From: WALKER@aedc-vax.af.mil (William Walker C60223 x4570)
Newsgroups: comp.virus
Subject: Re: victor charlie (PC)
Date: 28 Jul 92 19:55:09 GMT

From:    mebrown@hubcap.clemson.edu (Miriam E Brown)
> Has anyone ever used Victor Charlie and have any opinions?

Victor Charlie (VC) is the anti-virus package produced by Bangkok
Security Associates (BSA) of Thailand.  While I have not used it, I
understand that it is fairly good.  HOWEVER, BSA has been dabbling in
some activities that many anti-virus researchers call unethical, and I
personally recommend NOT using VC as a form of protest against this
behavior (notice: this is my opinion).

At the International Virus Prevention Conference (IVPC '92) in
Washington, D.C. last month, John DeHaven, director and chief
programmer of BSA, made a presentation on "The Virus Factory."  Not
the Bulgarian virus factory, which was what I expected, but a software
package developed by BSA to generate programs which are encrypted and
50% of which drop a slightly modified version of Jerusalem-B.  No
existing scanner can detect the virus in these files, which was their
point.  The package was developed as part of an experiment to
demonstrate that passive inspection (scanning) is inadequate.

If BSA had left it at that, it would have been fine.  However, BSA
decided to distribute sets of these generated programs.  Even though
they had set up an elaborate security system for sending the programs
to a researcher, the programs should not have been distributed at all.
A random 50% of the programs contain a LIVE (not neutralized)
Jerusalem-B virus, and none of them are detectable by existing
anti-virus software (once dropped, though, the Jerusalem-B virus IS
detectable).  BSA had set up the elaborate distribution system to
control and track distribution of these programs, but during the
presentation, Dr. Alan Solomon stated that he had received a set from
outside of this "secure" distribution channel.  I hope that Dr.
Solomon responds to this message and gives more details on the
incident as well as his opinion on the matter.

I'll agree that these particular programs are not much of a threat.
They're supposed to be stamped with the name and address of the
intended recipient, and the virus has "a one-byte alteration to
eliminate the 'bombs'...," though it can still spread.  However, I
still feel that it is unethical to distribute live viri in this
manner, particularly since they are not detectable in this form.  Of
course, this is just my opinion.  I hope others share their opinions
as well.

> We are thinking of using it opposed to McAfee's Scan and Clean.  

Have you considered Frisk's F-PROT, Dr. Solomon's Anti-Virus Toolkit,
IBM's VirScan, or Fifth Generation's Untouchable -- or some
combination?  You really should use more than one anti-virus product,
and these aren't bad.  Whatever you use, be sure that they are easy to
keep up-to-date.

The preceding comments reflect my opinions, and not those of my
employer or the Air Force.  Any errors are also mine, and are likely
to be pointed out as such.  :-)

Bill Walker ( WALKER@AEDC-VAX.AF.MIL ) |
OAO Corporation                        |   "... but as we say on Earth,
Arnold Engineering Development Center  |          c'est la vie."
M.S. 120                               |        -- James T. Kirk
Arnold Air Force Base, TN  37389-9998  |