🚀 go-pugleaf

			F-PROT 2.21 ON KILCOM1
			======================

The latest version of the PC virus fighting software, F-Prot 2.21, has been
placed on the Novell server KILCOM1; just login as GUEST (no password
required) and change to the FPROT directory. The file FP-221.EXE is a
self-extracting compressed archive.

F-Prot may also be obtained at the Help Desk; just bring in a formatted 
floppy diskette. The Help Desk is located in the basement of the Killam 
Library and is open from 9-12 and 1:30-4:30 weekdays.

F-Prot is free for use on personal (privately owned) systems, but there is
a licensing fee for use on university or commercially owned systems. Please 
see the program documentation for details of educational fees. UCIS
suggests that each department remit this fee on behalf of its faculty and
staff.

An abbreviated version of the author's (Fridrik Skulason, aka Frisk) notes
on the new version follows: 
===========================================================================
Version 2.21 - major changes:
 
    Very many virus names have been changed, in order to make the
    naming scheme more logical.  Most new viruses now receive names of
    the form "family.xxxx", where xxxx is the infective length of the
    virus, and most old virus names have been changed accordingly.

Version 2.21 - the following problems were found and corrected:

    The Antibase virus was only detected in COM files, not EXE.

    The Ginger.2774 virus was only detected in boot sectors, but not
    identified properly. 

    The PH33R virus was not detected in Windows applications, just DOS files.

Version 2.21 - the following false alarms were fixed:

    EMPRL03.COM: MtE
    NC.EXE:      Possibly a new variant of Civil_Defense
    NGBOOT.EXE:  Possibly a new variant of AntiCAD
    POSCRN.QPP:  MtE
    ROMSHELL.COM:Possibly a new variant of PS-MPC
    TSRCHK.COM:  Possibly a new variant of Taz
    VEIJO.EXE:   Possibly a new variant of Urfydus

    Also, VIRSTOP flagged some ProPack compressed files as containing
    the Over1644 virus.

Version 2.21 - minor improvements and changes:
 
    Previously, if a small file was created which contained nothing but a
    short byte sequence, which happened to match one of the search strings
    F-PROT used, it would report "possibly a new variant of ...".  This has
    been changed so that if the file is too short to contain a virus, nothing
    is reported.

    F-PROT now recognizes four new packers/wrappers (Hybrid, JD3, Teus
    and Ucexe), which used to trigger the heuristic scanner, but are
    now reported properly.

    F-PROT now detects programs that have been Trojanized by the Exebug virus.

    Invalid files (for example .EXE files with the entry point outside
    the loadable part) do not count as "suspicious" files any more.

Version 2.21 - new viruses:

    43 new viruses are now identified, but can not be removed as
    they overwrite or corrupt infected files.  Some of them were detected by
    earlier versions of F-PROT, but not identified accurately.

   290 new viruses can now be removed.  Many of them were
   detected by earlier versions, but are now identified accurately.

   108 new viruses are now detected and identified but can not
   yet be removed.

   3 viruses which were identified by earlier versions can
   now be removed.

   The following viruses have been renamed:

	_1798      -> Com2S.1798
	Espejo     -> Fifteen_Years
	TheDraw    -> Draw
	Vienna.IWG -> Vienna.Iraqui_Warrior.B