Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!usc!elroy.jpl.nasa.gov!ncar!midway!msuinfo!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: maven@rata.vuw.ac.nz (Jim Baltaxe)
Newsgroups: comp.virus
Subject: Re: Scan v67 and killer.com (PC)
Message-ID: <0006.9010171920.AA12825@ubu.cert.sei.cmu.edu>
Date: 15 Oct 90 22:37:04 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 28
Approved: krvw@sei.cmu.edu

Bill.Viggers@comp.vuw.ac.nz (Bill Viggers) writes:

>	There seems to be a little problem with the latest version of
>	Scan and its related products.  Killer is (I think) locally written,
>	and is designed to remove the STONED virus.

>       Putting 2 and 2 together, I assume that this means that
>	killer.com has some code in it that Scan uses to identify the
>	invader virus.

This appears to be the case, although our own testing is no finished yet.

In any event, I would suggest that people, in New Zealand at least, no
longer use KILLER to treat the Stoned virus. We have released a new
program, NOSTONE, which handles both the original Stoned and a new
variant with an altered signature (and one of several new messages,
including "Donald Duck is a liar.") Recent versions (post 64) of
McAfee's SCAN also know about both versions of the Stoned virus.

NOSTONE is available on our publicly distributed collection of
anti-virus utilities and it will be available for anonymous FTP very
shortly; like wait a day or two. The files will be in /usr/local/ftp
on rata.vuw.ac.nz

Jim Baltaxe - MAVEN@vuw.ac.nz
- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
There are some days when I can't be sure whether life is trying to
pass me by or trying to run me over.