HDTenEightyP/NetNews huggingface dataset:
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Re: VSHIELD, VIRSTOP, ... comparison ? (PC)
Date: 11 Dec 92 19:25:02 GMT

Hi Mike,

mramey@u.washington.edu (Mike Ramey) writes:
>I have found Robert Slade's quick comparison (and his longer reviews)
>of several anti-viral programs very helpful; they prompted me to try
>F-PROT and VIRx, in addition to the McAfee suite of programs which I
>have been using for several years.
>
>Is it possible that the three of you (McAfee, Frisk, and Slade) could
>cooperate to produce a point-by-point comparison of VSHIELD and
>VIRSTOP?
[...deleted...]

Given the already-existing number of anti-viral product-related
messages on comp.virus (and VIRUS-L) lately, perhaps it would be best
to do this offline in email.  If Rob is willing to do the comparison,
I'd be happy to review a draft copy.

Regards,

Aryeh Goretsky
Technical Support
- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR
From: holerbch@phoenix.princeton.edu (Uwe Hollerbach)
Newsgroups: comp.virus
Subject: Re: DOS CHKDSK bug (PC)
Date: 16 Dec 92 09:40:18 GMT

RPH0470@tntech.bitnet (Richard Hosker) writes:
>Mike Ramey <mramey@u.washington.edu> writes:
>
>> How can you tell if you have MS-DOS version 5.00a or not ?

[deleted]

>I don't have a definitve answer to the question Mike posed, but I can report
>one way you *can't* tell which version you have... :-/
>
>The VER/R command returns the following for **both** versions:
>
>        DOS 5.00
>        Revision A
>        DOS in <low,high> memory
>
>(The wording may not be exact here, but the Revision A part is correct.)
>I have tested this on both versions, dates 04-09-91 and 11-11-91.

[deleted]

Hmm, this is strange. I also have DOS 5.0 on my machine (but ask me
about Linux!), and I tried this, just for kicks. I don't remember
every character of the output, but I'm quite sure that it said, among
other things, "DOS 5.0", NOT "DOS 5.00", and the "Revision A" was
definitely missing. I don't remember the exact date on which I bought
the upgrade, but it was quite early on; late April or early May? It
was a special offer from Egghead, $39.95.
- -- 
Uwe Hollerbach          uh@acm.princeton.edu  or  uh@alumni.caltech.edu
"In His infinite mercy, Allah does not subtract from one's alloted span those
hours which are spent in contemplation of net.news. All praise be to Allah."
- -- an obscure commentator on the early work of Al-Khowariszmi
From: RZOTTO@NYX.UNI-KONSTANZ.DE (Otto Stolz)
Newsgroups: comp.virus
Subject: Re: Is this a new virus? (PC)
Date: 15 Dec 92 17:31:51 GMT

trinh@camins.camosun.bc.ca writes:
> - The system hung during booting from the HD [...]
> - A clean boot from floppy would allow access to the HD as usual.
> - [...] detected Stoned; [...] found Stoned and removed it.
> - A second run of [...] found Michaengelo but unable to remove it.
> - Fdisk /mbr did get rid of the Michaengelo look alike and the system
>   reboot successfully from the HD. [...] and [...] then gave the system
>   a clean bill of virus.

This is exactly the sequence of events described sub G3 in the VIRUS-L
FAQ list, which has been posted, recently.

> So would anyone please tell me what virus is this one, thanks.

Stoned + Michelangelo (original MBR lost), what else did anybody expect?

I wonder why we saw so diverging responses to this poster. Do the
experts not bother to read the FAQ list? I assure you, reading it is
worth-while!  I do not say so because I am acknowledged in its preface
(my contribution was rather limited), but because knowing what's in
the FAQ list could save many VIRUS-L subscribers -- both novices and
experienced virus busters -- a lot of work, honestly!

Best wishes,
                    Otto Stolz <RZOTTO@DKNKURZ1.Bitnet>
                               <RZOTTO@nyx.uni-konstanz.de>
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Is this a real virus? (PC)
Date: 11 Dec 92 19:26:10 GMT

GLWARNER@samford.bitnet (THE GAR) writes:

> We had a lab machine die in one of our computer labs yesterday.
> SCAN8.7BV95 said it had a "Generic Boot Virus" (real useful stuff, that).

Sigh... Hints to all producers of scanners: Yes, indeed the most
important question that interests the users is "Am I infected or
not?". However, the NEXT important question is "If I am infected,
which virus is it, i.e. what can it do/has done to me?". (The THIRD
question is usually "How do I get rid of it?".) Reports like "Generic
Boot Virus" or "FamilyQ Virus" are not very informative... Users -do-
want exact identification (or at least "almost exact identification",
if we use Frisk's terminology)...

> hits has been mostly due to bad code.  Stoned has garbled many floppies,
> and we have seen Marijuana messages and bouncing balls, but this is the
> first destructive hard drive hit we've seen.

No kidding, you have seen the Marijuana message? On the screen??
Displayed by the virus??? Then you should have a new variant - none of
the ones we have here displays that message. The original virus
displays only the first part - "Your PC is Now Stoned".

> The virus began in Sector 0, and wrote variations of ASCII 0-255 all the
> way through the boot sector and the FAT table.  (Or so it seemed to me

Ah, this explains the "Generic Boot Virus" report... It seems to me
that SCAN is using some kind of heuristics (Aryeh?) and reports a
"generic" boot (or partition) virus each time when something seems
wrong with the boot sector(s) - like missing names of the hidden DOS
files, missing signature (0AA55h), etc. In your case the whole
contents of the boot sector has been destroyed, so its contents has
become obviously "abnormal". This has triggered SCAN's heuristics
(just a wild guess; I'm not certain that it is indeed so).

In your particular case, the crash might not be caused by a virus. It
might be a normal crash, or be caused by a buggy program... It's the
destruction of the contents of the boot sector that has caused the
report about the "Generic Boot Virus", not the "generic boot virus"
has caused the destruction...

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: MICKLE@csmcmvax.bitnet (Dave Mickle x5205)
Newsgroups: comp.virus
Subject: Does anyone have info on DAME? (PC)
Date: 15 Dec 92 00:25:44 GMT

We've got a PC which is displaying a message to the effect it's
infected by the "DAME" virus.  Don't know what symptoms there are in
addition to the message.  We're going to do a low level format, but
would like to know what we've contracted.
- -----------------------------------------------------------------------------
- ----David K. Mickle                             darn, i sure
- ----if   !(BITNET) MICKLE@CSMCMVAX                       hate to see this
- ----then  (VOICE)  310 855-5205                      space go to
- ----else  (FAX)    310 967-0112                                 waste
- ----while (Cedars-Sinai Medical Center, Los Angeles, CA  USA)
- ----------------------------------------------------------------------------
From: dab6@po.CWRU.Edu (Douglas A. Bell)
Newsgroups: comp.virus
Subject: Jerusalem varient which crashes a novell network? (PC)
Date: 10 Dec 92 16:54:30 GMT

Hello all,

Recently at CWRU we had files on a novell 3.11 server get infected 
with a varient of the Jerusalem virus.

What is strange was that if a user ran an infected file on the network,
it would crash the file server.

Has anyone seen this kind of behavior before?
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Is this a new virus? (PC)
Date: 11 Dec 92 19:05:03 GMT

tck@fold.ucsd.edu (Kevin Marcus) writes:

> trinh@camins.camosun.bc.ca writes:
> >[description of a typical Stoned+Michelangelo problem deleted]

> It looks like you had a multiple infection.  Stoned and it's varients
> (Michelangelo is one...) don't always copy the MBR to the same spot.

No, the problem is cause by exactly the opposite - both Stoned and
Michelangelo copy the MBR to exactly one and the same spot (on the
hard disk), which results in the original MBR being lost.

> Michelangelo finds it's way onto your system; your MBR at 0,0,0 is
> moved to 0,0,7.  Shortly after, some copy of Stoned decides to find
> its way there, too, moving 0,0,0 (which is Michelangelo) to 0,0,15.
>  
> Now, upon a normal boot, the sectors are executed like:
> 0,0,0  (Stoned)
> 0,0,15 (Michelangelo)
> 0,0,7  (Real MBR)
>  
> Removal of this can be funny because some varients of Stoned store
> the real MBR at 0,0,7, as well as Michelangelo.  What probbaly

Removal of the above is very easy: you read 0,0,0, see Stoned in it,
get 0,0,7 and put it at 0,0,0. Since (according to your description),
it contains the real MBR, the problem is solved.

> tried to remove the real mbr.  (Though I don't know why this is so,
> since Mich uses sector 7, if my memory serves me right).

Correct, so in reality this is what happens:

1) Clean disk:

	0,0,0	(Real MBR)
	0,0,7	(unused)

2) After a Michelangelo infection:

	0,0,0	(Michelangelo)
	0,0,7	(Real MBR)

3) Now comes a Stoned infection:

	0,0,0	(Stoned)
	0,0,7	(Michelangelo, put there by Stoned, overwriting the
		 real MBR)

4) A scanner sees Stoned in the MBR and tries to remove it, by
restoring what it believes is the real MBR from 0,0,7 (where Stoned
puts it):

	0,0,0	(Michelangelo - fetched from 0,0,7 by the remover)
	0,0,7	(Michelangelo - still there, unless wiped out)

5) The scanners no sees the Michelangelo and tries to remove it by
restoring what it believes is the real MBR from 0,0,7 (where
Michelangelo puts it):

	0,0,0	(Michelangelo - fetched from 0,0,7 by the remover)
	0,0,7	(Michelangelo - still there)

And so on ad infinitum...

If the remover is smart enough, it will wipe out the sector at 0,0,7
at step 4. Also, at step 5 it will figure out that the sector at 0,0,7
now is wiped out and contains no valid MBR (this is what F-Prot does).
Now, if the remover is -really- smart, it will install a valid MBR
program that it carries with it, just for such cases... Of course,
there are some pitfalls with preserving the partition table data, but
they can be dealt with... Does anybody know a scanner that is that
smart?

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: riordan.cybec@tmx.mhs.oz.au (Roger Riordan)
Newsgroups: comp.virus
Subject: PC Viruses "protected" by CPAV (PC)
Date: 17 Dec 92 22:16:35 GMT

> MC1980@mclink.it (Luca Parisi) reports

> " I' ve had some random problems on my PC and wondered if some 
> virus could be responsible for this. ... I also poked around with 
> PCTools, and find a strange repeating pattern in the slack space 
> of many .EXE files. It contains something like 'Carmel SW' and a 
> copy of the 'MZ' signature, not the usual garbage...

This tail is a form of integrity checker, and is added to the file 
(in exactly the same way as a virus) by part of the CPAV/CARMEL 
anti-virus software.  When you run the program it is run first, and 
warns you if the start of the file, or the length, has been changed.  

This is a nice idea, but unfortunately this product has caused a 
number of users a lot of problems by protecting pre-existing viruses 
it has failed to detect. "Intelligent" scanners will generally fail 
to find viruses protected in this way, as the initial entry point 
goes to the CPAV software, instead of the virus. Logically "dumb" 
scanners ought to find the virus, but may not do so in practise.  

We have just received a new strain of Zerotime (or Slow) in which 
the decryption procedure has been patched to avoid detection.  The 
sample disk we received had many files in which the virus was 
protected in this way.  Because the CPAV software overwrites the 
start of the file (after saving it elsewhere) it has split the 
encryption procedure in two.  Neither part is long enough to detect 
reliably, without causing many false alarms, and so it is not 
possible to detect the virus unless the CPAV software is removed.

The virus will emerge, and make itself obvious by infecting new 
files (and also the ones with the "protected" virus), in the normal 
way immediately you run an infected file, but the source will remain 
hidden.  If you are having trouble getting rid of a virus you should 
treat any files "protected" by this product with extreme suspicion.

In investigating this we re-examined samples we had collected from a 
shop having virus like problems.  At the time we did not know about 
this product (which had been added by the proprietors son, without 
permission), and assumed it was causing the problems.  However when 
we looked at the files again we found that Padded virus was hiding 
behind the Carmel software.  Neither McAfee Scan nor Dr. Solomon's 
Toolkit can find the virus in these files. 

We know of two strains of this product, and have added signatures 
for them to VET 7.11.  This will flag affected files as "Packed with 
CPAV anti-virus."  

Roger Riordan                     riordan.cybec@tmxmelb.mhs.oz.au

CYBEC Pty Ltd.                                 Tel: +613 521 0655
PO Box 205, Hampton Vic 3188   AUSTRALIA       Fax: +613 521 0727
From: ctwilson@rock.concert.net (Charles T Wilson -- Personal Account)
Newsgroups: comp.virus
Subject: Re: Vshield vs Virstop (PC)
Date: 15 Dec 92 01:02:59 GMT

chess@watson.ibm.com (David M. Chess) writes:
>> From:    mcafee@netcom.com (McAfee Associates)
>
>> Isn't VIRSTOP a program by IBM for internal use by IBM employees only?
>
>No, you're thinking of VSTOP, which is used internally in IBM, and is
>also available to people who buy the IBM Anti-Virus Service Offering.
>The most recent incarnation of this code is as the DOS Session Shield
>component of IBM AntiVirus/DOS and IBM AntiVirus/2 (it's no longer
>called "VSTOP" there).
>
>VIRSTOP is something else, I'm not sure exactly what.

Virstop is part of the F-Prot package..

- -- 
/-------------------------------------------------------------------------\
|  Tom Wilson                      |                                      |
|  ctwilson@rock.concert.net       |                                      |
|                                  |                                      |
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: using %VARIABLE% with scan (PC)
Date: 11 Dec 92 21:56:59 GMT

craig@cadzook.columbiasc.NCR.COM (Craig.Williamson) writes:

> OK here is what I am trying to do:

> SET NETDRV=x:
> scan c: d: e: /date/report %NETDRV%\vir_rep

> The %NETDRV% is not getting replaced with x: like it should.

Hmm... Very strange... It -should- work... What does %NETDRV% get
replaced with? What DOS version are you using? What command
interpreter (COMMAND.COM/4DOS)? In any case, it is not a problem of
SCAN; it is a problem of the operating environment you are using...

[Moderator's note: I agree that this appears to be a problem with the
operating environment, and I'd like to request that follow-ups get
handled via e-mail, with the exception of a follow-up summary of the
solution (if anyone cares to post one).]

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: CARMEL Software (PC)
Date: 11 Dec 92 21:29:27 GMT

Final note - I was just looking at the memory after executing Central
Point Anti-Virus dated 6-15-92 (CPAV.EXE) and found the following 
strings:

"Central Point Anti-Virus...Authors: Eli Shapira...Yuval Sherman",
"CARMEL", "Anti-Virus Version 1.3", "CARMEL Software".

Well, Lotus used to have SMURF so why not.

					Warmly,
						Padgett
From: MEWETT@qut.edu.au
Newsgroups: comp.virus
Subject: RE: info on cansu virus (PC)
Date: 17 Dec 92 13:49:17 GMT


	RE: information on the 'Cansu' virus

Recently, we have had an outbreak of the 'Cansu' or 'V-sign' virus around the
Brisbane (Australia) area, and I would greatly appreciate any information on 
this virus, as any published inforamtion seems rather scarce.

	Sincerely Scott Mewett

Scott Mewett
Information Security Research Centre
Queensland University of Technology
e-mail:  mewett@qut.edu.au
FAX:     (07) 221 2384
Phone:   (07) 864 2095

Remember for complete virus protection...

1) don't buy a computer
2) if you do buy a computer, don't turn it on
From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: Re: VSHIELD, VIRSTOP, ... comparison ? (PC)
Date: 16 Dec 92 22:50:52 GMT

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:

>2) VShield can scan a file while it is being copied. VirStop does not
>have such a feature yet, although Frisk is promising it since a long
>time.

I have it working on my desk now...needs a bit of testing, though, but I hope
to be able to include this feature in 2.07.

>amount of memory used. This slows down the loading of the programs.
>VirStop does not have such an option (although Frisk intends to
>implement it), but then the memory requirements for VirStop are much
>more modest.

Uh, not correct.  VirStop CAN swap its signatures out to disk (with the /DISK)
switch, in which case the memory requirements drop down to 2K or so.

- -frisk
From: MICKLE@csmcmvax.bitnet (Dave Mickle x5205)
Newsgroups: comp.virus
Subject: Anyone have experience with XTree's VIRUSAFE 4.5? (PC)
Date: 10 Dec 92 23:44:37 GMT

I'm looking at purchasing a site license for a virus scanner in the
immediate future.  I am familiar with VIRUSCAN and F-PROT.  Can anyone
report on their experience with XTree's VIRUSAFE V4.5?

[Moderator's note: I'd suggest that you start by taking a look at
Chris McDonald's review, which is available by anonymous FTP from
cert.org:/pub/virus-l/docs/reviews/pc/mcdonald.virusafe]

- -----------------------------------------------------------------------------
- ----David K. Mickle                  "As soon as I pressed the red button, I
- ----if   !(BITNET) MICKLE@CSMCMVAX    realized I had made a terrible mistake."
- ----then  (VOICE)  310 855-5205         -Dr. who pressed the UNMARKED power
- ----else  (FAX)    310 967-0112          kill switch for the computer room.
- ----while (Cedars-Sinai Medical Center, Los Angeles, CA  USA)
- -----------------------------------------------------------------------------
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: Vshield vs Virstop (PC)
Date: 11 Dec 92 22:20:34 GMT

mcafee@netcom.com (McAfee Associates) writes:

> as789@cleveland.Freenet.Edu (Francisco J. Diaz) writes:
> >Hi All! I have a small question, Which antivirus TSR would you
> >recommend me to use? Vshield or Virstop? I have seen them both but the

> Isn't VIRSTOP a program by IBM for internal use by IBM employees only?

I guess, he is referring to the resident scanner called VIRSTOP.EXE
from the F-Prot package. BTW, the IBM product is not "internal use
only" any more; they have released it as a commercial (but cheap)
product.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: tck@fold.ucsd.edu (Kevin Marcus)
Newsgroups: comp.virus
Subject: Re: Is this a new virus? (PC)
Date: 17 Dec 92 02:57:17 GMT

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
>tck@fold.ucsd.edu (Kevin Marcus) writes:
>
>> trinh@camins.camosun.bc.ca writes:
>> >[description of a typical Stoned+Michelangelo problem deleted]
>
>> It looks like you had a multiple infection.  Stoned and it's varients
>> (Michelangelo is one...) don't always copy the MBR to the same spot.
>
>No, the problem is cause by exactly the opposite - both Stoned and
>Michelangelo copy the MBR to exactly one and the same spot (on the
>hard disk), which results in the original MBR being lost.

I have varients of stoned which copy to 0,0,15, and 0,0,7, as well as a
few other locations.  They do not necessarily copy to the same spot.


- -- 
|| Kevin Marcus, Computer Virologist.  (619)/457-1836; RE-xxx, TSCAN       ||
|| INET: tck@bend.ucsd.edu       []-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]-[]
||       tck@fold.ucsd.edu       || All I wanted was a Pepsi...            ||
||       datadec@watserv.ucr.edu ||       And she wouldn't give it to me...||
From: Nemrod_Kedem@f101.n9721.z9.virnet.bad.se (Nemrod Kedem)
Newsgroups: comp.virus
Subject: Re: Filler virus (PC)
Date: 13 Dec 92 00:53:00 GMT


 >         Scan 99 detected "Filler" active in the memory of my computer.
 > When I booted from a write-protected floppy the nasty virus was not
 > found, no matter how many times I tried.  By the way, I have CPAV
 > constantly running and it did not detect anything wrong.
 >         Does anybody know anything about Filler ?
 >         What can I do to get rid of the virus ?

CPAV is known to cause SCAN to false alarm on some viruses. CPAV does
not encrypt it's search strings and these that match McAfee's strings
cause it to detect CPAV as a virus.

Nemrod Kedem,
Authorized Agent of McAfee Associates.

- --- FastEcho 1.21/Real!
 * Origin: <Rudy's Place - VirNet, Israel> Make Safe Hex! (9:9721/101)
From: mcafee@netcom.com (McAfee Associates)
Newsgroups: comp.virus
Subject: Generic detection of Boot Sector/MBR viruses (was Re: Is this a real virus?) (PC)
Date: 16 Dec 92 19:24:03 GMT

Good morning Vesselin,

You wrote:
>Ah, this explains the "Generic Boot Virus" report... It seems to me
>that SCAN is using some kind of heuristics (Aryeh?) and reports a
>"generic" boot (or partition) virus each time when something seems
>wrong with the boot sector(s) - like missing names of the hidden DOS
>files, missing signature (0AA55h), etc. In your case the whole
>contents of the boot sector has been destroyed, so its contents has
>become obviously "abnormal". This has triggered SCAN's heuristics
>(just a wild guess; I'm not certain that it is indeed so).

The Generic Boot Sector and Master Boot Record (partition table) virus
detection routines are actually looking for several common instructions 
that appear over and over again in different viruses such as Stoned, 
Joshi, and so forth.  By looking for these, we can detect variants/new
viruses based on older viruses.

The Generic Boot Sector/MBR code is not doing a "fitness check" to see
if the partition table (the actual data) or 55 AA signature is valid,
since those would not neccessarily be due to a virus infection (e.g.,
could be an unformatted drive).  Likewise, we don't do a filename check
since that could cause false positives with non-DOS operating systems 
such as Unix and OS/2.

Regards,

- -- 
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
McAfee Associates, Inc.  | Voice (408) 988-3832 | INTERNET:
3350 Scott Blvd, Bldg 14 | FAX   (408) 970-9727 | mcafee@netcom.COM
Santa Clara, California  | BBS   (408) 988-4004 | CompuServe ID: 76702,1714
95054-3107  USA          | USR HST Courier DS   | or GO MCAFEE
Support for SENTRY/SCAN/NETSCAN/VSHIELD/CLEAN/WSCAN/NETSHIELD/TARGET/CONFIG MGR