Conference powdml::pc_security

MS-DOS/WINDOWS 3.n ANTI-VIRUS SOFTWARE on company-wide site license

The latest F-PROTECT version 2.26 is now available from:

MINOTR::USER6:[VIRUS]C_F_PROT.EXE is a self-decompressing kit 
                                  1885 blocks long and in block 512
                                  sequential format, world readable.
                                  (file was compressed with PKZIP 2.04G,
                                   in this compressed form it MUST NOT 
                                   be distributed outside the company)

MINOTR::USER6:[VIRUS.F-PROT] is a world readable subdirectory containing
                             an uncompressedkit.

Program size has changed
VERSION 2.26   F-PROT  is  115,785 bytes 

The F-MACROW program is now imbedded in the SETUPFM.EXE installation
file.
-------------------------------------------------------------------------

RENAMING - the vendor has always named his DOCUMENTATION file with a .DOC
suffix, although they are really ASCII text.  They are now renamed to .TXT 
to avoid confusion with the README.DOC which is a MS WORD document 
accompanying SCANPROT.DOT.

Below is an abridged version of the NEW.226

-------------------------------------------------------------------------
Version 2.26 - major changes:

   A massive renaming of viruses has been undertaken in order to make
   F-PROT conform more closely to the CARO virus naming standard.  For a
   list of the renamed viruses, see at the end of this file.

Version 2.26 - the following false alarms were fixed:

        ONGUARD.COM - Possibly a new variant of Jerusalem.

Version 2.26 - new viruses:

   The following 61 viruses are now identified, but can not be removed as
   they overwrite or corrupt infected files.  Some of them were detected by
   earlier versions of F-PROT, but not identified accurately.
...

   The following 431 new viruses can now be removed.  Many of them were
   detected by earlier versions, but are now identified accurately.
...

   We also added detection and disinfection of 2 Linux viruses:

        Linux/Bliss.17930
        Linux/Bliss.18642

   The following 207 new viruses are now detected and identified but can not
   yet be removed.
...

   The following 1 new virus is now detected, but not identified.
   F-PROT will just report the family name with a (?), as it is not yet
   able to determine which variant it is dealing with.  Disinfection of
   this virus is not yet possible.

        Tourist

   The following viruses have been renamed:
...

MS-DOS/WINDOWS 3.n ANTI-VIRUS SOFTWARE on company-wide site license

The latest F-PROTECT version 2.27 is now available from:

MINOTR::USER6:[VIRUS]C_F_PROT.EXE is a self-decompressing kit 
                                  1972 blocks long and in block 512
                                  sequential format, world readable.
                                  (file was compressed with PKZIP 2.04G,
                                   in this compressed form it MUST NOT 
                                   be distributed outside the company)

MINOTR::USER6:[VIRUS.F-PROT] is a world readable subdirectory containing
                             an uncompressedkit.

Program size has changed
VERSION 2.27   F-PROT  is  115,966 bytes 

The F-MACROW program is now imbedded in the SETUPFM.EXE installation
file.
-------------------------------------------------------------------------
Version 2.27 - major changes (From FRISK Software International, abridged 
with "..." where there are long lists, see the file NEW.227 for full data):

We apologize for version 2.27 being late.  The major reason is that we
wanted to add proper detection of Office '97 Word and Excel macro viruses,
as contrary to what you might have been led to believe, the anti-virus
features added to the latest version of Word do not make it virus-proof.

Getting the required information from Microsoft took much longer than
anticipated, and we were forced to spend a considerable part of our
developers' time on reverse-engineering certain parts of the file format.

Version 2.27 - major changes:

    There are no major changes in 2.27, which will probably be the last
    version of the scanner using our "old" technology, as we have been
    busy creating an improved product:  F-PROT 3.0, which among other
    things will combine the F-PROT and F-MACROW programs into one.

    Most of the new viruses added to this version are macro viruses.
    We added detection/disinfection of over 600 Word and Excel viruses
    since version 2.26 was released - those viruses are all handled by
    the F-MACROW program, not F-PROT itself.

Version 2.27 - the following problems were found and corrected:

    No problems were reported to us that needed correction.

Version 2.27 - the following false alarms were fixed:

	INSTALL.COM   Possibly a new variant of Creator
	PEAS.COM      Possibly a new variant of Creator
	REDIR.COM     Possibly a new variant of Darth_Vader
	SERVER.COM    Possibly a new variant of Darth_Vader
	MUM.EXE       New or modified variant of Jerusalem
	SUCH.EXE      Possibly a new variant of Cascade

Version 2.27 - minor improvements and changes:

   The .DOC files that were included with F-PROT have been renamed and
   given a .TXT extension, as they are just plain ASCII files.

   The DISTRIB.TXT file now states it clearly that we consider the
   Virus Simulator from Rosenthal Engineering a virus-construction tool,
   and any site offering that program is therefore not permitted to offer
   F-PROT.  Restricting the distribution of our program this way may seem
   strange, but we consider this an ethical issue - we do not wish to
   support the creation of viruses is any way, and allowing F-PROT to
   be distributed together with viruses or virus-construction tools could
   be interpreted as support for virus development.

Version 2.27 - new viruses:

   The following 6 viruses are now identified, but can not be removed as
   they overwrite or corrupt infected files.  Some of them were detected by
   earlier versions of F-PROT, but not identified accurately.

	HFR.702
	HLLO (4184, 4476 and 5071)
	Phile.210
	Trivial.32.H

   The following 54 new viruses can now be removed.  Many of them were
   detected by earlier versions, but are now identified accurately.

   ...

	Additionally, as mentioned above, detection and disinfection of
	over 600 macro viruses was added.

   The following 30 new viruses are now detected and identified but can not
   yet be removed.
	
   ...

   The following 1 virus which was identified by earlier versions can
   now be removed.

	Johnny.826

   The following viruses have been renamed:
	
	HLLP.4080 -> HLLP.Weed.4080
	IVP.648 -> IVP.648.A
	NYB -> NYB.A
	Sierra.A-D -> NYB.B-E