🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #3119

Re: KEY Press virus & McAfee v97 (PC)

#3119
From: McAfee Associates
Date: Wed, 11 Nov 1992 00:41
52 lines
2823 bytes
Hello Vesselin,

you write:
[Or if the line starts with a ">>" then I wrote it.]
[...my comments about KeyPress variants deleted for brevity...]

>While you are at it, please also have in mind that:
>
>BetaBoys.Rattle is reported as Rattle [Rttl] and Mexican [Mex];
>Burger.* are reported as Burger [Burger] and FamilyQ [FQ];
>Cascade.1701.D is reported as JoJo [JoJo] and Yap [Yap];
>Crew.* (except Crew.1.C) are reported as Crew-2480 [2480] and FamilyM [FM];
>FaxFree.Topo is reported as Lamer [Lam] and Topo [Topo];
>Happy_New_Year.1600 is reported as Happy N.Y. [HNY] and Voronezh [Vor];
>Horse.1154.* are reported as 512 [512] and Horse [Hrs] (in some files only);
>Jerusalem.Mummy.1_2 is reported as Mummy [Mum] and FamE [FE];
>Jerusalem.Timor is reported as 1241 [1241] and Jerusalem [Jeru];
>Leprosy.G is reported as infected twice by Leper [OW];
>Leprosy.Plague is reported as Viper [Vip] and Plague [Plg];
>MShark is reported as FamN [FN] and FamM [FM];
>Murphy.Brothers is reported as Brothers [Bro] and 1530 [1530];
>Murphy.Tormentor.* are reported as LixoNuke [Lix] and Murphy [Murphy];
>
>Sorry for the long list, but I hope that it might help to some other
>readers too. Hope you'll fix that in your next version.

Well, they all are detected as viruses, which is a start.  I'll ask our
programmers if they can spend some time looking into that listing of viruses.

[...questions about reliability of Commander Bomber detector deleted...]
>Am I sure about -what-? That SCAN 97 does not detect Commander Bomber
>reliably? Yes, I am sure about it. It doesn't detect it reliably. It
>misses this virus in some of the infected files.
[...deleted...]

But it picks it up in some.  Which means the programmers are at least on
the right track, as far as a making a detector goes.  I'll ask them to look
at the detector for the it, then.  If they have any questions, can they 
contact you directly by email?

Regards,

Aryeh Goretsky
Technical Support

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
Technical Details
Message-ID: <0013.9211121928.AA09892@barnabas.cert.org>
Path: arc1-ca.pugleaf.net!sparky!uunet!ukma!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!ukma!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: KEY Press virus & McAfee v97 (PC)
Message-ID: <0013.9211121928.AA09892@barnabas.cert.org>
Date: 11 Nov 92 00:41:03 GMT
Sender: virus-l@lehigh.edu
Lines: 52
Approved: news@netnews.cc.lehigh.edu