🚀 go-pugleaf

> From:    mechalas@mentor.cc.purdue.edu (John Mechalas)

Sorry for the delay in responding!  I was out last week on vacation...

>    1) Does VIRSCAN have a tendancy to cause a false positive
>       for Yankee Doodle?  I think we really do have a virus, but
>       I'd like to check this option anyway.

No!  We know of no 2885 false positives at all, so if you've gotten
reports in multiple files, it's almost certainly a real infection.
(If you'd like to uuencode and send me an infected file, I'd be glad
to verify the exact identity.)

>    2) I check F-Prot's virus base, but of course every virus is
>       labeled differently between scanners.  :)  Which version of
>       Yankee Doodle do we have, as in what does this strain do?

I think F-Prot calls it "Yankee (TP-44)".  Not too atrociously
different!  *8) It's not a fascinating virus; it infects COM and EXE
files, and sometimes plays the tune Yankee Doodle at 5pm.  It also
alters the Bouncing Ball virus, if it finds in in memory, but that
basically never happens so isn't interesting (the alteration causes
the altered BB to eventually stop spreading, as I recall).

- - -- -
David M. Chess                           Objects In Mirror
High Integrity Computing Lab                Are Closer Than They Appear
IBM Watson Research