From: frisk@complex.is (Fridrik Skulason)
Newsgroups: comp.virus
Subject: FP-203.ZIP - Virus detection/removal/prevention/information
Date: 4 Apr 92 23:16:00 GMT
Organization: Lehigh University

I just uploaded version 2.03 of my F-PROT anti-virus package to SIMTEL20.

[Moderator's note: See follow-up 2.03A posting below!]

pd1:<msdos.trojan-pro>
FP-203.ZIP      Virus detection/removal/prevention/information

Version 2.03 - major changes:

  The program can now scan inside PKLITE (1.03, 1.1 and 1.13), LZEXE, EXEPACK
  and ICE-packed files.

  A list of all viruses that are found is now displayed while the program
  is running in interactive mode, instead of just being displayed
  afterwards.

Version 2.03 - corrections:

  If F-PROT 2.02 was run with just the /HELP option, it might leave the
  cursor turned off on certain types of display adapters - fixed.

  User-specified file extensions were saved correctly to the setup file,
  but not restored the next time the program was run - fixed.

  The rewrite of the virus scanner engine in version 2.02 resulted in some
  false positives, and the search patterns have now been changed as
  necessary.  The following false positives were reported and corrected:

      "Possibly a new variant of Sylvia" in TUTOR.COM (Word Perfect 4.2)
      "Shirley" (Quick Scan), in DIET 1.10A overlay-mode compressed files.
      "SBC" in several small EXE files.
      "Yaunch" (Quick Scan) in several programs.
      "AIDS" in a few programs from Personal Bibliographic Software

  The program also no longer reports certain files from Central Point
  Software as Flip-infected - it seems the programmers there used the same
  signature string as F-PROT uses, but they did not encrypt it.

  The command BREAK=ON could sometimes cause F-PROT to crash - fixed.

  F-PROT might not return the correct return code (ERRORLEVEL), when it
  found a boot sector virus, unless the virus was active in memory.

  Quick Scan would leave the name of the last file scanned on the screen,
  even if it was not infected - fixed.

  2.02 produced an ugly error message if it attempted to scan a .SYS file
  under Netware, which was in use by another program - now it simply says
  "Error opening ......"

  When operating in command line mode on old IBM XT's with monochrome or
  CGA adapters, the program sometimes produced unexpected characters on
  the screen - fixed.

Version 2.03 - minor improvements:

  The /TROJAN command-line switch is now default, instead of /NOTROJAN.

  Primary names are now highlighted in the virus list.

  The following command-line switches have been added:

      /PACKED  (default) scan inside packed files.
      /NOPACKED          don't scan packed files.
      /NOSUB             don't scan subdirectories.

  The set of default extensions now includes OV? instead of OVR and OVL.

  Long lines (>80 chars) in the scan report now wrap properly.

  The heuristic analysis did not identify files that had been compressed
  with OPTLINK, but instead reported them as moving around in memory in a
  suspicious way.

  If the /REPORT command-line switch is used, and the report file already
  exists, the new report will be appended to the previous one.

  The F-TEST.COM program is now included again - see VIRSTOP.DOC for
  details.

Version 2.03 - new viruses:

  The following 81 new viruses can now be detected and removed.

      _1355 (temporary name)
      Ada
      Alabama
      Ambulance-B
      AT (132, 144B and 149)
      Black Jec (3B, 5B, 7B and 9B)
      Cascade (1701-F and 1706)
      Criminal
      Danish Tiny-251
      Dutch Tiny-126
      Enola
      Fichv-2.0
      Frogs-1550-B
      Gliss
      Grune
      Harakiri [overwriting - cannot be disinfected]
      Hafenstrasse-1689
      Horse Boot
      Itti-(99 and 161) [overwriting - cannot be disinfected]
      Jabberwocky-615
      Japanese Christmas-Cookie
      Jerusalem (1244, 1735, 1767, 2187, Anticad-3088, Barcelona,
                 Moctezuma, Nov 30., Skism11, Skism12 and Sub-Zero)
        Kalah
      KO-408
      Leprosy (C2 and Viper) [overwriting - cannot be disinfected]
      Lovechild B3
      Mannequin
      Manuel
      Mshark
      Murphy-5
      Nines Complement
      Null-178
      Padded
      Pixel-Pixie 1.0
      Portugese-1441
      Quiet
      Screamer
      Seventh son (284 and 350)
      Smiley
      Suriv 1-Argentina
      Tic
      Timid (305 and 306)
      Traceback-3029
      Trivial-38
      Troy
      Vienna (618, 621, 644B, 645B, Infinity, Mob 1a, Parasite, Parasite 2B,
              Viperize and W-13 534-B)
      Violetta
      Void Poem
      We're here
      Wonder
      Yafo

  The following 39 new viruses can now be detected but not removed.

      _5792 [temporary name]
      Cannabis
      CAZ
      Compiler (1 and 2)
      Cooki (7360 and7392)
      Danish Tiny-Stigmata
      Demolition
      DM-330
      Eliza
      EUPM
      Flip (2153-B,2153-C,2153-D)
      Forger
      Freew-692
      Halloween
      Helloween
      Horror
      Intruder
      Keydrop
      Kremikov
      LV 1.2
      Marauder
      MtE (Dedicated, Fear and Pogue)
      Murphy-Tormentor
      Nov. 17th
      Pathhunt
      Peach
      Phalcon-Ministry
      RNA2
      SBC
      TV
      Vienna-Dr. Q 1028
      Virus-9
      XPEH

  The following 5 viruses that could be detected but not removed with
  earlier versions of F-PROT can now be disinfected.

      Cascade-1661
      Justice
      Pregnant
      Rage
      Stardot-600

  The following 6 "viruses" are now detected/identified.  They don't
  work at all, due to serious internal errors, but the reason I bother to
  detect them is because they are included in some "virus collections",
  which are used for comparative reviews, and some of my competitors
  detect them already.

      Bad Brains
      Int 80
      Scorpio
      Sylvia (Hong Kong and Kranz)
      Trivial-25

The Following families have been combined:

        Denzuko, Ohio, Mardi Bros -Denzuko family
      Number One and AIDS -Number One family

frisk
- - -
Fridrik Skulason
frisk@complex.is