Path: utzoo!utgpu!news-server.csri.toronto.edu!mailrus!uunet!mcsun!unido!fauern!tumuc!lan!rommel
From: rommel@lan.informatik.tu-muenchen.dbp.de (Kai-Uwe Rommel)
Newsgroups: comp.windows.ms
Subject: Warning! Bogus virus
Message-ID: <4070@tuminfo1.lan.informatik.tu-muenchen.dbp.de>
Date: 21 Aug 90 15:11:13 GMT
Sender: news@lan.informatik.tu-muenchen.dbp.de
Reply-To: rommel@lan.informatik.tu-muenchen.dbp.de (Kai-Uwe Rommel)
Organization: Inst. fuer Informatik, TU Muenchen, W. Germany
Lines: 23

Tanguy Kervahut (kervahut@iro.umontreal.ca) reported to Michael Regoli
at cica.cica.indiana.edu, that my screen saver EGAUTIL8 seems to be
infected by the 1381 virus, but that SCAN V64 does only report this when
using the /A switch (rather strange).

I checked it out and it seems to be a bug in SCAN itself. SCAN reports
the virus even in a virgin, just fresh assembled and linked executable.
Also, virlist.txt says, that the 1381 virus attacks EXE files and
overlays but not COM files (EGAUTIL8 is a COM file) and that increases
the attacked file's size by 1381 bytes which is not true for the
"infected" EGAUTIL8.

That means, EGAUTIL8 is clean, this seems to be a bug in SCAN.
The same virus is "found" in the new version EGAUTL83 which is also not
infected.

Kai Uwe Rommel

--
/* Kai Uwe Rommel
 * Munich
 * rommel@lan.informatik.tu-muenchen.dbp.de
 */