Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!csd4.csd.uwm.edu!bionet!ames!indri!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: portal!cup.portal.com!Alan_J_Roberts@Sun.COM Newsgroups: comp.virus Subject: 1701/4 Disinfector Message-ID: <0002.8908181428.AA27881@ge.sei.cmu.edu> Date: 16 Aug 89 15:36:09 GMT Sender: Virus Discussion List Lines: 34 Approved: krvw@sei.cmu.edu Forward from John McAfee ============================================================================= Hi folks. I've had a large number of panicky calls, and Ken van Wyk has had at least one 'emergency' message about a possible 1701 virus in the M-1704.EXE disinfector program. What's happening is VIRUSCAN is identifying the 1701 virus code within the disinfector product. The 1701/4 disinfector is the only one of our disinfectors that causes this problem, and because of the very small de-garbling code within the 1701/4 virus, there is no practical way around it. Our choices are: 1. Remove the 1701/4 disinfector from circulation and let people disinfect manually; 2. Change VIRUSCAN to ignore the program (it's the only non-virus program we know of that looks like a virus to VIRUSCAN); or 3. Continue as is. I definitely do not want to change VIRUSCAN to start and 'exclusion' list. This defeats the purpose of the scan program and reduces its reliability. I also believe that the value of the disinfector outweighs the confusion factor. I have stated up front in the documentation for M-1704 that the user should contact us BEFORE trying to use the program so that we can verify over the phone whether there is a possibility that the program really is infected (a slim probability if downloaded from SIMTEL or other reputable source). A second point I'd like to bring up is that people do not need to stockpile disinfector programs. Many of these programs are dangerous if used on uninfected systems and even in infected systems, certain disinfectors can have unpleasant side effects if used improperly. A disinfector should be used AFTER an infection has been verified. It appears that many people are collecting disinfectors and trying them out so that they are prepared for an infection if one occurs. I don't think this is a good idea. My final recommendation is: Read the documentation and follow the instructions. If you're using the M-1704 program, then call before you do anything with it. John McAfee