Follw-up to Virus Alert #2

[American Embassy <usemb@servis.net.tr>]

This is an explanation about the virus.
It was posted by a guy I have read often and
he seems to know what he's talking about, despite
the tone of the Post.
If anyone cannot break out the attachment and needs
the information, E-mail me and I will write you the details.
Regards,
Jack Gartin
usemb@servis.net.tr
CIS 100330,705
US Embassy, Turkey
From usemb@servis.net.tr Mon Jun 20 04:48:48 1994
Date: Mon, 20 Jun 94 04:42 EET DST
From: American Embassy <usemb@servis.net.tr>
To: usemb@servis.net.tr

Subject: bontchev Re: CD-ROM Shareware Virus Alert!                                                                                                                                                                                                                                           

Path: trmetu!trearn!dearn!
 nntp.gmd.de!xlink.net!zib-berlin.de!news.dfn.de!news.dkrz.de!news.rrz.uni-hamburg.de!fbihh.informatik.uni-hamburg.de!bontchev
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.security.misc
Subject: Re: CD-ROM Shareware Virus Alert!
Date: 9 Jun 1994 17:24:00 GMT
Organization: University of Hamburg -- Germany
Lines: 41
Message-ID: <2t7j7g$jim@rzsun02.rrz.uni-hamburg.de>
References: <94160.102633U45301@uicvm.uic.edu>
NNTP-Posting-Host: fbihh.informatik.uni-hamburg.de
X-Newsreader: TIN [version 1.2 PL2]
 
Mary Jacobs (U45301@uicvm.uic.edu) writes:
 
>                          INTERNET VIRUS ALERT
 
>      A virus has been discovered on the Internet that is disguised as CD-ROM
> shareware.  Unknown hackers have illegally put the Chinon name on the
> destructive shareware file and released it on the Internet.  This catastrophic
 
[The following comments are not directed towards the person who posted
the message (who is not the author and is just forwarding a standard
text that is circulating around), but towards the (unknown) athor(s)
of the message.]
 
PLEASE, IGNORE THIS CRAP. It was written by someone who suffers of
ACDS (Acute Clue Defficit Syndrome) about computer viruses, and all
the media is repeating it without knowning what they are talking about
(as usual). I am really tired of seeing it for the Nth time.
 
First, it was not a virus. It was a Trojan Horse. Viruses replicate.
Trojan horses do not. Got that?
 
Second, the trojan, Worpal.2, has been known for years. All good
scanners (e.g., F-Prot, Dr. Solomon's Anti-Virus ToolKit) have been
able to detect it for years. Just because somebody was using a crappy
anti-virus program (NAV in that particular case, I believe) is not an
excuse for raising panic.
 
Third, as far as I understand, the trojan (NOT A VIRUS, damn it!), has
been found only on some obscure BBS, not "on the Internet" and is not
spreading at all.
 
In short - ignore it. It's just incompetent journalists making up
their stories.
 
Regards,
Vesselin
--
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.3 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de        22527 Hamburg, Germany