Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: davidf@CS.HW.AC.UK (David.J.Ferbrache) Newsgroups: comp.virus Subject: Less well known viruses? Message-ID: <0004.8907261137.AA08543@ge.sei.cmu.edu> Date: 25 Jul 89 19:36:47 GMT Sender: Virus Discussion List Lines: 43 Approved: krvw@sei.cmu.edu Having just finished an update on the list of known IBM and MAC viruses I have come across a few reported viruses which no/few details seem to be available on. These are: IBM PC Boot sector Nichols virus both are incorporated in the 0.29 viruscan test 2730 virus strings, but have not been reported in full IBM PC Link viruses Screen characteristic lengths and identifying signatures Dbase are currently unknown for these two viruses covered in Ross's article in the June edition of byte Agiplan So far no-one seems to have a sample of this virus available, also no signatures have been provided Mistake Again no signatures available I would also be interested in characteristic lengths and signature byte sequences for a number of the Homebase variants described in Jim Goodwin's list. On a further point a remarkable similarity has been established between the Saratoga and Icelandic (variant 1) virus code. This similarity is reflected in the code sequences used by Viruscan 0.29. The question raised by this observation is which came first, the Saratoga virus detected in California or the Icelandic virus. With the recent report of a second strain of the Icelandic virus which bypasses Interrupt table dos call monitoring methods it seems that the virus is under active development by a hacker in Iceland. Finally, I will be forwarding three notes from Joe Hirst in the next few days concerning the Ashar variant of Brain, Saratoga virus and his views on the foundation of national research centres. I will establish a temporary mail account for his centre and will relay any correspondence received. - ------------------------------------------------------------------------------ Dave Ferbrache Internet Dept of computer science Janet Heriot-Watt University UUCP ..!mcvax!hwcs!davidf 79 Grassmarket Telephone +44 31-225-6465 ext 553 Edinburgh, United Kingdom Facsimile +44 31-220-4277 EH1 2HJ BIX/CIX dferbrache - ------------------------------------------------------------------------------