Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!wuarchive!zaphod.mps.ohio-state.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: PHYS169@csc.canterbury.ac.nz (Mark Aitchison, U of Canty; Physics)
Newsgroups: comp.virus
Subject: Re: Trojan version of VIRUSCAN version 78 (PC)
Message-ID: <0009.9105151741.AA00799@ubu.cert.sei.cmu.edu>
Date: 15 May 91 01:19:00 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 16
Approved: krvw@sei.cmu.edu

aryehg%darkside.com@apple.com (Aryeh Goretsky) writes:
> We have received a trojan horse version of VIRUSCAN...
>
> Running PKUNZIP on the file reveals the following:
>
>  . Authentic files Verified!   # TJB859   Zip Source: McAFEE ASSOCIATES
>
> While the Authentic Files Verified Message appears, the Serial Number is
> NOT correct.  McAfee Associate's Serial Number is NWM405.

This worries me. Could somebody explain what good the PKUNZIP
authentication system should be, as it obviously isn't providing
enough warning here. (Who would know, and think of looking at, the
serial number? Probably few people).

Mark Aitchison, Physics, University of Canterbury, New Zealand.