Article View: comp.virus
Article #3135Re: PS-MPC, similar to VCL (PC)
From: Fridrik Skulason
Date: Wed, 11 Nov 1992 01:40
Date: Wed, 11 Nov 1992 01:40
17 lines
1157 bytes
1157 bytes
ACPS7115@RYEVM.RYERSON.CA (Mind Your Own Business!!!!) writes: >Q: does McAFEE, for Frisk, have a scan string for the viruses made buy > the MPC? Well, unfortunately there is no single string possible for all PS-MPC generated viruses. I have added detection of it, however, and I believe version 2.06a (the latest F-PROT) gets them all - however, as PS-MPC generates .ASM code, somebody could take the output and keep modifying it, until my scanner misses it. However, my heuristic scanner would probably continue to detect it.... One note - even though the PS-MPC viruses are quite primitive, they are "better" than the VCL viruses in one respect - they seem to work properly. - -frisk
Technical Details
Message-ID:
<0016.9211121928.AA09892@barnabas.cert.org>Path:
arc1-ca.pugleaf.net!sparky!uunet!ornl!utkcs2!darwin.sura.net!zaphod.mps.ohio-state.edu!magnus.acs.ohio-state.edu!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!newsShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!sparky!uunet!ornl!utkcs2!darwin.sura.net!zaphod.mps.ohio-state.edu!magnus.acs.ohio-state.edu!usenet.ins.cwru.edu!cert!netnews.upenn.edu!netnews.cc.lehigh.edu!news From: frisk@complex.is (Fridrik Skulason) Newsgroups: comp.virus Subject: Re: PS-MPC, similar to VCL (PC) Message-ID: <0016.9211121928.AA09892@barnabas.cert.org> Date: 11 Nov 92 01:40:14 GMT Sender: virus-l@lehigh.edu Lines: 17 Approved: news@netnews.cc.lehigh.edu