia M. Hoffman
1556 Halford Avenue, #127
Santa Clara, CA 95051
Voice: 1-408-246-3915
FAX  : [phone]
BBS  : 1-408-244-0813
Virus Summary Document
also distributed by:
Roger Aucoin
Vacci Virus
84 Hammond Street
Waltham, MA 02154
Voice: 1-617-893-8282
FAX  : [phone]

Denny Kirk
Hyper Technologies
211 - 3030 Lincoln
Coquitlam, B. C.
604-464-8680
Integrity
still in production, not yet available

IBM High Integrity Computing Lab
Thomas J. Watson Research Center
P. O. Box 218
Yorktown Heights, New York
USA      10598
Bill Arnold, author
David Chess [e-mail], [e-mail]
VIRSCAN

IMSI Software
San Rafael, CA
415-454-7101
BBS 415-454-2893
VirusCure Plus
product not available

International Computer Virus Institute
1257 Siskiyou Boulevard, Suite 179
Ashland, OR   97520
USA
503-488-3237
503-482-3284
BBS 503-488-2251
Eliminator anti-viral, virus simulators plus books and consulting
see also British Computer Virus Research Centre, Joe Hirst

Interpath Corporation
Cylene-4-Anti-Viral software, no longer produced
defunct, cf McAfee

IP Technologies
Virus Guard
address no longer valid

Lasertrieve, Inc.
395 Main Street
Metuchen, NJ   08840
USA
Viralarm-Anti-Viral Software
product not available

LeeMah DataCom Security Corp.
3948 Trust Way
Hayward, CA   94545
USA
415-786-0790
product not available

Leprechaun Software Pty Ltd
PO Box 134
Lutwyche  Queensland  4003
Australia
Lindsay Hough [phone]
Leprechaun International
2284 Pine Warbler Way
Marietta Georgia 30062 USA
404 971 8900
fax [phone]
Virus Buster
product not available

Look Software
Cliff Livingstone
Ottawa, Ontario
613-820-9450
Start - VIRUSCAN front end

Paul Mace Software
400 Williamson Way
Ashland, OR   97520
USA
tech support 503-488-0224
fax: [phone]
sold and supported through:
Fifth Generation Systems, Inc.
10049 N. Reiger Rd.
Baton Rouge, Louisiana
USA   70809
1-800-873-4384 sales and info
504-291-7283 tech support
504-291-7221 admin
telecopier: 504-292-4465
Mace Vaccine-Anti-viral software.

McAfee Associates
4423 Cheeney Street
Santa Clara, CA   95054
USA
408-988-3832
Viruscan-Scans disk and RAM for viri.
Morgan Schweers - [e-mail]
Aryeh Goretsky,Tech Sup.|voice(408)988-3832|INTERNET
McAfee Associates       |  fax[phone]|[e-mail]
4423 Cheeney Street     |  BBS(408)988-4004|[e-mail]
Santa Clara, CA  95054  | UUCP apple!netcom!nusjecs!ozonebbs!aryehg
[e-mail]
cynic!van-bc!apple.com!uuwest!aryehg
[e-mail]
cynic!van-bc!uunet!mimsy!ames!netcom.netcom.com!mcafee

Mike McCune
MMCCUNE@SCTNVE...<MM>.
FTP from mibsrv.mib.eng.ua.edu in pub/ibm-antivirus/innoc.zip
INNOC Boot Virus Immunizer, boot sector overlay renders non-booting

Microcom Software Division
3700-B Lyckan Parkway
Durham, NC   27717
USA
also Norwood, MA
919-490-1277
800-822-8224
Virex-PC, also Virex for Mac - scanner
Mary Hughes
Glenn Jordan - beta list Fidonet: 1:155/223
see also Software Concepts Design

Micronyx Inc
1901 N. Central Expressway
Richardson, TX
USA    75080
800-634-8786
fax: [phone]
Triumph security package (PC and LAN)
product not available

Computer Security Division
National Computer Systems Laboratory
National Institute of Standards and Technology (NIST)
225/A216
United States Department of Commerce
Gaithersburg, Maryland  20899
USA
310-975-3411
BBS 2400 bps 301-948-5717
BBS 9600 bps 301-948-5140
John P. Wack
Marianne Swanson (sysop)
[e-mail]
[e-mail]
wack@csmes
cynic!van-bc!csmes.ncsl.nist.gov!wack
[e-mail] (Dennis D. Steinauer)
steinauer.ncsl.nist.gov (CSME1.NCSL.NIST.GOV)
cynic!van-bc!csmes.ncsl.nist.gov!dds

Orion Microsystems
Quebec

Panda Systems
801 Wilson Road
Wimington, DE   19803
USA
Dr. Panda Utilities-Anti-Viral Software
product not available

Parsons Technology
375 Collins Road NE
Cedar Rapids, IA   52402
USA
319-395-9626
Virucide

A. Padgett Peterson, Computer Network Security
Orlando
[phone], 6384 work
[phone] FAX
[phone]
cynic!van-bc!uvs1.orl.mmc.com!tccslr.dnet!padgett
[e-mail] [host unknown]
note: To: "[e-mail]"[e-mail]
cynic!van-bc!uvs1.orl.mmc.com!tccslr.dnet![e-mail]
uvs1.orl.mms.com![e-mail]
Received: from TCCSLR.DECnet MAIL11D_V3 by uvs1.orl.mmc.com
DISKSECURE

PKWare, Inc.
7545 North Port Washington Road
Glendale, WI   53217-3442
USA
PKZIP, PKSFX-File compression utilities with encryption option

Prime Factors
1470 East 20th Avenue
Eugene, OR   97403
USA
VI-Raid-Anti-Viral Software
product not available

Publisher One
Baltimore, Maryland
Chris - [e-mail]
virus protection book (Jan '92?)

PYRAMID Development Corp
20 Hurlbut Street,
West Hartford, CT 06110
203-953-9832
Fax: [phone]
PC/DACS retail $249.00.
product not available

Quaid Software Ltd.
45 Charles Street East
Toronto, ON   M4Y 1S2
416-961-8243
Antidote-Anti-Viral Software
product not available

RG Software Systems Inc
6900 East Camelback Road
Suite 630
Scotsdale AZ 85251
[phone]
Diskwatcher 2.0, ViSpy
product not available

Fridrik Skulason
Box 7180
IS-127 Reykjavik
Iceland
[e-mail]
F-PROT-Virus detection/protection/disinfection and utilities

Ross Greenburg
Software Concepts Design
594 Third Avenue
New York, NY   10016
USA
Flushot-Anti-Viral Software.
see also Microcom

S&S International Ltd.
Berkley Court, Mill Street
Berkhamsted, Herts. HP4 2HB
England
Phone:   [phone]
Fax:     [phone]
BBS:     [phone] (used to be -- still valid??)
E-Mail:  Dr. Alan Solomon <[e-mail]>
Dr. Solomon's Anti-Virus Toolkit (SHERLOCK and HOLMES?)
Vendor:  perComp Verlag GmbH
Holzmuhlenstrasse 84
2000 Hamburg 70
Germany
Phone:   [phone]
Fax:     [phone]
E-Mail:  Gunter Musstopf <[e-mail]>
product not available

Luis Bernardo Chicaiza Sandoval
Phone: [phone]
Universidad de los Andes Bogota, Colombia
mail address: <[e-mail]>
Compucilina  US$70, adds self check module
review copies not available

SECTRA
Teknikringen 2
S-583 30 Linkoping
SWEDEN
Telephone: [phone]
FAX: [phone]
[e-mail]
TCell unix change checker

Sophco
P.O. Box 7430
Boulder, CO   80306
USA
Vaccinate-Anti-Viral Software
product not available

Sophos Limited
20 Hawthorne Way
Kidlington, Oxford,    OX5 1EZ
UK
Vaccine-Anti-Viral Software
product not available

Swarthmore Software Systems
526 Walnut Lane
Swarthmore, PA   19081
USA
Bombsquad, Check-4-Bomb-Anti-Trojan software

Stratford Software
#2047-4710 Kingsway
Burnaby, BC  V5H 4M2
[phone]
SUZY Information System, INtegrity antivirus information network

Symantec/Peter Norton
10201 Torre Avenue
Cupertino, CA   95014
USA
408-253-9600
800-343-4714
800-441-7234
408-252-3570
416-923-1033
Norton AntiVirus

Tacoma Software Systems
7526 John Dower Road W.
Tacoma, WA  98467
VIRSTOP 1.05

T.C.P. Techmar Computer Products
97 - 77 Queens Blvd.
Rego Park, NY   11374
USA
800-922-0015
718-997-6800
718-997-6666
fax: [phone]
    IRIS Antivirus (cf Fink), Antivirus Plus (purported "AI vaccine"),
         VirAway scanner

Tomauri Inc.
30 West Beaver Creek Road, Unit 13
Richmond Hill, Ontario
L4B 3K1
416-886-8122
Telecopier: 416-886-6452
PC Guard - password protection board, also for Mac
product not available

Trend Micro Devices Inc.
2421 W. 205th St., #D-100
Torrance, CA   90501
USA
213-782-8190
fax: [phone]
PC-cillin - program change detection hardware/software

University of Cincinnati
Dep't. of Computer Engineering
Mail Loc. 30 - 898 Rhodes Hall
Cincinnati, OH   45221-0030
USA
Cryptographic Checksum-Anti-Viral software

Vacci Virus
84 Hammond Street
Waltham, MA 02154
Voice: 1-617-893-8282
FAX  : [phone]
distributes Hoffman Virus Summary Document, other products unknown

Vancouver Institute for Research into User Security
3118 Baird Road
North Vancouver, B. C.
V7K 2G6
604-984-9983
virus research archives, seminars, vendor contact list, product reviews,
consulting

Frans Veldman
ESaSS B.V.
P.o. box 1380
6501 BJ  Nijmegen
The Netherlands
Tel:  31 - 80 - 787 771
Fax:  31 - 80 - 777 327
Data: 31 - 85 - 212 395
    (2:280/200 @fidonet)
c/o Jeroen W. Pluimers/Smulders
P.O. Box 266
2170 AG Sassenheim
The Netherlands
work:  [phone]   9.00-17.00 CET
home:  [phone]:00-23:00 CET
email: 2:281/521 or 2:281/515.3
email: [e-mail]
       [e-mail]
       ugw.utcs.utoronto.ca!rulgl.LeidenUniv.nl!FTHSMULD
TBSCAN, TBRESCUE, TBSCANX, Thunderbyte card

Mikael Larsson
Virus Help Centre
Box 7018
S-81107  SANDVIKEN
SWEDEN
Phone    : [phone]
Fax      : [phone]
BBS      : [phone] (HST)
FidoNet  : 2:205/204
VirNet   : 9:461/101
SigNet   : 27:5346/108 (soon)
Email    : [e-mail]

Virus Test Center, Faculty for Informatics
University of Hamburg
Schlueterstr. 70,  D2000 Hamburg 13, FR Germany
Prof. Dr. Klaus Brunnstein, Simone Fischer-Huebner
Contact: Margit Leuschner (VTC, secretary)
Tel: [phone] (KB), -4175 (SFH), -4162 (ML)
Email (EAN/BITNET): [e-mail]
Computer Virus Catalog (MS-DOS, Mac, Amiga and Atari)

Worldwide Software Inc.
20 Exchange Place, 27th Floor
New York, NY   10005
USA
212-422-4100
Telecopier 212-422-1953
[e-mail]
Vaccine Version 3.20 - Anti-Viral Software.



=============
Vancouver          [e-mail]   | "If you do buy a
Institute for      [e-mail] |  computer, don't
Research into      (SUZY) INtegrity         |  turn it on."
User               Canada V7K 2G6           | Richards' 2nd Law
Security                                    | of Data Security

------------------------------

End of VIRUS-L Digest [Volume 4 Issue 105]
******************************************