The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/pc/virus/v06i150.txt

Internet Message Format | 2003-06-11 | 94.9 KB

To:       [e-mail]
Subject:   VIRUS-L Digest V6 #150
--------
VIRUS-L Digest   Monday, 29 Nov 1993    Volume 6 : Issue 150

Today's Topics:

Re: "Eye of the Storm" (*another* Desert Storm virus? :-)
SURVEY: PLEASE HELP!
Re: McAFEE Quarterly newsletter
Re:Swiss Anti-Virus Legislation
UA-Dialer 2.8g (Amiga)
Re: Horror of Horrors! (PC)
Info Requested on "INOCULAN" (PC)
Re: Satanbug (PC)
STONED 3 as broken my floppy !!! (PC)
Re: Form virus--IBM (PC)
Re: McAfee Vshield and Windows (bad combination) (PC)
funky HD error? (PC)
Re: Virus poll (PC)
Re: Sorry, I need more RAM memory (PC)
November 17th Virus at Manchester Univ (England): from Italy? (PC)
Restoring Floppy's Boot Sector (PC)
Re: Scanning below the DOS level (PC)
Memory lack for cleaning virus (PC)
How to clean Exebug2 ? (HELPME, please, please ) (PC)
Re: which antivirus program (PC)
CPAV immunization in .COM/.EXE and copyrigths (PC)
PS to "Help !! I have virus in my partition table..." (PC)
Call-for-Papers
McAfee VIRUSCAN 109 uploaded to the SimTel Software Repository (PC)
Antiviral BBS listing

VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a gatewayed and non-digested USENET
counterpart.  Discussions are not limited to any one hardware/software
platform - diversity is welcomed.  Contributions should be relevant,
concise, polite, etc.  (The complete set of posting guidelines is
available by FTP on CERT.org or upon request.)  Please sign submissions
with your real name; anonymous postings will not be accepted.
Information on accessing anti-virus, documentation, and back-issue
archives is distributed periodically on the list.  A FAQ (Frequently
Asked Questions) document and all of the back-issues are available by
anonymous FTP on CERT.org (192.88.209.5).

Administrative mail (e.g., comments, suggestions, beer recipes)
should be sent to me at: [e-mail].

All submissions should be sent to: [e-mail].

   Ken van Wyk

----------------------------------------------------------------------

Date:    Mon, 15 Nov 93 07:25:52 -0500
From:    [e-mail] (Ken Bruce)
Subject: Re: "Eye of the Storm" (*another* Desert Storm virus? :-)

In comp.virus, [e-mail] (Rob Slade) writes:
>BKEYESTM.RVW   931019
>
>In the book, we once again see the myth of a virus (or the defending
>"worm" in this case) being able to damage hardware.  Fuses blow, wires
>burn out and the power for the entire complex shuts down.  Debugging
>do.
><rest deleted to save bandwidth

That was an interesting remark. The energy managing and control systems
that I was involved in the early '80's, were the industries trial and
error systems. The very first systems, and I supposed porely written
modern systems, had very little in the way of electro/mechanical safeguards
to prevent the software from making a system doing itself harm. Boilers
and A/C systems powered themselves up and down, and electrical switchgear
simply shutoff. The majority of the time the problem was in sensory
feedback failure, but on occasion faulty software was to blame.

"We are sorry, the fix will be in the next release, we will be more
than happy to send you a Beta version. Please let us know if they are
any problems. Please send your check to postal box, xxx, Grand Caymen
Island.  ,-)

The nuclear industry probably did the best safeguarding even they have
had some accidents. The most recent I believe to be the one where 3
days went past before someone noticed that the power was off to an idle
reactors safety system. The space shuttle program has its own share
of computer glitches that create hardware (life support, control power
etc.) My point is anytime that software controls that kind of hardware,
and if software errors can create havoc, then a virus can cause blown
fuses, burnt wires etc., given that the virus has an entry point to
the system. It all hinges on the physical safeguards in place and the
human attention given. I haven't read the book yet, however I suspect
the author may be guilty of not explaining in detail the exact steps
the virus took to create the havoc.  When science becomes boring, a
creative author can make it interesting to us unscientific souls.

|-----------------------------------------------------------------------------|
| [e-mail]        | Opinions expressed herein are not those   |
| Ken Bruce                       | of my employer. They are not even mine.   |
| David Taylor Model Basin        | The devil made me do it.                  |
| Code 3581 Customer Support      |                                           |
| [phone] Autovon 287-4030 | Chairman of the Bored.                    |
|-----------------------------------------------------------------------------|

------------------------------

Date:    Tue, 16 Nov 93 19:46:09 -0500
From:    [e-mail] (John Wuzbek)
Subject: SURVEY: PLEASE HELP!

I am doing a research paper, would you please help out by answering the
following questions:

(1) Do you think your system is at risk of computer virus attack?

(2) Do you think you can take reasonable measures that can totally secure
    your system?

(3) Do you think there should be laws against the deliberate transmission
    of computer viruses?

Please send your responses to [e-mail]
Thank you very much for your time.

------------------------------

Date:    Wed, 17 Nov 93 03:46:54 -0500
From:    [e-mail] (McAfee Associates)
Subject: Re: McAFEE Quarterly newsletter

Hello Adam,

[e-mail] (Adam Rodgers) writes:
>Does anyone know where I can find past issue's of the Virus newsletter?
>Also, is there a mailing list on the internet I can subscribe to?
>
>Thanx,
[..signature deleted..]

McAfee Associates does publish a quarterly newsletter named
(unimaginatively) "Quarterly Update" for licensed (business) users of
our software.  They are mailed out to the point of contact on the site
license.  We usually have a few hundred left over after each mailing,
so if you'd like one (or anyone else reading this) I'd recommend that
you send a postcard to the address in my signature file asking for a
copy.

Regards,

Aryeh Goretsky
McAfee Associates Technical Support

- --
- - - - - - -  Please send your reply, if any, to [e-mail]  - - - - - -
McAfee Associates, Inc.  | Voice [phone] | INTERNET: [e-mail]
2710 Walsh Ave, 2nd Floor| FAX   [phone] |  or try: [e-mail]
Santa Clara, California  | BBS   [phone] | CompuServe ID: 76702,1714
95051-0963  USA          | USR HST Courier DS   |  or GO MCAFEE
Support for SENTRY/SCAN/VSHIELD/CLEAN/WSCAN/NETSHLD/TARGET/CONFIG MGR/PROVIEW

------------------------------

Date:    Sat, 20 Nov 93 07:06:25 -0500
From:    Klaus Brunnstein <[e-mail]>
Subject: Re:Swiss Anti-Virus Legislation

Based on reactions from participants in this forum, the draft paragraph of
to be incorporated in the Swiss Penal Code was properly updated. After success-
ful discussions with Staenderat (senate), the related law will be discussed in
Swiss parliament, in December 1993. For your information, I forward a message
from Mr. Frigerio about the development and actual status.

Regards === The Messenger === (Klaus Brunnstein, U-Hamburg, Nov.20,1993)

================== Message from Mr. Claudio Frigerio ========================

On November 11, 1993 the Law Committee of the 2nd Chamber of the Parliament
(German: "Staenderat"; a kind of "Swiss Senate") decided to accept the anti-
virus propositions. The Staenderat will probably discuss in Parliament and
decide on the subject by December 1993. In the Law Committee there was
practically no opposition to the law draft; thus it is very likely that the
Staenderat will accept it too. After this the "Nationalrat" (the 1st Chamber of
Parliament, a kind of "Swiss House of Representatives" or "Swiss Congress")
will  discuss the draft and decide about it by Spring 1994.

The Swiss law draft, posted to the net, has been changed considerably in the
last few weeks. The draft actually discussed in Parliament will be:

German text:
Schweizerisches Strafgesetzbuch, Artikel 144bis, Datenbeschaedigung
1. Wer unbefugt elektronisch oder in vergleichbarer Weise
   gespeicherte oder uebermittelte Daten loescht, veraendert oder
   unbraucbar macht, wird, auf Antrag, mit Gefaegnis oder mit Busse
   bestraft.
   Hat der Taeter einen grossen Schaden verursacht, so kann auf
   Zuchthaus bis zu fuenf Jahren erkannt werden. Die Tat wird von
   Amtes wegen verfolgt.
2. Wer Programme, von denen er weiss oder annehmen muss, dass sie
   zu den in Ziffer 1 genanten Zwecken verwendet werden sollen,
   herstellt, einfuehrt, in Verkehr bringt, anpreist, ueberlaesst oder
   sonstwie zugaenglich macht oder zu ihrer Herstellung Anleitung gibt,
   wird mit Gefaegnis oder mit Busse bestraft.
   Handelt der Taeter gewerbsmaessig, so kann auf Zuchthaus bis zu
   fuenf Jahren erkannt werden.

English text:
Swiss Criminal Code, Article 144bis, Damaging of data
1. Anyone, who without authorization deletes, modifies or renders
   useless electronically or similarly saved or transmitted data, will,
   if a complaint is filed, be punished with the imprisonment for a
   term of up to 3 years or a fine of up to 40000 Swiss francs.
   If the person charged has caused a considerable damage, the
   imprisonment will be for a term of up to 5 years. The crime will
   be prosecuted ex officio.
2. Anyone, who creates, imports, distributes, promotes, offers,
   makes available, circulates in any way, or gives instructions to
   create programs, that he/she knows or has to presume to be used
   for purposes according to item 1 listed above, will be punished
   with the imprisonment for a term of up to 3 years or a fine of up
   to 40000 Swiss francs.
   If the person charged acted for gain, the imprisonment will be for
   a term of up to 5 years.

This English translation may not be perfect. The text will be available by
January 1994 in all official Swiss languages: German, French and Italian.

The protected item of this article are just data (immaterial goods). Any damage
to computer systems, like the burning of floppies, plug-pulling, sledgehammers
etc. are damages to "physical/material things" covered by article 144
(Sachbeschaedigung, damage to property).

According to Swiss penal legislation the requisite knowledge and intent
("knowingly and willingly") have not to be mentioned specifically.

As you may have noticed, the "registration" of IS security pros has been
dropped. The expression "that he/she knows or has to presume to be used for
purposes according to item 1 listed above" will exclude any penal responsibi-
lity if the committer e.g. gave a virus to a professional anti-virus software
developer or is creating viruses for research, as in these and similar special
situations a misuse of the virus is highly unlikely. The committer will not be
prosecuted, if he had reasonable motives, to practically exclude a misuse. On a
retrospective analysis the judge will check if the person who gave a viruses to
somebody else (who misused it to cause damage) could in any way be blamed for
not having foreseen the occurred misuse. If you give a virus to a notorious
anti-virus professional, known for spreading viruses or source codes, or simply
to somebody who does not give a special guarantee for not misusing the virus,
you will be prosecuted. Who just trusted in the promise of a virus-recipient,
that the latter will not misuse it, will be in trouble, if he did not have a
very special additional reason to trust him. The law considers viruses as so
dangerous for the general public, that any act making them available to
somebody else, represents a general risk to the general public. Who invokes an
exception,that an act of making a virus available to somebody else, did not
represent such a risk has to prove it.

This may cause some concern, but law can not foresee any situation. Judges will
have to carefully check if the reasons to give a virus to somebody else, were
good enough to practically exclude any misuse.

Making a newly discovered virus available to McAfee or the Virus Test Center
will not be a crime, as long as the reputation of these recipients is above any
suspicion.

As the draft is now in the Parliament, there is practically no way to change
any thing in this text anymore (by the administration). Now it is up to the
politicians to decide about the subject and to make any additional change.

Claudio G. Frigerio

+------------------------------------------------------------------------------+
| Claudio G. Frigerio
| Bundesamt fuer Informatik/Stabsdienste
| (Swiss Federal Office of Information Technology and Systems/Staff Services)
| Feldeggweg 1, CH-3003 Bern (Switzerland)
+-------------------------------------+----------------------------------------+
| Telefon/Voice:  +41/31/325-9381     | e-mail:  [e-mail]
| Telefax:        +41/31/325-9030     |
+------------------------------------------------------------------------------+

------------------------------

Date:    Thu, 18 Nov 93 08:06:24 -0500
From:    [e-mail] (Ulf Magnusson)
Subject: UA-Dialer 2.8g (Amiga)

What does this do? Please tell me all you know!

- ------------------------------------------------------------------------------
  Ulf Magnusson           ([e-mail])
  Tornavdgen 3:503        Lund Institute og Technology, Sweden
  S-223 63 LUND
  SWEDEN
- ------------------------------------------------------------------------------

------------------------------

Date:    Tue, 23 Nov 93 15:28:00 +0200
From:    "Y. Radai" <[e-mail]>
Subject: Re: Horror of Horrors! (PC)

  Jenny Abar writes:
> My husband uses Untouchable and he thought it was a little overdue
> for a virus update so he called Fifth Generation Systems Tech Support
> to find out when Untouchable/Search and Destroy updates are due (they
> were also supposed to come out with an updated utres.exe).  He was
> told that as of Nov. 1 Untouchable is discontinued!!
>
> It appears that Symantec has bought Fifth Generation and will no
> longer offer Untouchable or S & D.  They will refund your money if
> it is still under warranty (Not sure about if it is not) or "allow"
> you to upgrade to NAV 3.0 for $29, whoppee!
>
> Are any of the Untouchable people still out there?  What will become
> of these programs?  Is Symantec going to incorporate some of their
> features into NAV or are they just going to let it die out?  Please
> let us know so I can tell my husband to get a refund, we don`t want
> to be stuck with NAV.

There was a similar report in the November issue of the Virus Bulletin.
In any case, I just phoned BRM (the producers of Untouchable and
Search & Destroy) and was told that, contrary to rumors, and contrary
even to what FGS Tech Support may have been saying up to now, there
has not yet been a final decision as to the future of these products.
However, he implied that whatever the decision, the *capabilities* of
these packages would continue to be available in one form or another.

                                     Y. Radai
                                     Hebrew Univ. of Jerusalem, Israel
                                     [e-mail]
                                     [e-mail]

------------------------------

Date:    Mon, 15 Nov 93 18:23:56 -0500
From:    [e-mail] (Kenneth J. Walkky)
Subject: Info Requested on "INOCULAN" (PC)

My bank is looking at the LAN virus protection software "InocuLAN"
sold by Cheyenne Software, Roslyn Heights, NY.
Has anybody evaluated this software? Any info from current users?
 The information from the vendor claims "complete network
security", etc.
- --
[e-mail]        |    "Just when I figured out the answers
Kenneth J. Walkky        |    to all of life's questions.....
Seattle, Washington, USA    |    they changed the questions!"

------------------------------

Date:    Mon, 15 Nov 93 18:17:09 -0500
From:    [e-mail] (C Glenn Jordan -- Virex-PC Development Team)
Subject: Re: Satanbug (PC)

    The product I work on, Virex for the PC, detects S-Bug reliabley
in the 2.91 version and greater.  We don't attempt to repair it.

    A lot of the information in the LAN Times article was inaccurate
and apparantly designed to stir up fear and concern.  This is not a virus
worth special media attention.  It would be nice if its author would turn
his efforts to more productive endeavors.

    During the work I did on the decryptor-detector for Satin_Bug, I
noticed the routine seemed very familiar.  It was the same as I had seen in
another, non-resident, virus which called itself "FruitFly".  Also written
by Little_LOC, who could be doing more interesting things if he were to try.

------------------------------

Date:    Tue, 16 Nov 93 04:17:59 +0000
From:    [e-mail] (Jean Laganiere)
Subject: STONED 3 as broken my floppy !!! (PC)

Hi

One of my friend has detected STONED 3 on is PC a couple of day ago.
He says that he can not use is floppy drive since then.  When he try
to read a disket, he always see the directory of the preceding one...

This seem very strange. Is that possible that the virus as broken
someting in is hardware ???

Any info would be apreciated.

Tanks in advance.

Jean

------------------------------

Date:    Tue, 16 Nov 93 09:19:38 -0500
From:    [e-mail]
Subject: Re: Form virus--IBM (PC)

Richard Ford ([e-mail]) writes:
> Form has a harmless but irritating trigger routine. After INT 13h is
> hooked, the date is checked. If this corresponds to the 18th of any
> month, the virus also hooks the keyboard interrupt. The new INT 09h
> handler causes a click to be produced by the PC's speaker every time a
> key is pressed.

One sidenote about the activation effect of Form. If a keyboard handler
(typically KEYB.COM) is loaded, the keyboard ticks caused by Form are
not heard at all. This happens because KEYB takes over the INT 09h
(keyboard interrupt).

Since a very large number of PCs (perhaps even half of all the installed
systems) are running KEYB.COM or a similar program to provide a national
keyboard setup, it is quite important to take this into account when
talking about the activation effect of Form. On such PCs, Form will not
seem to activate in any way.
- --
         Mikko Hypponen // [e-mail] // Finland
   Data Fellows Ltd's F-PROT Professional Support: [e-mail]
              PGP 2.3a public key available, ask by e-mail

------------------------------

Date:    Tue, 16 Nov 93 11:56:41 -0500
From:    [e-mail] (Alexander Dittrich)
Subject: Re: McAfee Vshield and Windows (bad combination) (PC)

>Perhaps others could confirm this:

>I have several (3) DOS windows in my startup group.  They start up minimised.

>If I have vshield loaded when I start up windows at least two of these
>minimised icons start to flash and report that "this application has
>violated system integrity etc..."  This happens even if I have only one
>DOS window in startup.  If I take them all out of startup and start them
>manually I don't get this effect.

>I know that it is probably not common to have dos windows like this,
>but the problem is repeatable so it must be a bug somewhere.  I want to
>start up telbin.exe in server mode, so there is at least one dos window that I
>don't want to remove from the startup group.

>I contacted our local McAfee rep and sent quite a bit of info (windows
>msd info) to [e-mail] about 2 months ago and have still not
>had any luck or pointers from them.

>Could others using vshield confirm this for me?  I am wanting to
>implement a new campus wide policy for scanning for viruses and SCAN.EXE
>takes far too long to be run at each bootup.  I would prefer to make vshield
>a standard means of detection/prevention, but not if it is flaky with
>Windows.

>I have a 386DX 33Mhz with 8Mb ram, this happens with DOS5 and DOS6.

>Any confirmation/denials/suggestions would be appreciated.

Hi,

we had to unload vshield in order to get WINDOWS working correctly.
Why don4t you use vshield just for checking and unload it afterwards?
BTW, SCAN is slow, indeed, but an infection doesn4t only slow down
work, it STOPS IT. I think those few seconds of delay are REALLY
neglectible. Also, there4s another product by McAfee called SENTRY.
Don4t know how good it is, but it sure IS fast...

Regards,  Alex

------------------------------

Date:    Tue, 16 Nov 93 18:25:51 -0500
From:    [e-mail] (Corey Lawson)
Subject: funky HD error? (PC)

FDISK /MBR is doing some funky stuff on my IBM PS/2-90...

It gets an error, puts some blue crud on the top two lines of the screen,
with the error, "No fixed disks present."

also, when I fire up F-PROT to scan the HD, I get a "Disk error on the
hard disk" box, and hitting ESC continues the test.

This doesn't sound good.

SCAN doesn't report anything fishy... Anybody have similar experiences or
could tell me what I should be looking for?

- -Corey Lawson
[e-mail]

------------------------------

Date:    Tue, 16 Nov 93 23:23:30 -0500
From:    [e-mail] (vfr)
Subject: Re: Virus poll (PC)

regarding the following,  i think it would be interesting if
someone had the statistics on which of these viruses were
released on commercial software, reshrinkwrapped software,
etc. if i am not mistaken, the first two definitely have been
released accidentally by commercial product vendors.

do you have any information on the mode of transmission of these
viruses listed? (i mean, the specific mode, not the general mode).

>Michelangelo              203
>Stoned                    188
>512 (no. of the beast)    132
>Jerusalem                  67
>Ping Pong (Italian boot)   67
>Cascade                    19
>Dark Avenger               13
>Antitel                     8
>Dir II                      8
>Flip                        6
>Frodo                       2
>Form                        1
>Other                      59

- --

[e-mail] / [e-mail]         bbs:    219-273-2431
fidonet 1:227/190 / virnet 9:10/0  p.o. box 11417    south bend, in 46624
while [ $lines -le $maxlines ] do echo >> $BUFFER  lines='expr $lines +1 '

------------------------------

Date:    Wed, 17 Nov 93 04:23:43 -0500
From:    [e-mail] (McAfee Associates)
Subject: Re: Sorry, I need more RAM memory (PC)

Hello,

[e-mail] (Ng Bee Yong) writes:
>Has anyone encounter the following error message from SCAN?
>
>  Sorry, I need more RAM memory
>  390 kbytes should be enough
>
>Is it some kind of bug in SCAN?  I am quite sure I have more than 500 kbytes
>of conventional memory before running SCAN.  It happened when I scanned some
>standalone machines, and also when I tried to scan the network.
[...deleted...]

The "Sorry, I need more..." error message occurs when VIRUSCAN can not
allocate enough memory on the PC in question to scan a file for
viruses.

I would first recommend that you check the PC you are running SCAN on
to make sure that it does have enough memory.  Remember, 390 kilobytes
= 399,360 bytes, not 390,000 bytes.

Next, check to see if you are using a foreign language support file
with SCAN.  It would be named as MCAFEE.MSG and in the same directory
as the SCAN.EXE file.  Running SCAN with an FLS file will increase
SCAN's memory usage by the size of the file (typically 15Kb +/- 2Kb or
so).

If you are running SCAN out of a batch file or network login script,
try placing the DOS MEM command (or something like it) in the
batch/script file to see how much memory is available when SCAN is
called.

Lastly, what version of SCAN are you using?  V107 had a problem in
that it would allocate memory from DOS without releasing it, causing
it to run out of memory to read files into.  If you are using V107,
upgrade to V108 or above (V109 was just released and should be at the
SimTel ftp site shortly) and try running that in its place.

Regards,

Aryeh Goretsky
McAfee Associates' Technical Support
- --
- - - - - - -  Please send your reply, if any, to [e-mail]  - - - - - -
McAfee Associates, Inc.  | Voice [phone] | INTERNET: [e-mail]
2710 Walsh Ave, 2nd Floor| FAX   [phone] |  or try: [e-mail]
Santa Clara, California  | BBS   [phone] | CompuServe ID: 76702,1714
95051-0963  USA          | USR HST Courier DS   |  or GO MCAFEE
Support for SENTRY/SCAN/VSHIELD/CLEAN/WSCAN/NETSHLD/TARGET/CONFIG MGR/PROVIEW

------------------------------

Date:    Wed, 17 Nov 93 11:56:55 -0500
From:    [e-mail]
Subject: November 17th Virus at Manchester Univ (England): from Italy? (PC)

  John Smith <[e-mail]> wrote to [e-mail] at 16 Nov 93
17:31:19 GMT and the message found its way to me:-
  > I have had one user with a laptop PC which who has had files infected with
the November 17 855 virus. Dr Solomon's Toolkit gave two different messages
for infected files: "filename identified as November 17.855 virus" or
"filename This virus is like November 17". Microsoft anti-virus in DOS 6 has
November 17 virus on its info list but did not identify this infection.
Neither did VET 7.3. The user had an old version of McAfees SCAN which did
report it (but apparently failed to clean despite saying it had). Dr Solomon
seemed to clean OK but Scan would still report the files as infected
afterwards. John Smith, Economics

  (1) I later gave John Smith a copy of SCAN v.106 (he had v102).
  (2) False positive? Ghost? Some new version and still infected?
  (3) John Smith told me that the infected user blames a floppy that the
infected user got from a company director in Italy during a visit.

------------------------------

Date:    Wed, 17 Nov 93 14:34:30 -0500
From:    [e-mail] (Russell Aminzade)
Subject: Restoring Floppy's Boot Sector (PC)

Thanks to an earlier query here about cleaning boot-sector
diskettes off of floppies, a reader of this group (I'm sorry,
I lost the name, but thank you anonymous wizard!) sent me a simple
debug script for getting a good boot sector
off of a known uninfected diskette, and another one to write
a boot sector.  They look like this, and they work like a charm:

- ------------------------------------------------------------
read boot sector to file goodbt
- ------------------------------------------------------------
l 100 0 0 1
n goodbt.
rcx
200
rbx
0
w
q
- ------------------------------------------------------------
write boot sector image from file goodbt
- ------------------------------------------------------------
n goodbt
l 100
w 100 0 0 1
q
- ------------------------------------------------------------

Of course, I need to have one boot sector image for each size
disk we commonly use here (720 and 1440), and I also have to
do:

debug < WRITEHD.DBG

Here's my question.  Is there a soul out there who can tell me
how to make these debug scripts into EXE or COM files?  I have never
used DEBUG outside of a classroom (I shy away from Intel
chips as a rule anyway.  Never could appreciate their sense of humor
- -- writing each byte in pig latin like that).  I suspect it would
just be one more line or two of DEBUG

------------------------------

Date:    Wed, 17 Nov 93 14:47:57 -0500
From:    Henrik Stroem <[e-mail]>
Subject: Re: Scanning below the DOS level (PC)

David Conrad wrote,

> But one major reason for not scanning at the sector level, the most
> important reason IMNSHO, hasn't been mentioned.  Any scanner which did
> this would lose compatibility with future DOS versions, or with other
> environments (OS/2, Windows NT, UN*X DOS boxen) which emulate DOS.  A
> program which opens and reads a file via handles and standard calls will
> be able to do so under DOS 8.21, even if it uses something like HPFS.
> Any program which tries to redo DOS will get hopelessly confused and fail,
> I hope gracefully, at worst it may fail catastrophically.

> Of course, someone might reply that scanners are updated so frequently
> that a new update would follow close on the heels of any major change in
> the DOS filesystem, and a scanner could check the DOS version (but what of
> SETVER?)

There is no need to check for the DOS version. A program working at
sector-level would most likely not work very well with OS/2 and
Windows-NT. Since the low-level support on these platforms are not
sufficient to do "safe" sector reading the same way you do in DOS. A
different program would be needed for running under OS/2 and Windows-NT.

But, talking about future DOS compatibility is something else. The
type of filesystem (FAT/HPFS/NTFS/etc) is described in a one-byte
field in the partition-table (contained in the HD's first sector). And
as long as your program is able to read at sector-level, it should
have no problems finding out what kind of file system it is dealing
with, and use different routines for the different file systems.

To handle the low-levels of HPFS and NTFS may not be as easy as
handling the FAT filesystem. So programs like TBScan might have to
tell the user that only FAT partitions may be scanned in a low-level
manner.

Sincerely,
Henrik Stroem
Stroem System Soft

------------------------------

Date:    Thu, 18 Nov 93 11:34:19 -0500
From:    Fabio Esquivel <[e-mail]>
Subject: Memory lack for cleaning virus (PC)

Hi.  I've got a little problem trying to disinfect Stoned in a PS/2 system.

F-Prot 2.09f identifies the virus as a new variant of Stoned and refuses to
kill the virus.

Clean 108 says there is not enough memory, and that it needs at least 390K
of free RAM to run.  The PS/2 has just 512K of RAM.  The startup files (auto-
exec.bat and config.sys) were renamed to avoid loading of TSRs and device
drivers.

Norton's DiskEdit version 7.0 (the only one I have) DOES NOT RUN on 8086's...

Suggestions to kill this virus?

DATA SEGMENT PARA PUBLIC
     name DB 'Fabio Esquivel'            ;  C:\> dir a:
   bitnet DB '[e-mail]'    ;  Virus found in drive A:
 internet DB '[e-mail]' ;  Install, Kill, Panic?_
DATA ENDS

------------------------------

Date:    Thu, 18 Nov 93 12:11:06 -0500
From:    [e-mail] (Antonio Vieira Melo)
Subject: How to clean Exebug2 ? (HELPME, please, please ) (PC)

Hello ...

By mistake I've switched on my computer with a non system diskette.
The error message stating that it was not a system disk appeared, so I did
take the diskette off and rebooted the computer.
Knowing of the existence of virus that 'live' on diskette's boot, the
first thing I did was:
c:> scan a:
Scan stated that the Exebug2 was in memory (and in my disk off course).

After booting from a DOS 6.0 clean boot diskette I can't access drive C.
If I want the see the partitions on the HD, fdisk is confused.
If I boot from the HD everything seems normal (but I didn't run anything,
but scan, from the HD).

I've read the virlist that come with scan and clean and saw that among
other things the Exebug2 virus afects the HD partition table. They say
that the desinfector for this virus is M-Disk (not clean). I looked for
this with archie and found only a version that the largest DOS that
accepts is DOS 4.0.

Can anyone out there help me ? How can I remove the virus ? If it is with
M-Disk where can I find a version compatible with DOS 6.0 ? If not, what
is the program(s) tha are good for this virus ?

Thak you in advanced
    Antonio |-(

ps:my computer configuration:
- -486 dx 25Mhz, 8Mb RAM
- -Disk C: seagate 240 Mb - only one normal partition - DOS 6.0 - normal
boot -
 no stacker, dbl-spc, etc.
- -Disk D: seagate 80 Mb - 2 partitions - both linux (I boot from a
diskette)

- --
Antonio A. V. Melo      | INESC - Instituto de Engenharia de Sistemas e
Email:                  |         Computadores       (room 613)
   [e-mail]   | Rua Alves Redol, 9   1000 Lisboa -  Portugal

------------------------------

Date:    Fri, 19 Nov 93 17:46:45 -0500
From:    [e-mail] (Piet de Bondt)
Subject: Re: which antivirus program (PC)

In article <[e-mail]>,
Fridrik Skulason <[e-mail]> wrote:
>[e-mail] (Piet de Bondt) writes:
>
>>Could you please give more fund to this statement, as I have never read *anywhere* that
>>McAfee detects about the same as F-Prot.
>
>It feels a bit strange "defending" my competitor, but the fact is that in many
>tests the programs detect about the same number of viruses.
>
>For example in VSUM310 (ignoring for a moment all the horrible technical
>inaccuracies in VSUM), the score is:
>
>   F-PROT 2.09F      95.5%
>   SCAN V108         95.0%

>So, yes...in this particular test, SCAN indeed detects about the same as
>F-PROT.  The other programs were
>
[... list deleted ...]

Well, in spite of all things people are going to say: vsumx is (mostly)
made available *through* McAfee's ftp site. This, and the fact that mcafee
is one of the oldest around, makes me think the tests for the vsumx-scores
are not very thorough.
I'll elaborate on this by means of a test a Dutch magazine (Personal
Computer Magazine) held in November this year.

They tested the software on three areas. They explicitely did not test
the resident parts.
They had a virus-test-bank with 11.383 files, all infected with another virus.
For a large part it was compiled with the help of the VSG (DUtch: virus
strategy group), a dutch collaboration of researchers, government and
companies.
The three categories were: 'normal' viruses (for practical reasons just the
com and .exe infectors), which all were *at least* a year old.
'new' viruses (less than a year old)
Last one: '40 polymorf virus-types', by making about 5.000 different
replicants of them.
CPAV crashed on some viruses, so this one was not included in the 'hit-rate'
The scores:
software                              normal    new   polymorf
Thunderbyte TBAV 6.05                 >99      >99     >99
Sohos Vaccine 4.38 & Sweep 2.53        97.9    >83      88.4
F-Prot Pro 2.09                       >98       85.6    83
McAfee Viruscan-VShield-Cleanup 106    94.1     60.5    92.1
Dr. Solomons anti-virus toolkit 6.54   96.7     61.3    62.9
PC Vaccine Professional 1.21           94.5     40.9   >74
IBM Antivirus 1.03                     92.9     61.5    47.7
Norton Antivirus 2.1                   71.5     20      40
Microsoft Anti-virus                   70       19.8    27

I think that these test give at least one clue (but I'll mention
some other things too) :
***1) avoid Microsoft and Norton
***2) The best combination: use TBAV and F-Prot (as they have very
      good results AND are not that expensive). McAfee and Sophos
      are reasonably reliable, but don't depend on them alone (like
      you should never do !!)
***3) Use (in combination of one of those anti-virus packages) an
      integrity checker. One of the best (as far as I know) is
      Integrity Master, but there should be others around too.
      McAfee, Dr. Solomon and Sophos seem to have rather reliable
      ones.
***4) Always scan *new* (e.g. brought back from a friend) disks
      before just copying files to your hard disk. A resident
      AV can come in handy.
***5) Last but not least (as far as my remarks will go) try to keep
      very up to date, as this can save you a lot of trouble.
      Use (if available for you) ftp-sites for this:
      oak.oakland.edu, garbo.uwasa.fi, nic.funet.fi, complex.is,
      ftp.twi.tudelft.nl, urvax.umich.edu (not sure about the address)
      or some others. Read the FAQ in comp.virus or check this
      newsgroup and you will be kept up-to-date.
      Mail me if you want to be informed about new TBAV releases.

NOTE: I have no affiliation with any of the aforementioned companies.
      I'm just a user of some products and happily trust my TBAV
      resident programs. For me it was (although I knew it was rather
      reliable) a kind of a surprise that TBAV came out 'best'.

NOTE 2: mail me if you want to know more details on this test and I will
        try to answer any questions.

>Fridrik Skulason      Frisk Software International     phone: [phone]
>Author of F-PROT      E-mail: [e-mail]         fax:   [phone]

Piet de Bondt                   E-mail: [e-mail]
===================================================================
FTP-Admin for MSDOS Anti-virus software at:      ftp.twi.tudelft.nl
- --

Piet de Bondt                             E-Mail : [e-mail]
==============================================================================
Interviewer:  Why did Syd Barrett leave the band ?

------------------------------

Date:    Sat, 20 Nov 93 14:23:58 +0000
From:    [e-mail] (b manuel)
Subject: CPAV immunization in .COM/.EXE and copyrigths (PC)

I have read the manual and still can't find anything about
using this immunization in commercial software.
Can I do this or is there any restrictions I am unaware of?
Any help is most appreaciated. Thanks!

------------------------------

Date:    Sat, 20 Nov 93 12:56:56 -0500
From:    [e-mail] (JONAH C WITTKAMPER)
Subject: PS to "Help !! I have virus in my partition table..." (PC)

Please send any responses you might have to [e-mail]
If you didn't read the last message:
I have a virus in my partition table of my COMPAQ 386SL.  Scan has detected
it and I don't believe clean can effectively clean it, because my computer
was showing viral symptons days before scan was finally able to detect it.
Help please.
What should I do.
[e-mail]

------------------------------

Date:    Mon, 15 Nov 93 10:55:09 -0500
From:    [e-mail]
Subject: Call-for-Papers

CALL FOR PAPERS & PANELS - 17TH NATIONAL COMPUTER SECURITY CONFERENCE
           October 11-14, 1994 --- Baltimore, Maryland
    Co-Sponsors: National Institute of Standards & Technology
                 National Computer Security Center

The National Computer Security Conference attendees represent a broad
range of information security interests spanning government, industry,
commercial, and academic communities.  Papers and panel discussions
typically cover:

   - research & development for secure products and systems;
   - implementation and accreditation of secure systems;
   - administration & operation of secure systems;
   - evaluation of products and systems against trust criteria;
   - international harmonization of security criteria & evaluations;
   - promotion of computer security: education, awareness and training;
   - social and legal issues related to computer security.

We invite the submission of papers and proposals for panels in any of
the above areas and on other topics related to the confidentiality,
integrity, and availability of data and resources in information
systems.  Papers will be selected through an anonymous review process
and will be published in the conference proceedings.  Panels will be
selected by the Program Committee, and panel members will be expected to
provide written statements for inclusion in the proceedings.

BY 1 MARCH 1994:  eight (8) copies of your paper or panel proposal
                 should ARRIVE at the following address:

    National Computer Security Conference
    ATTN: NCS Conference Secretary, APS XI
    National Computer Security Center
    Fort George G. Meade,  MD.  20755-6000

By 1 June, 1994:  Authors and panel chairs selected to participate in
the conference will be notified and advised when final papers and panel
statements are due.

PREPARATION OF CONFERENCE SUBMISSIONS:

    Cover sheet:  Type of submission (paper, panel, tutorial)
                  Title or Topic
                  Abstract  (not to exceed 250 words)
                  Author(s)
                  Organizational Affiliation(s)
                  Phone numbers  (voice and fax if available)
                  Internet address if available
                  Point of contact if more than one author

    SUBMISSIONS RELATED TO WORK UNDER U.S. GOVERNMENT SPONSORSHIP
    MUST ALSO INCLUDE THE FOLLOWING:

                  Program Sponsor or Procuring Element
                  Contract Number (if applicable)
                  Government Publication Release Authority

    Paper preparation:  10-page maximum incl. figures & references;
                        title, abstract, & keywords on first page;
                        no more than 12 char./inch & 6 lines/inch;
                        one-inch margins all around.

BECAUSE THE REVIEW PROCESS WILL BE ANONYMOUS, NAMES AND
   AFFILIATIONS OF AUTHORS SHOULD APPEAR ONLY ON THE SEPARATE
   COVER SHEET

CLASSIFIED MATERIAL OR TOPICS SHOULD NOT BE SUBMITTED

RELEASE FOR PUBLICATION & COPYRIGHT:

     It is the responsibility of the authors to obtain government or
corporate releases for publication.  Written releases will be required
for all papers to be published.  Papers developed as part of official
U.S.  government duties may not be subject to copyright.  Papers that
are subject to copyright must be accompanied by written assignment to
the NCS Conference Committee or written authorization for publication
and release at the Committee's discretion.

PANEL PROPOSALS:
    Panels should be geared to a maximum of ninety minutes long,
         including time for prepared remarks and audience interaction.
    2 page maximum.
    Include chair and proposed panelists or organizations to be
         represented on first page.
    Include summary of topic, issues, and/or questions to be
         addressed by the panel and viewpoints that proposed
         panelists would bring to the discussion.

FOR MORE INFORMATION ON SUBMISSIONS, PLEASE CALL 410-850-0272 OR SEND
INTERNET MESSAGES TO:  NCS_Conference at DOCKMASTER.NCSC.MIL.

For other information about the conference, call 301-975-2775.

------------------------------

Date:    Wed, 17 Nov 93 22:57:01 -0500
From:    [e-mail] (McAfee Associates)
Subject: McAfee VIRUSCAN 109 uploaded to the SimTel Software Repository (PC)

I have uploaded to the SimTel Software Repository (available by anonymous
ftp from the primary mirror site OAK.Oakland.Edu and its mirrors):

pub/msdos/virus/
scanv109.zip    VIRUSCAN 9.20V109 virus scanner for PCs, LANs
vshld109.zip    VSHIELD 5.55V109 virus prevention TSR
clean109.zip    CLEAN 9.20V109 virus remover for PCs & LAN's
wscan109.zip    WSCAN V109 Windows front-end for VIRUSCAN
3nsh155.zip     NETSHLD V1.55 virus prevention for Novell 3.x
4nsh155.zip     NETSHLD V1.55 virus prevention for Novell 4.x

WHAT'S NEW

VIRUSCAN adds detection of 114 new viruses and 167 variants,
bringing the total number of viruses detected to 1,769, or
counting variants, 2,632 viruses.

CLEAN-UP adds a remover for the Invisible Man [IMF] virus.

NETSHIELD is now at Version 1.55 (V109) and has been Tested and
Approved compatible by Novell, Inc. for use with Novell NetWare
v3.11, v3.12, SFT-III v3.11, 4.01, and NetWare for OS/2 4.01.

Two files are available, one containing the NetWare v3.x version
of NETSHIELD, and one containing the NetWare v4.x version.

A few notes about using NETSHIELD Version 1.55 for NetWare v3.x:

o       Other antivirus NLM's should not be used simultaneously
        with NETSHIELD

o       The Novell file SPXFIX2.NLM must be loaded when running
        NETSHIELD.  SPXFIX2.NLM fixes a problem that NETSHIELD
        and several other NLM's have in NetWare 3.x with SPX.

o       The latest version of the Novell file CLIB.NLM (Version
        3.11 revision D) must be loaded when running NETSHIELD.
        NETSHIELD will not load correctly if an older version of
        CLIB.NLM is used.*

        *Specifically, a message about "IsColorMonitor" not
         being declared will pop up and NETSHIELD fails to load.

Both files are available directly from Novell, or your Novell
network provider.  They are on CompuServe in the NOVLIBRARY
Forum and may be available elsewhere as well.  We are currently
checking to see if these files may be made available by McAfee
Associates.

And a note about NETSHIELD Version 1.55 for NetWare v4.x:

o       When running NETSHIELD under NetWare 4.x during heavy
        file server utilization, if NETSHIELD's priority option
        is set to a lower value (increasing the priority given
        to NETSHIELD), then some of the low priority threads
        will not be given a chance to execute.  When the
        utilization drops the threads will execute.

And a mcafee.com bandwidth note:

Over the past couple of months, we have had several reports of
slow access and timeouts when connecting to the mcafee.com anonymous
ftp site due to increasing numbers of users logging on at the same
time to download the programs.

As of November 1, we have upgraded from our former switched-56 line
to a full T-1 connection, providing some 20 times the capacity of the
former.

VALIDATE VALUES

FILENAME:                           SIZE:      DATE:        CHECK METHODS 1&2:
CLEAN-UP 9.20V109 (CLEAN.EXE)       S:187,414  D:11-08-93   M1: F0EB  M2: 135E
NETSHIELD 1.55 for 3.x (NETSHLD.NLM)S:135,353  D:11-05-93   M1: 4404  M2: 1DF7
NETSHIELD 1.55 for 4.x (NETSHLD.NLM)S:131,493  D:11-05-93   M1: 6F2F  M2: 03CB
NETSHIELD 1.55 (both) (VIR.DAT)     S:62,992   D:11-15-93   M1: 6A57  M2: 13BB
CLEAN FOR OS/2 V109 (OS2CLEAN.EXE)  S:323,024  D:11-08-93   M1: 9907  M2: 16AE
SCAN for OS/2 V109 (OS2SCAN.EXE)    S:234,688  D:11-08-93   M1: 9D67  M2: 062C
VIRUSCAN 9.20V109 (SCAN.EXE)        S:155,729  D:11-08-93   M1: A702  M2: 071A
VSHIELD 5.55V109 (VSHIELD.EXE)      S:52,317   D:11-02-93   M1: 3714  M2: 1110
SCAN FOR WINDOWS V109 (WINSTALL.EXE)S:19,606   D:11-04-93   M1: AE21  M2: 02EE
SCAN FOR WINDOWS V109 (WSCAN109.EXE)S:76,868   D:11-04-93   M1: 3FC8  M2: 0913

Regards,

Aryeh Goretsky
McAfee Associates' Technical Support
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice [phone] | INTERNET: [e-mail]
2710 Walsh Ave, Suite 200| FAX   [phone] | IP# 192.187.128.1
Santa Clara, California  | BBS   [phone] | CompuServe ID: 76702,1714
95051-0963   USA         | USR HST Courier DS   | America Online: McAfee

------------------------------

Date:    Sat, 13 Nov 93 21:33:21 -0500
From:    "Rob Slade" <[e-mail]>
Subject: Antiviral BBS listing

As with the CONTACTS.LST sent out last week, I would ask that all readers
check this listing for accuracy.

The V.I.R.U.S./Virus Doctor BBS List

A number of those who have access to viral information or antiviral software
only through commercial systems (or long distance calls) have requested
listings of "local" access to antiviral sources.  This list is an attempt to
provide such information.  Additions and corrections are solicited to help make
this a more useful reference source.

For sorting purposes the wide variety of bracket, slash, space and hyphen
placement have been replaced with the European standard "global" area codes.
I have used hyphens instead of blank spaces when separating the "global",
"country" and "city" codes.  Every phone number begins with the global area
code; this code is "1" for USA and Canada.  To prevent misinterpretation, the
global area code is preceded with a "+" sign, and delimited by a hyphen.  The
(national) area code is delimited from the local phone number by another
hyphen.  (Thanks to Otto Stolz for his assistance.)

In order to avoid line wrap on Fidonet mail readers, the "node number" has been
"right justified" at 75 columns.  For those on the Internet, it is possible to
send mail to these systems.  The node number is in the format
<zone>:<net>/<node> and can be converted to an Internet address as
user.name@f<node>.n<net>.z<zone>.fidonet.org, so that Rob Slade may be reached
at The Cage (1:153/733, see "+1-604") as [e-mail].
VirNet sites can be addressed as
Fname.Lname@f<node>.n<net>.z<zone>.virnet.bad.se at the moment.

Information included, where available, is name of system, name of sysop, city,
province/state/country, information carried and Fidonet address.  If a product
is associated, that is included as well.

Key:

AM = Amiga          AT = Atari          MC = Macintosh          PC = MS-DOS
Fidonet:  VIRINF = VIRUS_INFO   VIR = VIRUS   WRN = WARNINGS   VNT = VirNet
Files archived: CVP = Computer Viral Programs column  RVW = Antiviral reviews

Where verification is possible, the "node number" is followed by a "V" and the
initials of the reviewer.


[phone]  The Quill & Inkpot BBS, Garfield NJ           (1:2604/407)
[phone]  Menti's Bay, Dumont NJ  VIR                    (1:107/521)
[phone]  THE DIGITAL ABYSS, Newark NJ  VIR           (1:2605/121.0)
[phone]  E.o.D. Systems  VIRINF                        (1:2606/213)
[phone]  Int'l Computer Security Association (ICSA) BBS       <EOL>
[phone]  Starfleet Technical Support, Columbia CT       (1:320/296)
[phone]  Xanth BBS, Easton CT                           (1:141/465)
[phone]  The Wacko Board, Fairfield CT                  (1:141/415)
[phone]  The Rx BBS, Groton CT  VIRINF                  (1:320/448)
[phone]  Warrior BBS  VIRINF                          (1:142/831.0)
[phone]  Our House  VIRINF                            (1:320/128.0)
[phone]  Southern Nights BBS, Gadsden AL                  (1:373/6)
[phone]  The Intrepid BBS, Mobile AL  VIR            (1:3625/467.0)
[phone]  The CADD Station, Theodore AL                 (1:3625/459)
[phone]  Channel 8250, Birmingham AL  VIRINF                  <EOL>
[phone]  Gulf Coast Net  VIRINF                        (1:3625/443)
[phone]  Deep Space 9  VIRINF                           (1:3602/45)
[phone]  Top Hat BBS  WRN                                (1:343/40)
[phone]  The Dragon's Eye BBS  VIRINF               (1:343/116.116)
[phone]  SeaBIN BBS, Seattle WA  VIRINF                  (1:343/89)
+1-206-581APPLE The right place, Tacoma WA  MAC                (1:138/131)
[phone]  Awakening BBS, Tacoma WA  VIRINF               (1:138/102)
[phone]  The French Connection, Edmonds WA               (1:343/45)
[phone]  The French Connection, Edmonds WA               (1:343/45)
[phone]  Pioneers BBS, Safe Hex Int'l  VIRINF          (1:343/54.0)
[phone]  Michael Arends      P.O. Box 1531 Lynnwood, WA  98046-1531
[phone]  Quicksilver, Bainbridge Is WA  VIRINF          (1:350/201)
[phone]  Camas Chatter Box BBS                          (1:105/123)
[phone]  The Open Window BBS  VIRINF                    (1:105/130)
[phone]  City People BBS, New York NY  VIR              (1:278/720)
[phone]  Stargate BBS, New York NY  VIR                 (1:278/714)
[phone]  Software Concepts Design, Ross Greenburg     Flushot, VIRx
[phone]  Master Control, Dallas TX                     (1:124/5107)
[phone]  Central BBS, TX                                 (8:930/21)
[phone]  Galactic Archives, Carrollton TX              (1:124/8009)
[phone]  User-To-User  VIR  RIME                       (1:124/6300)
[phone]  Mega-Sys OS/2 BBS, Plano TX  VIRINF           (1:124/5119)
[phone]  The WySiWyG BBS  VIRINF                       (1:124/5132)
[phone]  Flash BBS, Richardson TX                      (1:124/7020)
[phone]  The Desktop BBS, Allen TX  VIRINF        (1:124/5133.4501)
[phone]  The Quad C, Collin Cty Comm College, Plano TX (1:124/7016)
[phone]  Stingray BBS  VIRINF                           (273/728.1)
[phone]  Klingon Bird of Prey, Robt J Ferguson  VIRINF  (1:273/935)
[phone]  DSC (Datamax/Satalink Connection)  VIRINF      (1:273/203)
[phone]  Runway BBS, Stiller Research              Integrity Master
[phone]  Runway BBS, Stiller Research              Integrity Master
[phone]  Runway BBS, Stiller Research              Integrity Master
[phone]  The Keep BBS, Lansdale PA  VIRINF              (1:273/731)
[phone]  JCUPCB, John Carroll Univ  VIRINF            (1:157/555.0)
[phone]  The Hard Drive Cafe, Akron OH                  (1:157/619)
[phone]  Akron Info & Party  WRN                        (1:157/617)
[phone]  Certus International                                 <EOL>
[phone]  Analytical Engine BBS  VIRINF                  (1:157/554)
[phone]  Treasure Chest ML-TBBS, South Bend IN  VIR       (1:227/3)
[phone]  VFR S Gordon VIRINF VIR WRN NET INT (9:101/101)(1:227/190)
[phone]  The Combat Zone                                (1:2612/10)
[phone]  National Institute of Standards & Technology (NIST)  <EOL>
[phone]  Thunderbyte USA, Dagsboro DE  VIRINF/VIR       (1:150/520)
[phone]  Southern Cross, Delmar DE VIRINF               (1:150/410)
[phone]  Taurus BBS, Millsboro DE  VIRINF               (1:150/300)
[phone]  Taurus BBS, Millsboro DE                       (1:150/300)
[phone]  The Eighth Dimension                         (1:104/118.0)
[phone]  The Circuit Board Inc, Lafayette CO            (1:104/117)
[phone]  The Vault BBS, Littleton CO                    (1:104/332)
[phone]  Computer Security BBS  VIR                      (1:306/30)
[phone]  Silent Death BBS                                     <EOL>
[phone]  AIS, US Treasury CSB, Kim Clancy [e-mail]
[phone]  Project Enable, the disability resource         (1:279/14)
[phone]  Ramblin' Roots, Miami FL                        (1:135/54)
[phone]  Marquee/2 [e-mail]   DPROT (1:369/83)
[phone]  The Jailhouse, North Miami FL                   (1:135/34)
[phone]  Computer Answers, Prince Albert SK  VIRINF      (1:140/74)
[phone]  Gateway to Balumnia, Prince Albert SK  VIR     (1:140/138)
[phone]  The Data Dump                      HACK Report  (1:140/12)
[phone]  Zeller East, Groveland IL                       (1:232/43)
[phone]  Live Wire III BBS  VIRINF                       (1:232/27)
[phone]  Trend Micro Devices Inc                          PC-cillin
[phone]  Long_Island RB  VIR                            (1:102/138)
[phone]  Ursa Major BBS, Scott Robb  VIR                (1:102/128)
[phone]  The Flying Circus  VIR                         (1:102/438)
[phone]  Helping Hands, Santa Fe Springs CA             (1:102/433)
[phone]  Cal State Long Beach (University BBS)                <EOL>
[phone]  WorkStations Unlimited, Chicago IL  VIRINF     (1:115/404)
[phone]  CDS BBS, Livonia MI                            (1:120/234)
[phone]  The Treasure House BBS  VIRINF                 (1:120/613)
[phone]  Terox BBS, Troy MI                             (1:120/324)
[phone]  Int'l Network Security Association (INSA)      (1:120/336)
[phone]  Atlantis, Oxford MI  VIRINF                    (1:120/336)
[phone]  Planet ><, Columbia MO                           (1:289/5)
[phone]  Cheswick's, St Louis MO                        (1:100/375)
[phone]  The Reef, Syracuse NY                          (1:260/338)
[phone]  PowerLine BBS, Marcy NY  VIRINF                 (1:2609/7)
[phone]th & Main, Winfield KS  VIRINF                 (1:291/21)
[phone]  Garsand Biomedical, Inc.  VIR                   (1:3803/9)
[phone]  Kittens BBS1, Monroe LA  VIR                         <EOL>
[phone]  Middle Earth, Lake Charles LA                   (1:3807/4)
[phone]  Icarus  VIRINF                                 (1:283/657)
[phone]  The Razors Edge, Richmond RI  VIRINF         (1:323/401.0)
[phone]  InterLink, Calgary AB  VIR                      (1:134/93)
[phone]  ECS Net, Calgary AB                             (1:134/72)
[phone]  The Messhall, Calgary AB                        (1:134/73)
[phone]  The Terminal BBS, Lethbridge AB  VIRINF         (1:358/17)
[phone]  Synectics, Edmonton AB  VIRINF                  (1:342/72)
[phone]  Rascal BBS, Calgary AB                         (1:134/122)
[phone]  NMD Maximus, Fort McMurray AB                   (1:3402/6)
[phone]  Arsenal of Freedom-OS/2, Fort McMurray AB      (1:3402/19)
[phone]  The Sailboard, Nobleford AB  VIR                (1:358/25)
[phone]  Engineering Services BBS, Decatur GA           (1:133/405)
[phone]  SpacePort Atlanta                            (1:133/524.0)
[phone]  Shelter From The Storm  VIRINF                 (1:133/115)
[phone]  Atlanta PCUG, Atlanta GA                             <EOL>
[phone]  The Bargain BBS, Lawton OK                    (1:385/17.0)
[phone]  Aloha BBS  VIR                                  (1:147/47)
[phone]  Good News II Carl Wilson [e-mail] Lawton OK
[phone]  Mann's Solutions  VIRINF                    (1:147/1033.0)
[phone]  Toyz BBS, Lawton OK  VIRINF                     (1:385/23)
[phone]  Tech Term BBS, Lawton OK  VIRINF                (1:385/18)
[phone]  J & J BBS, Mangum OK  VIRINF                  (1:385/24.0)
[phone]  PC-Montana BBS,  VIRINF                        (1:3400/26)
[phone]  Challenger BBS  VIRINF VIR                     (1:363/175)
[phone]  The Slipped Disk, Lantana FL                    (1:3638/5)
[phone]  My Cozy Kitchen BBS  VIRINF                    (1:3609/16)
[phone]  The Noble House BBS, Kissimmee FL  VIRINF      (1:3633/36)
[phone]  Patricia M. Hoffman                 Virus Summary Document
[phone]  Ashton-Tate/Borland (refer from 3103242188)          <EOL>
[phone]  Symantec/Norton           Norton AntiVirus/Norton Utilites
[phone]  Symantec BBS                                         <EOL>
[phone]  HomeBase BBS, McAfee Assoc                  VIRUSCAN Suite
[phone]  The Parole Board, College Station TX           (1:117/369)
[phone]  SyncPoint, Baltimore MD  VIRINF               (1:261/1008)
[phone]  The Rainbow Zen, Fallston MD  VIR             (1:261/1111)
[phone]  The North Star BBS  VIR                       (1:261/1108)
[phone]  Pittsburgh Computer Virus Specialists BBS            <EOL>
[phone]  Magic Board BBS, McKeesport PA                 (1:129/165)
[phone]  Mabel's Mansion, Sharon PA                    (1:2601/100)
[phone]  The Phantom Tollbooth, Cedarburg WI            (1:154/410)
[phone]  The PC GFX Exchange  WRN                     (1:125/217.0)
[phone]  Ship to Shore, SF Bay West CA  VIRINF          (1:204/7.0)
[phone]  SeaHunt BBS, San Francisco CA                   (1:125/20)
[phone]  International Microcomputer (IMSI)          VirusCure Plus
[phone]  Crystal Palace, San Francisco CA    (9:101/107) (1:125/53)
[phone]  Foley Hi-Tech Systems                          Safety Disk
[phone]  Coconino County, San Francisco CA               (1:125/28)
[phone]  SMARTalec, Etobicoke ON                        (1:250/834)
[phone]  Access-PC BBS, Scarborough ON  VIR             (1:250/320)
[phone]  Ali Salari [e-mail]        (1:250/508)
[phone]  OmegaStardock (2330-0630EDT)  VIRINF           (1:250/508)
[phone]  Command Software Systems              F-PROT Professional
[phone]  The Barn Stormers, Oshawa ON  VIR AM           (1:229/114)
[phone]  Motor City BBS, Oshawa ON                      (1:229/430)
[phone]  Canada Remote Systems, Toronto ON                    <EOL>
[phone]  Canada Remote Systems, Toronto ON                    <EOL>
[phone]  Data Warehouse, Stoney Creek ON  VIRINF        (1:244/133)
[phone]  CompuNet, Peter Avgerinos                      (1:250/407)
[phone]  CompuNet, Peter Avgerinos                      (1:250/407)
[phone]  Forbidden Knights Systems  VIRINF              (1:259/423)
[phone]  Age Of The Dark Renaissance  VIRINF            (1:259/210)
[phone]  The Sound Blaster Digest Support, Brampton ON  (1:259/210)
[phone]  Sheridan College, Oakville ON                  (1:259/303)
[phone]  Life's a Beer, Toronto ON  VIRINF              (1:250/410)
[phone]  InfoTech Online SuperBBS  VIRINF               (1:247/124)
[phone]  Inside Ok! BBS, Joplin MO  VIRINF              (1:286/702)
[phone]  PC Virus Research Foundation BBS                     <EOL> ???
[phone]  A Toad's Haven BBS, Jax AR                      (1:3821/5)
[phone]  TopSoft Support                                 (1:2320/4)
[phone]  TopSoft Support                                 (1:2320/4)
[phone]  International Computer Virus Institute Eliminator    <EOL>
[phone]  ATC, Aloha OR  VIRINF                          (1:105/343)
[phone]  NWCS Online  VIRINF                            (1:105/362)
[phone]  White Dragon BBS, Dallas OR  VIRINF            (1:105/630)
[phone]  Information Anxiety, Lake Oswego OR            (1:105/208)
[phone]  Intel Corporation                               LANProtect
[phone]  Axe Tax 'N More, Gresham OR  VIRINF            (1:105/450)
[phone]  Sydex BBS, Eugene OR                    Prune Disk Utility
[phone]  Eastside Data Services #2, Portland OR          (1:105/61)
[phone]  WSTPC BBS, Nolan Lee                             (1:390/5)
[phone]  Selective On-Line, Santa Fe NM  VIR              (1:15/11)
[phone]  Driftnet, Wallace Hale, Woodstock NB               SIX(TH)
[phone]  Programmer's Corner, Saint John NB             (1:255/6.0)
[phone]  Red Dwarf BBS, Moncton NB  VIRINF              (1:255/202)
[phone]  Computer Confident!, Franklin MA               (1:322/594)
[phone]  MSI S/W BBS, Framingham MA                     (1:322/327)
[phone]  LBD Consultants, Oxford MA  VIRINF             (1:322/507)
[phone]  Felicia BBS, Bill Orvis ([e-mail])  RVW        <EOL>
[phone]  Felicia BBS, Bill Orvis ([e-mail])  RVW        <EOL>
[phone]  Computer Communications, Concord CA           (1:161/3216)
[phone]  Far Point Station                          HACK (1:382/77)
[phone]  Flotom Enterprises                         HACK (1:382/91)
[phone]  The Rendezvous, Bastrop TX  VIRINF              (1:382/92)
[phone]  NRFPT BBS, Victoria TX  VIR                 (1:3802/221.0)
[phone]  JimNet, Austin TX  VIR                          (1:382/29)
[phone]  Simple Solutions, Montreal PQ                  (1:167/224)
[phone]  Juxtaposition, Lasalle PQ                      (1:167/133)
[phone]  Avant 386, Lasalle PQ                        (1:167/190.1)
[phone]  XON/XOFF Information System, Montreal PQ       (1:167/159)
[phone]  Radio-Amateur BBS, Montreal, PQ                (1:167/134)
[phone]  SSSFFF, Montreal PQ                            (1:167/166)
[phone]  ABS International (Canada), Montreal PQ        (1:167/136)
[phone]  Wizzard's Cave, Jon Freivald  INT                    <EOL>
[phone]  The Rec Room, Lansing MI                       (1:159/350)
[phone]  LCC CAI BBS, Lansing MI  VIR                   (1:159/575)
[phone]  Spark-5, Guelph ON  VIRINF                     (1:221/321)
[phone]  Dead End, Windsor ON                            (1:246/17)
[phone]  Windsor Download BBS  VIR                       (1:246/15)
[phone]  MidNite ChowBoy, Greenwood MS  VIRINF            (1:368/1)
[phone]  Solitude BBS, Tucson AZ  PC INT       PC-Sentry (1:300/23)
[phone]  SouthWest Data, Tucson AZ                       (1:300/21)
[phone]  Artemis Lair, Phoenix AZ                       (1:114/116)
[phone]  Warzone, Avondale AZ  VIRINF                   (1:114/150)
[phone]  RG Software Systems       Diskwatcher/ViSpy/Virus Bulletin
[phone]  Leo Technology/NETIS  PC VIRINF VIR INT        (1:132/189)
[phone]  Leo Technology/NETIS  PC VIRINF VIR INT        (1:132/189)
[phone]  The Hobby Center, Plymouth NH  PC VIRINF VIR   (1:132/180)
[phone]  TheCage  PC VIRINF VIR WRN VNT NET INT CVP RVW (1:153/733) Vrms
[phone]  The BandMaster, Vancouver BC  VIRINF           (1:153/715)
[phone]  The RedPoint BBS, Vancouver BC  VIR           (1:153/7060)
[phone]  Peace & Silence!, Vancouver BC                 (1:153/737)
[phone]  Peace & Silence!, Vancouver BC                 (1:153/717)
[phone]  Pasin MainFrame #3, Vancouver BC  VIRINF       (1:153/717)
[phone]  The Rumour Mill, Robson BC  VIR                (1:353/450)
[phone]  DaTaCoRp, Kamloops BC                          (1:353/730)
[phone]  The Wild Wild West  VIRINF                      (1:340/62)
[phone]  The Mohave Desert  VIRINF                       (1:340/60)
[phone]  RAVE                                             (defunct)
[phone]  CyberStore, Vancouver BC  $ AM AT MC PC  Virus Doctor feed Vrms
[phone]  Bear Garden, Langley BC                        (1:153/920)
[phone]  Lambda Speaks, Vancouver BC  WRN               (1:153/756)
[phone]  The Annex BBS, Nanaimo BC  VIR                 (1:351/401)
[phone]  The Excaliber BBS, Nanaimo BC  VIRINF          (1:351/287)
[phone]  The Voyager New Space To Explore, McCook Lk SD   (1:288/2)
[phone]  Metaverse BBS, Bill Lambdin   VIRINF                   LAT
[phone]  Memory Alpha, BAKA Computers Inc, Mark Anbinder      <EOL>
[phone]  NiteWing                              (8:72/5) (1:260/410)
[phone]  Ground Zero, Conklin NY                        (1:260/490)
[phone]  The Satellite of Love  VIRINF                  (1:260/485)
[phone]  The Pigeon Coop, Manahawkin NJ  VIRINF          (1:266/63)
[phone]  .\lternate Reality  VIRINF                      (1:266/37)
[phone]  The Enterprise Board, Fridley MN                (1:282/60)
[phone]  The Enterprise Board, Fridley MN                (1:282/60)
[phone]  HomeTown BBS, Eagan MN                        (1:282/3002)
[phone]  C.R.I.M.E. (Chez Rob's International Mail Exchange)  <EOL>
[phone]  Lion's Den, Trenton ON  VIR                    (1:249/303)
[phone]  Bull's Eye, Trenton ON  VIRINF                 (1:249/302)
[phone]  The Street, Ottawa ON                           (1:243/20)
[phone]  Sarcastic Cow, Gloucester ON                   (1:163/273)
[phone]  Challenged-I For the Abled, Kingston ON        (1:249/138)
[phone]  Midnite Mania, Ottawa ON  VIRINF               (1:163/313)
[phone]  Misty Mountain BBS                   HACK Report (1:241/7)
[phone]  War on Virus Canada BBS                              <EOL>
[phone]  Steve Tibbett                             VirusX for Amiga
[phone]  Inescapable Death, Ottawa ON  VIRINF           (1:163/449)
[phone]  Dundas Dynamo, Laurie Summers/Paul Hutchinson  (1:163/284)
[phone]  DM BBS, Ottawa ON  VIRINF                      (1:163/542)
[phone]  DM BBS, Ottawa ON  VIRINF                      (1:163/542)
[phone]  Tumbler's Tavern  VIRINF WRN                   (1:163/315)
[phone]  Rez-Tek Online  VIR                            (1:163/517)
[phone]  ISSC BBS, Ottawa ON                            (1:163/152)
[phone]  Utilities Exchange                              (1:226/60)
[phone]  Hippie Commune, Baxter TN                       (1:3637/2)
[phone]  White Lightning, Madisonville TN    Thunderbyte (1:3643/1)
[phone]  Cumberland, Cookeville TN                       (1:3637/1)
[phone]  The Beta BBS, Newton MA  VIR                   (1:101/346)
[phone]  Alien Biker Kat  VIRINF                       (1:202/1120)
[phone]  The Raging Main (replaces Programmer's Connection)   <EOL>
[phone]  The Programmers WorkShop, San Diego CA         (1:202/204) Ctg
[phone]  Programmer's Paradise  VIRUS-L                       <EOL> Ctg
[phone]  CNSP/CNAP PCB (U.S. Navy BBS)                        <EOL>
[phone]  Lion Share(ware) BBS  VIRINF                  (1:202/1316)
[phone]  Foys' Trading Post, Santee CA  VIRINF         (1:202/1301)
[phone]  D.J.M.BBS  VIRINF                              (1:202/104)
[phone]  A-1 EZ OK  MC                                  (1:202/234)
[phone]  The Back Door, Victorville CA  VIRINF         (1:202/1110)
[phone]  Dark Tower, Las Vegas NV                       (1:209/220)
[phone]  Act One BBS, Las Vegas NV                      (1:209/237)
[phone]  Rise of the Dragon  VIRINF                     (1:209/233)
[phone]  OS/2@Manassas, Manassas VA                     (1:265/101)
[phone]  The Fido Exchange, Vienna VA                   (1:109/353)
[phone]  The Fido Exchange                              (1:109/353)
[phone]-B Hartland Road, Falls Church, VA   22043       <EOL>
[phone]  Norman Defense Data Systems Inc.  V-Base             <EOL>
[phone]  End of the Line, Duane Brown  VIRINF NET        (1:274/16)
[phone]  Little Larry's Place, Springfield VA             (1:109/3)
[phone]  BXR Info Corner, Falls Church VA               (1:109/158)
[phone]  BXR Info Corner, Baileys Xroads VA  VIRINF   (1:109/158.0)
[phone]  Sentry Net, DStevens, Centreville VA VIRINF VIR(1:109/229)
[phone]  Burleigh's BBS, Spotsylvania VA                  (1:274/6)
[phone]  The XT Connection, Richlands VA  VIRINF       (1:3622/801)
[phone]  Carolina Forum  PC AM MC                         (8:926/2)
[phone]  Shockwave BBS, Midland ON                      (1:252/404)
[phone]  Hill Side BBS                                   (1:3613/1)
[phone]  Under The Nile, Cairo Rsrch, S Burkett, Col. GA(1:3613/12)
[phone]  The Public's Domain  VIR                        (1:360/14)
[phone]  The Power Station  VIRINF                      (1:161/123)
[phone]  Lambda Zone  VIRINF                            (1:115/827)
[phone]  FamilyNet International Echogate               (1:115/887)
[phone]  Space Odyssey, Mount Pearl NF  VIRINF          (1:255/202)
[phone]  Bulldozers BBS  VIRINF                         (1:106/242)
[phone]  Uncle Wally's Place, Houston TX  VIRINF       (1:106/1136)
[phone]  Texas Fathers for EQUAL Rights!  VIR          (1:106/1555)
[phone]  Jagged Edge, Stafford TX                    (1:106/9730.0)
[phone]  The Breeze Rbbs, Bellaire TX                 (8:930/501.0)
[phone]  The Anti-Virus BBS, Houston TX                       <EOL>
[phone]  COMM Port One, Sugar Land TX                  (1:106/2000)
[phone]  Colossus Galactica, Brea CA  VIR               (1:103/307)
[phone]  The Diamond Bar, Ontario CA                    (1:207/101) Ctg
[phone]  The Black Cat Information Service  VIRINF     (1:2613/475)
[phone]  Exit 47/LeRoy BBS, LeRoy NY  WRN  (1:260/220) (1:2613/810)
[phone]  L & T's Spitfire BBS                           (1:270/713)
[phone]  Brinkman's Hollow, Hamlin PA                   (1:268/324)
[phone]  The Dorsai Diplomatic Mission, Brooklyn NY     (1:278/706)
[phone]  Shadowdale Telegard Alpha #2  VIR            (1:278/624.0)
[phone]  Carolina Connections, Sumter SC  VIRINF       (1:3647/1.0)
[phone]  Broad River Emporium  VIR                       (1:3650/3)
[phone]  The Dark Corner, Spartanburg SC  VIRINF       (1:3639/203)
[phone]  The Dark Corner BBS, Spartanburg SC  VIRINF     (1:3652/3)
[phone]  The Apex  VIRINF                                (1:275/99)
[phone]  The File Allocation Table in VA                 (1:275/16)
[phone]  Greater Richmond Connection, Richmond VA  VIR  (1:264/177)
[phone]  Turn and Burn BBS, Hampton VA                  (1:271/275)
[phone]  Chthonic  VIRINF                              (1:206/2601)
[phone]  XTree Co. BBS                                     ViruSafe
[phone]  The Town Crier, Amarillo TX  VIRINF           (1:3816/126)
[phone]  The Joyous Occasion BBS                       (85:818/106)
[phone]  Ranger BBS, Bayamon PR                          (1:367/23)
[phone]  Bits of Blue, Tampa FL  VIRINF                  (1:377/32)
[phone]  The Godfather BBS, Tampa FL  VIRINF             (1:377/54)
[phone]  Programmer's Realm II  VIRINF                 (1:3603/280)
[phone]  *SPPE* Origin-o:just Italian Seasoning        (1:3603/326)
[phone]  SHI USA East, Port Richey FL Jim Maciorowski    (defunct?)
[phone]  Studio PC BBS  VIR                              (1:3619/1)
[phone]  T.A.B.B., Tampa FL                               (1:377/6)
[phone]  Does Your Mother Know, Tampa FL                 (1:377/37)
[phone]  NIU Connection  VIR                            (1:11/70.0)
[phone]  Solo-Quest  VIR                                (1:280/315)
[phone]  Maple Woods, Kansas City MO                      (1:280/7)
[phone]  Gryphon, Harrisonville MO                       (1:280/69)
[phone]  CyberVille, Benbrook TX  VIR                    (1:130/78)
[phone]  Spare Parts  VIR                                (1:130/38)
[phone]  Nemesis  VIR                                    (1:130/61)
[phone]  Fire Point, BOCA  VIR                           (1:3805/4)
[phone]  House Of Golem, Killeen TX 76543                (1:395/21)
[phone]  WFPD BBS  VIR                                   (1:3805/6)
[phone]  WFPD BBS  VIR                                   (1:3805/6)
[phone]  Wizard BBS, Killeen TX                           (1:395/8)
[phone]  Maximum Overdrive, Wichita Falls TX             (1:3805/8)
[phone]  Rambo-Scan WWIV (Public BBS)                         <EOL>
[phone]  Inter-BBS, Pasadena CA  VIRINF             (1:102/741.200)
[phone]  The Sweet Life PCBoard, Canoga Park CA         (1:102/815)
[phone]  Los Angeles Valley College  VIRINF             (1:102/837)
[phone]  Multi Vision, Aylmer PQ                        (1:163/304)
[phone]  the Max!, Halifax NS                           (1:255/107)
[phone]  the Max!, Halifax NS  VIRINF                   (1:255/107)
[phone]  The Pyramid  VIRINF                            (1:3601/31)
[phone]  Transcom II BBS, Gainesville FL                (1:3601/32)
[phone]  Wingit, Tallahassee FL                               <EOL>
[phone]  Connection, Shalimar FL  VIRINF                 (1:366/17)
[phone]  digital underground, eglin afb, fl  VIRINF      (1:366/43)
[phone]  Nuclear Wastelands  VIR                       (1:3612/601)
[phone]  Bytes-r-Us, Ishpeming Mi  VIRINF                (1:2280/1)
[phone]  T.C.'s Byte Bank System, North Pole AK           (1:355/2)
[phone]  Brunswick Mart BBS, Edison NJ                        <EOL>
[phone]  ACGNJ Main, Fanwood NJ  VIRINF                (1:2605/704)
[phone]  ACGNJ Main, Fanwood NJ  VIRINF                (1:2605/704)
[phone]  Synthesis BBS, Central NJ  VIR                 (1:107/639)
[phone]  Expressway BBS, Edison NJ         (1:107/3001) (1:107/387)
[phone]  The Maven's Roost, Kendall Park NJ  VIR        (1:107/390)
[phone]  Business Connection                            (1:3645/10)
[phone]  La Villa Strangiato  VIR                       (1:3611/18)
[phone]  Mother's Kitchen, Centerville GA               (1:3611/19)
[phone]  Foundation BBS, Overland Park KS               (1:280/335)
[phone]  Wincomp Opus                                  (1:272/29.0)
[phone]  SENY Echomail HUB, Spring Valley NY              (1:272/1)
[phone]  The MailMan, NY                                 (1:272/34)
[phone]  Bear Heaven, Walter & Debbie Bodin  VIR         (1:272/53)
[phone]  Implosion BBS, Millwood NY                      (1:272/54)
[phone]  The Link BBS  VIRINF                            (1:272/46)
[phone]  DataShack BBS, Eastchester NY                   (1:272/55)
[phone]  The OtherWhen BBS, Sacremento CA  VIRINF     (1:203/601.0)
[phone]  KSBE Digital Radio Datamaze  VIRINF          (1:203/100.0)
[phone]  Silverado Express, N Highlands CA  VIRINF     (1:203/1102)
[phone]  Alpha & Omega                                   (1:203/56)
[phone]  Dynasoft TimeGates  VIRINF MC                  (1:203/955)
[phone]  The Genesis Satellite System                   (1:203/965)
[phone]  Morning Star BBS, Tulsa OK  VIRINF             (1:170/307)
[phone]  Wayne's World BBS, Tulsa OK                    (1:170/204)
[phone]  The Tower of London BBS                        (1:170/213)
[phone]  The Void BBS, Greenville NC                   (1:3629/415)
[phone]  Datawatch (frmrly Microcom)        Virex-PC/Virex-Mac/VIRx
[phone]  Software Cache, Goldsboro NC  VIRINF           (1:151/811)
[phone]  Golden City Opus, Johannesburg RSA              (5:7101/1)
[phone]  Rand Datasystems Technology  VIR             (5:7101/38.0)
[phone]  Bombed Out, Klerksdorp RSA                      (5:7105/6)
[phone]  NetLine-2, Randburg RSA                        (5:7101/19)
[phone]  Netline Northcliff  VIR                      (5:7101/24.0)
[phone]  Fast! BBS, Sandton RSA                         (5:7101/47)
[phone]  Layout de Marillac, Johannesburg  VIR VIRINF   (5:7101/40)
[phone]  The Graphics BBS  VIR                          (5:7101/56)
[phone]  DePtHs Of InSaNiTy, Alberton RSA  VIR          (5:7101/54)
[phone]  Novell User Group, Pretoria RSA                (5:7101/22)
[phone]  Top Byte, Verwoerdburg RSA                     (5:7101/37)
[phone]   Netline KSD, Henley-On-Klip                     (5:7101/6)
[phone]    Goldfields, Welkom                              (5:7105/1)
[phone]    Bombed Out, Klerksdorp RSA                      (5:7105/6)
[phone]   Information Security, Cape Town RSA           (5:7102/110)
[phone]   Oliver Steudler  PC VIR VIRINF RVW CVP               <EOL>
[phone]   Magnum BBS, Cape Town RSA                     (5:7102/111)
[phone]  Chaos Manor                              HACK (5:7102/713)
[phone]  Softel Monster BBS, Natal                     (5:7103/1.0)
[phone]   The Catalyst, Sajid Rahim, Port Elizabeth RSA (5:7105/4.5)
[phone]   The Catalyst BBS 1, Port Elizabeth              (5:7104/1)
[phone]   The Catalyst  INT (catpe.alt.za)              (5:7105/4.5)
[phone]   Gambler BBS, Athens Greece  VIR                (2:410/109)
[phone]   Noise Forest System  VIR                     (2:410/107.1)
[phone]   Onned BBS, Athens Greece  VIR                  (2:410/110)
[phone]   Master Mailing System, Pireaus Greece  VIR   (2:410/123.0)
[phone]   Metal Mutant BBS Pefki, Athens Greece VIR      (2:410/114)
[phone]   SHI GREECE, Konstantinos Angelis, Box 50784,  Thessaloniki
[phone]   The East Way, Xanthi, Greece                   (2:410/8.3)
[phone]  [MPwrHQ] 1st European #Cc.MisTeam  VIRINF   (2:512/1007.2)
[phone]  Sae[Dv]Remote, E Cleton, Rotterdam  PC VIR VNT       <EOL>
[phone]  Maasstad BBS  VNT                              (9:310/300)
[phone]   RedBox!  VIRNET                     (9:310/15) (2:281/618)
[phone]  The Fly BBS, Nederland  VIRINF                 (2:285/213)
[phone]  Albert Louw, Holland  VNT            (9:310/1) (2:285/521)
[phone]  BULLET  VNT                                    (9:314/206)
[phone]  PCN, Amsterdam NL                              (2:280/415)
[phone]  Dirk-Jan's BBS, Bussum NL                      (2:500/289)
[phone]   HCC Kennemerland, Haarlem NL                    (2:500/45)
[phone]   Bamestra RBBS, Beemster NL                      (2:512/10)
[phone]   FLASH BBS, Utrecht NL  VIR                      (2:512/43)
[phone]  Virus Rescue BBS, Lelystad NL                  (2:282/401)
[phone]  Bitbull BBS, Nieuwegein NL                     (2:512/153)
[phone]  BBS IJsselstein  VIRINF                        (2:512/142)
[phone]   HCC Olivetti GG Heerlen, Brunssum              (2:500/120)
[phone]  Googol Board  VNT                                (9:313/0)
[phone]  Def Board Multi Line Palace Best NL            (2:284/202)
[phone]   KIM Gebruikersclub Nederland (KGN) - /328506    (2:512/32)
[phone]   UtilSoft BBS  VIRINF                           (2:283/326)
[phone]   KIM Gebruikersclub Nederland (KGN) - /303902    (2:512/32)
[phone]   Big Hole, Enschede NL                          (2:283/303)
[phone]   Big Hole, Enschede NL                          (2:283/303)
[phone]   Discovery BBS, Apeldoorn NL                    (2:500/249)
[phone]   Coosjer-BBS, Leeuwarden NL                      (9:314/13)
[phone]   The Experience, Leeuwarden NL  VIR             (2:282/360)
[phone]   Odin Never On Line, Blijham NL  VIRINF        (2:512/58.3)
[phone]  Support BBS for                    PC Vaccine Professional
[phone]  Infodesk, F Hagelaars, The Hague NL  VIRINF VIR  (2:512/2)
[phone]  Infodesk, Frans Hagelaars, The Hague NL      (2:2801/1007)
[phone]   The Gauntlet                                    (2:512/37)
[phone]   De Werkplaats, Venlo NL                        (2:500/255)
[phone]   Da Vinci, Dordrecht NL                         (2:285/308)
[phone]  BBS Bennekom  VIR                            (2:283/203.0)
[phone]   Thunderbyte Help, Arnhem NL                    (2:280/200)
[phone]   Luc Shoofs, Belgium  VNT            (9:321/101) (2:296/10)
[phone]   Info-Center BBS  VIR                           (2:292/401)
[phone]   Lions & Pittaway, Belgium  VIRINF              (2:292/405)
[phone]   Lions & Pittaway, Belgium  VIRINF (gone 930601)(2:292/405)
[phone]   The Cormoran BBS, Hever                        (2:292/500)
[phone]   RTV-SAT BBS, Belgium                       (2:291/709.108)
[phone]   FBH System  VIR                               (2:293/2601)
[phone]   The NoNamE BbS Chatelineau Belgique  VIRINF (2:293/2003.1)
[phone]  Logidata International S.A. France              TBAV agent
[phone]  Li'LL BBS, Paris FR  VIR                         (2:320/7)
[phone]    E Vandermeersch, France  VNT         (9:331/101) (2:322/2)
[phone]   CAD Connection, Montesson FR                   (2:320/203)
[phone]   A.C.M.E. BBS, Belfort FR  VIR                    (2:325/1)
[phone]   Alfredo Sanchez, Spain  VNT        (9:341/101) (2:345/801)
[phone]  Justin Solvsten, Portugal  VNT      (9:3511/101) (2:362/3)
[phone]  Kaos BBS, Lisbon, Portugal                      (2:362/21)
[phone]  Inforlandia, Aveiro                              (2:361/4)
[phone]  Stephen Kearon, Ireland  VNT      (9:3531/101) (2:263/167)
[phone]   TOPPSI, Dublin Ireland                       (2:263/151.0)
[phone]   TOPPSI, Dublin Ireland                       (2:263/151.0)
[phone]   Reflex AV-BBS  VIR                  (9:3532/0) (2:263/401)
[phone]    Vision Bulletin Board System  VIR               (2:391/20)
[phone]  IntroPoli, Finland                           (2:220/91.59)
[phone]   SL, Helsinki Finland                           (2:220/456)
[phone]   K Ylhavuori, Helsinki Finland VNT (9:3581/104) (2:220/456)
[phone]   Hristo Mitov, Bulgaria  VNT       (9:3591/101) (2:359/108)
[phone]   Lab of Computer Virology, A Sharlandjiev, Bulg.(2:359/110)
[phone]  Navigator Gate, Varna Bulgaria  VIRINF          (2:359/10)
[phone]   VirNET, Janos Kiss, Budapest                     (2:371/9)
[phone]    LifeForce (18-06h), Hungary  VIRINF            (9:361/103)
[phone]   Erno Petro, Hungary  VNT             (9:361/101) (2:370/1)
[phone]   Erno Petro, Hungary  VNT VIRINF      (9:361/101) (2:370/1)
[phone]  Fido, Trieste                                  (2:333/603)
[phone]   The Axis, Verona                               (2:333/103)
[phone]  Rodolfo Vardelli, Italy  VNT       (9:391/101) (2:331/206)
[phone]   Power of KnowLedge, G Finocchiaro [e-mail]   <EOL>
[phone]  Virus Help HQ, Civitavecchia                     (2:335/5)
[phone]  The World BBS, Napoli Italy                      (2:335/4)
[phone]  Gold BBS, Napoli Italy  VNT        (9:395/108) (2:335/220)
[phone]   Catania Uno, Catania                           (2:335/503)
[phone]   R Schmidiger, Switzerland  VNT     (9:412/101) (2:300/801)
[phone]  YaCaN-BBS  VNT                                 (9:412/410)
[phone]    CSFR, Pavel Mrnustik  VNT           (9:421/101) (2:241/24)
[phone]   F De Cassan, Austria  VNT           (9:432/102) (2:313/14)
[phone] Watchdog's BBS, Sooss A                        (2:313/100)
[phone]  Faint Breeze, Birmingham UK                    (2:253/164)
[phone]  Black Cat BBS  VIR                              (2:251/27)
[phone]  Blue Label BBS, Aberdeen UK                     (2:259/22)
[phone]    Glasterlaw BBS, Arbroath UK                     (2:259/24)
[phone]  Peter Duffield AM/MC/PC CVP/RVW CVC VIRUS-L    (2:250/201) Vrms
[phone]  N.Wales [e-mail] VNT (9:441/110) (2:250/201) Vrms
[phone]  Blue Label BBS  VIR                           (2:259/22.0)
[phone]  Spartacus, Brighton                             (2:441/27)
[phone]  Six & Five 8's                                (2:441/86.0)
[phone]  Six & Five 8's                                (2:441/86.0)
[phone]  Random Access, Barnoldswick UK  VIR             (2:256/38)
[phone]  Airtel Remote Access  VIR                     (2:440/64.0)
[phone]  NCSA, B Sterrett, Exeter UK  VNT    (9:441/101) (2:255/34)
[phone]  Alba Maximus, Glasgow/Barrhead                   (2:259/2)
[phone]  S&S International         Dr. Solomon's Anti-Virus Toolkit ???
[phone]  Wally's BBS, Livingston Scotland                (2:259/27)
[phone]  Formal Dress Not Essential  VIR                (2:253/161)
[phone]  The Pegasus Connection, Kettering  VIR          (2:258/28)
[phone]  Index III, Nottingham UK  VIR                (2:250/413.0)
[phone]  Index III, Nottingham UK  VIR                (2:250/413.0)
[phone]  Seven Seas, Stockport  VIR                     (2:253/410)
[phone]  DOA/UK's Number 1 AntiVirus BBS, Manchester    (2:250/110) ???
[phone]  The Cavern BBS, Manchester UK  VIR           (2:250/102.0)
[phone]   Byteseyes BBS, Skelmersdale UK                 (2:440/507)
[phone]  GABBS, Gosport                                  (2:251/16)
[phone]  Teenage Retreat, Littleborough                  (2:258/16)
[phone]  Golly!, Twyford                                 (2:252/21)
[phone]  Infotel, Redhill UK                            (2:252/206)
[phone]   Guru-Ten BBS, Perth UK                           (2:259/6)
[phone]  Intel Corporation                               LANProtect
[phone]  Pyrotechnix BBS  VIR                          (2:440/38.0)
[phone]  Test Drive BBS                                  (2:254/40)
[phone]  The Crystal Tower, Enfield UK                   (2:440/25)
[phone]  Tornado BBS, London UK                         (2:440/114)
[phone]  Amiga World BBS, Kent UK  VIR                  (2:440/115)
[phone]   Raytech BBS  VIR                                (2:259/49)
[phone]  FreeMatrix BBS  VIR                             (2:254/39)
[phone]  Cat Flap BBS, Wellingborough                    (2:258/27)
[phone]    AMC International & RA Support, Copenhagen DK   (2:231/50)
[phone]   Dan.Crypt.Cen.Roskilde Kjell Olsen(9:451/170)(2:234/79.15)
[phone]   Frog BBS, Lyngby                               (2:230/151)
[phone]   Horreby SuperBBS  VNT              (9:451/169) (2:230/512)
[phone]    Thomas Schmidt, Denmark  VNT        (9:451/101) (2:230/74)
[phone]    Virus Help Ctr #1, M Larsson  VNT   (9:461/101)(2:205/204)
[phone]    Virus Help Ctr #2 [e-mail] (9:461/101)(2:205/234)
[phone]   NewAge BBS, Jnkping Sweden  VNT      (9:9/1) (2:204/503)
[phone]   Buller BBS, Bastad                             (2:200/221)
[phone]   NKAB Sweden                                     TBAV agent
[phone]   NKAB Sweden                                     TBAV agent
[phone]   NKAB Sweden                                     TBAV agent
[phone]   NKAB Sweden                                     TBAV agent
[phone]  LusseBurken Stckhlm (9:462/111 or 136 2:201/269 2:201/262)
[phone]                              Dr Solomon's Anti-Virus Toolkit
[phone]   Tel [phone] Fax [phone]            (2:201/370)
[phone]   [e-mail] 100135,[e-mail]   (2:201/370)
[phone]   PO Box 596 S-175 26 Jarfalla Sweden            (2:201/370)
[phone]   Micke Larsson, QA Informatik AB                (2:201/370)
[phone]   Lost Toy BBS  VIR                            (2:201/236.4)
[phone]   Back To Business Base BBS  VNT                 (9:466/200)
[phone]   Artic BBS CSC #1, Skelleftea                   (2:205/422)
[phone]   Akme BBS, Warszawa [Warsaw Poland]              (2:480/21)
[phone]  Justin Mann, Germany  VNT        (9:491/1000) (2:241/5601)
[phone]  Duisburg Germany Shuttle  VNT    (9:493/1190) (2:2401/111)
[phone]  Local Service, Duesseldorf  VIR               (2:241/4158)
[phone]  B.L.M., Wermelskirchen                         (2:2402/61)
[phone]  Gayline, Cologne Germany  VNT    (9:491/4090) (2:2402/109)
[phone]  WayForward, Tobias Burchhardt  VNT (9:492/6050) (2:245/39)
[phone]  Stones, Herdecke                              (2:245/5804)
[phone]  WildCat Hagen  VNT                    (9:495/0) (2:248/25)
[phone]  WildCat Hagen  VNT                   (9:495/0) (2:248/210)
[phone]  Kalkar BBS, Kalkar                            (2:2401/209)
[phone] Urmel's Eis, Bad Lippspringe                    (2:242/55)
[phone]  Download Paradise  VNT            (9:491/6000) (2:240/500)
[phone]   Mail Storage, Hillerse Germany VNT (9:491/6030)(2:240/520)
[phone] News-box, Schwetzingen  VNT                   (9:492/3560)
[phone]   The Database Warehouse, Kaiserslautern         (2:247/110)
[phone]  Neuenfels - Box Pirmasens  VNT  (9:492/2570.0) (2:247/122)
[phone]   Golem, Kirchhain 1                             (2:248/102)
[phone]  Super Mario Mailbox  VIR                       (2:242/516)
[phone]   The Summit BBS  VIR                            (2:247/406)
[phone]   Gilbert's Fundgrube - Offenbach/Main FRG      (9:494/7060)
[phone]  Virus Research Center Line II                 (2:241/7526)
[phone]  Virus Help Service, Karlsruhe(Nemesis author) (2:241/7518)
[phone]  Bodensee bitbeisser Crew Friedrichshafen      (2:241/7207)
[phone]  Advabced, A Schweigart, Munich VNT (9:494/3120)(2:246/119)
[phone]  Beta-System, Muenchen                           (2:246/10)
[phone]   Ed's BBS, Sulzdorf FRG                          (2:246/86)
[phone]   Another Brick In The Wall!  VIRINF            (2:2400/304)
[phone]   Creaturas de la Noche, Monterrey NL              (4:971/1)
[phone]   Calmer Software   TBSCAN/TBRESCUE/TBSCANX/Thunderbyte Card
[phone]   Melbourne Board: ComputerWare for Micros       (3:681/871)
[phone]   Diagnostic BBS, Brisbane, Australia  VIRINF    (3:640/302)
[phone]   Power Up OZ  VIRINF                            (3:640/215)
[phone]   The Edge of Reality!  VIR               C:CURE (3:640/886)
[phone]   Bangkok Security Associates                 Victor Charlie
[phone]  Fil Grushevsky, Ukraine  VNT        (9:744/101) (2:463/34)
[phone]  [e-mail], Pereslavl  DOGSoft Ambulance
[phone]  The Watering Hole BBS, Tokyo  VIRINF          (6:730/18.0)
[phone]   TAIC, [e-mail], Hong Kong               (6:700/1)
[phone] Zen BBS, Taiwan  VIR                         (6:720/312.0)
[phone]  Power Wave  VIRINF                              (6:727/19)
[phone] New Taiwan Opus BBS  VIR                       (6:727/2.0)
[phone]  RAN BBS, Istanbul Turkiye  VIR                   (2:430/12)
[phone]  Wild Gun Excell/\/et  VIRINF                   (2:403/156)
[phone]  Nemrod Kedem Rishon Le, Zion Israel            (2:403/138)
[phone] MNP5  VNT            (9:9721/0, 9:99/972) (2:403/138)
[phone]  14,400 V32b/V42b  VNT    (9:9721/101, 9:972/0) (2:403/138)
[phone]  14,400 V32b/V42b  PC MC AT AM VIR              (2:403/138)
[phone] V42b                                      (2:403/138)
[phone]  Rudy's Place, Zion Israel                      (2:403/138)
[phone]   Atari Blues BBS Israel                       (2:405/101.0)
[phone]   Time Vortex  VNT                              (9:9721/111)
[phone]   Triple D BBS, Rehovot Israel                   (2:403/123)

==============
Vancouver      [e-mail]         | "It says 'Hit any
Institute for  [e-mail]      | key to continue.'
Research into  [e-mail]         | I can't find the
User           [e-mail]         | 'Any' key on my
Security       Canada V7K 2G6           | keyboard."

------------------------------

End of VIRUS-L Digest [Volume 6 Issue 150]
******************************************