Return-Path: XPUM04@prime-a.central-services.umist.ac.uk Received: from G.SEI.CMU.EDU by ubu.cert.sei.cmu.edu (5.61/2.3) id AA04579; Wed, 20 Jun 90 17:30:13 -0400 Received: from SEI.CMU.EDU by g.sei.cmu.edu (5.61/2.5) id AA07199; Wed, 20 Jun 90 17:30:13 -0400 Received: from nsfnet-relay.ac.uk by sei.cmu.edu (5.61/2.3) id AA23522; Wed, 20 Jun 90 17:30:03 -0400 Received: from sun.nsfnet-relay.ac.uk by vax.NSFnet-Relay.AC.UK via Janet with NIFTP id aa23419; 20 Jun 90 16:25 BST From: Anthony Appleyard To: DAVIDF@cs.heriot-watt.ac.uk Date: Wed, 20 Jun 90 16:35:40 BST Message-Id: <$TGWGCZNQBTTC at UMPA> Subject: Virus-L vol 0 issue #1101 Virus-L Digest Tue, 1 Nov 88, Volume 0 : Issue #1101 Today's Topics Nov. 1, monthly information Re: Debrain.exe Macs and VirusRx ** no subject, date = Tue, 1 Nov 88 17:25:25 AST ------------------------------ Date: Tue, 1 Nov 88 13:22:19 ESTT From: "Kenneth R. van Wyk" Subject: Nov. 1, monthly information [ Last modified 01 November 88 - Ken van Wyk ] Welcome! This is the monthly introduction posting for VIRUS-L, primarily for the benefit of any newcomers. Apologies to all subscribers who've already read this in the past (you'll only have to see it once a month and you can, if you're quick, press the purge key...:-). What is VIRUS-L? It is an electronic mail discussion forum for sharing information about computer viruses. Discussions should include (but not necessarily be limited to): current events (virus sightings), virus prevention (practical and theoretical), and virus questions/answers. The list is non-moderated and non-digested. That means that any message coming in goes out immediately. Weekly logs of submissions are kept for those people who prefer digest format lists (see below for details on how to get them). For those interested in statistics, VIRUS-L is now (Nov. 1, 1988) up to 514 direct subscribers. Of those, approximately 50 are local redistribution accounts with an unknown number of readers. What isn't VIRUS-L? A place to spread hype about computer viruses; we already have the Press for that. :-) A place to sell things, to panhandle, or to flame other subscribers. If anyone *REALLY* feels the need to flame someone else for something that they may have said, then the flame should be sent directly to that person and/or to the list moderator (that'd be me, ). How do I get on the mailing list? Well, if you're reading this, chances are *real good* that you're already on the list. However, perhaps this document was given to you by a friend or colleague... So, to get onto the VIRUS-L mailing list, send a mail message to . In the body of the message, say nothing more than SUB VIRUS-L your name. LISTSERV is a program which automates mailing lists such as VIRUS-L. As long as you're either on BITNET, or any network accessible to BITNET via gateway, this should work. Within a short time, you will be placed on the mailing list, and you will get confirmation via e-mail. How do I get OFF of the list? If, in the unlikely event, you should happen to want to be removed from the VIRUS-L discussion list, just send mail to saying SIGNOFF VIRUS-L. People, such as students, whose accounts are going to be closed (like over the summer...) - PLEASE signoff of the list before you leave. Also, be sure to send your signoff request to the LISTSERV and not to the list itself. Note that the appropriate node name is LEHIIBM1, not LEHIGH; we have a node called LEHIGH, but they are *NOT* one and the same. How do I send a message to the list? Just send electronic mail to and it will automatically be redistributed to everyone on the mailing list. By default, you will NOT receive a copy of your own letters. If you wish to, send mail to saying SET VIRUS-L REPRO I can't submit anything to the list - what's wrong? There have been a few cases where people found that they were unable to send anything in to VIRUS-L even though they were registered subscribers (only subscribers can participate). Let me try to explain. The LISTSERV program differentiates lowercase from UPPERCASE. So, if you've subscribed to the list as (for example) OPUS@BLOOM.COUNTY.EDU and your mail is actually coming through as Opus@Bloom.County.EDU, then the LISTSERV will think that you're not subscribed to the list. BITNET usernames and node names are automatically uppercased by the LISTSERV, but other network addresses are not. If your site (or you) should happen to make a change to, say, the system mailer such that it changes the case of your mail, there will be problems. If you're having problems submitting (you'll know this because the LISTSERV will say "Not authorized to send to VIRUS-L..."), try unsubscribing and re-subscribing. If that doesn't work, send me mail (LUKEN@LEHIIBM1.BITNET), and I'll try to fix things up. What does VIRUS-L have to offer? All submissions to VIRUS-L are stored in weekly log files which can be downloaded by any user on (or off) the mailing list; readers who prefer digest format lists should read only the weekly logs. There is also a small archive of some of the public anti-virus programs which are currently available. This archive, too, can be accessed by any user. All of this is handled automatically by the LISTSERV here at Lehigh University (). How do I get files from the LISTSERV? Well, you'll first want to know what files are available on the LISTSERV. To do this, send mail to saying INDEX VIRUS-L. Note that filenames/extensions are separated by a space, and not by a period. Once you've decided which file(s) you want, send mail to saying GET filename filetype. For example, GET VIRUS-L LOG8804 would get the file called VIRUS-L LOG8804 (which happens to be the monthly log of all messages sent to VIRUS-L during April, 1988). Note that, starting June 6, 1988, the logs are weekly. The new file format is VIRUS-L LOGyymmx where yy is the year (88, 89, etc.), mm is the month, and x is the week (A, B, etc.). Readers who prefer digest format lists should read the weekly logs and sign off of the list itself. Subsequent submissions to the list should be sent to me for forwarding. Also available is a LISTSERV at SCFVM which contains more anti-virus software. This LISTSERV can be accessed in the same manner as outlined above, with the exceptions that the address is and that the commands to use are INDEX PUBLIC and GET filename filetype PUBLIC. What is uuencode/uudecode, and why do I need them? Uuencode and uudecode are two programs which convert binary files into text (ASCII) files and back again. This is so binary files can be easily transferred via electronic mail. Many of the files on this LISTSERV are binary files which are stored in uuencoded format (the file types will be UUE). Both uuencode and uudecode are available from the LISTSERV. Uudecode is available in BASIC and in Turbo Pascal here. Uuencode is available in Turbo Pascal. Also, there is a very good binary-only uuencode/uudecode package on the LISTSERV which is stored in uuencoded format. Why have posting guidelines? To keep the discussions on-track with what the list is intended to be; a vehicle for virus discussions. This will keep the network traffic to a minimum and, hopefully, the quality of the content of the mail to a maximum. No one wants to read personal flames ad nausium, or discussions about the pros and cons of digest-format mailing lists, etc. Your adherence to these guidelines is appreciated, and essential in keeping the list a non-moderated one. What are the guidelines? As already stated, there will be no flames on the list. Anyone sending flames to the entire list must do so knowing that he/she will be removed from the list immediately. Same goes for any commercial plugs or panhandling. Submissions should be directly or indirectly related to the subject of computer viruses. This one is particularly important, other subscribers really don't want to read about things that aren't relevant - it only adds to network traffic and frustration for the people reading the list. Responses to queries should be sent to the author of the query, not to the entire list. The author should then send a summary of his/her responses to the list at a later date. "Automatic answering machine" programs (the ones which reply to e-mail for you when you're gone) should be set to *NOT* reply to VIRUS-L. Such responses sent to the entire list are very rude and will be treated as such. When sending in a submission, try to see whether or not someone else may have just said the same thing. This is particularly important when responding to someone else's posting (which should be sent to that person *anyway*). It's very easy to get multiple messages saying the exact same thing. No one wants this to happen. Thank-you for your time and for your adherence to these guidelines. Comments and suggestions, as always, are invited. Please address them to me, or . Ken van Wyk Kenneth R. van Wyk Calvin: (hammer hammer hammer ...) User Services Senior Consultant Mom: Calvin, what are you DOING to the Lehigh University Computing Center coffee table?! Internet: Calvin: Is this some sort of trick BITNET: question? -------------------- Date: Tue, 1 Nov 88 10:11:45 EST From: SHERK@UMDD Subject: Re: Debrain.exe In-Reply-To: Message received on Mon, 31 Oct 88 18:45:34 EST >From: Wim Bonner <27313853@WSUVM1> >If possible, when people post where code is available via FTP, could >you also list the network numbers? I am interested in getting the brain >code, but Our machine which can do FTP does not have a full listing of >hosts. I can call out if I know the number though. The internet address of umd5.umd.edu is 128.8.10.5 but I think this is a problem you should take up with you system administrator. Any machine that can FTP can also find an internet address from a fully qualified domain name. Erik Sherk, Workstation Programmer, Computer Science Center University of Maryland sherk@umd5.umd.edu -------------------- Date: Tue, 1 Nov 88 11:10:44 est From: GATEH@CONNCOLL Subject: Macs and VirusRx > This afternoon, I found that we have what I think is some form >of mutated virus. IT CHANGED MY VIRUS RX PROGRAM TO A GENERIC DOCUMENT >ENTITLED "PLEASE THROW ME IN THE TRASH". This is no joke. It did it right >in front of my eyes. >I got a message box, which stated "There is a penetration attempt >on VirusRx, if the disc is unlocked, it will be changed >to "Please throw me in the trash"". As I understand it, this is a feature of VirusRx. If the application is run on a machine with an infected system (as opposed to running it from a locked floppy w/clean system), and the system infects VirusRx, the application destroys itself. This is to make sure that the virus is not spread further via contaminated copies of VirusRx. Gregg TeHennepe | BITNET: gateh@conncoll Minicomputer Specialist | Phone: (203) 447-7681 Academic Computing and User Services Connecticut College New London, CT 06320 -------------------- Date: Tue, 1 Nov 88 17:25:25 AST Comments: From: CHRIS JONES In-Reply-To: In reply to your message of TUE 01 NOV 1988 14:47:02 EDT I'm a little at a loss to understand your letter. I have no idea what dissertation copy you have in mind, and I don't remember sending anywhere for one. Sorry I can't help. (Maybe you have the address?) Chris Jones (M616000@UNB.CA) -------------------- *** end of Virus-L issue ***