Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!swrinde!cs.utexas.edu!sun-barr!rutgers!aramis.rutgers.edu!porthos.rutgers.edu!petechen
From: petechen@porthos.rutgers.edu (Peter Chen)
Newsgroups: comp.sys.mac.apps
Subject: Re: Problems with SAM 2.0
Message-ID: <Apr.8.12.44.57.1991.20999@porthos.rutgers.edu>
Date: 8 Apr 91 16:44:58 GMT
References: <369.27fc4f76@mbcl.rutgers.edu>
Organization: Rutgers Univ., New Brunswick, N.J.
Lines: 109

friedman@mbcl.rutgers.edu writes:

>Apparently, the author, Paul
>Cozza, is unreachable as he has people who post messages for him.
........
>Rich
>Friedman@mbcl.rutgers.edu

>PS The last virus I got new codes for was about 6 months ago.  If anyone could
>pass along the list of codes I might have missed, I would appreciate.
>Rich

A couple days ago, I sent a message to Paul Cozza regarding exactly such
a listing.  And I got a reply from him within a day, so I wouldn't say
he is unreachable. 

Pete Chen

Here is the list he sent me:
--------------
Here are a list of the definitions that have been posted:
 
***********
 
ZUC
 
     Virus Name:   ZUC
  Resource Type:   CODE
    Resource ID:   1
  Resource Size:   Any
  Search String:   4E56FF74A03641FA04D25290    (hexadecimal)
  String Offset:   Any
 
 
***********
 
Garfield (or MDEF), both strains A & B
 
   Virus Name:   Garfield
Resource Type:   MDEF
  Resource ID:   0
Resource Size:   Any
Search String:   A9A92F0CA9AA2F0CA9B0      (hexadecimal)
Search Offset:   Any
 
 
***********
 
Steroid Trojan horse
 
   Virus Name:  Steroid Trojan
Resource Type:  INIT
  Resource ID:  148
Resource Size:  1080
Search String:  ADE9 343C 000A 4EFA FFF2 4A78    (hexadecimal)
String Offset:  96
 
 
 
***********
 
CDEF
 
   Virus Name:   CDEF
Resource Type:   CDEF
  Resource ID:   1
Resource Size:   510
Search String:   45463F3C0001487A0046A9AB      (hexadecimal)
Search Offset:   420
 
 
 
***********
 
ANTI B
 
   Virus Name: ANTI
Resource Type: CODE
  Resource ID: 1
Resource Size: Any
Search String: 000A317CFFFF000CA033303C0997A146     (hexadecimal)
Search Offset: Any   (or, for later versions of SAM, -886 will also work)
 
 
 
***********
 
Garfield C (or MDEF C)
 
   Virus Name:  Garfield      (or MDEF)
Resource Type:  MDEF
  Resource ID:  0
Resource Size:  556
Search String:  4D4445464267487A005EA9AB       (hexadecimal)
Search Offset:  448
 
 
 
************
 
   Virus Name:   ZUC B     (or ZUC 2)
 
Resource Type:   CODE
  Resource ID:   1
Resource Size:   Any
Search String:   7002A2604E752014A0552240      (hexadecimal)
Search Offset:   Any
 
************