From: Kenneth R. van Wyk (The Moderator) Errors-To: krvw@CERT.SEI.CMU.EDU To: VIRUS-L@IBM1.CC.LEHIGH.EDU Path: cert.sei.cmu.edu!krvw Subject: VIRUS-L Digest V5 #48 Reply-To: VIRUS-L@IBM1.CC.LEHIGH.EDU -------- VIRUS-L Digest Monday, 2 Mar 1992 Volume 5 : Issue 48 Today's Topics: Introduction to the Anti-viral archives, listing of 02 March 1991 Archive access without anonymous ftp, last changed 30 June 1991 Brief guide to files formats, last changed 11 February 1992 Apple II Anti-viral archive sites, last changed 13 November 1991 Amiga Anti-viral archive sites, last changed 13 November 1991 Atari ST Anti-viral archive sites, last changed 13 November 1991 Anti-viral Documentation archive sites, last changed 13 November 1991 IBMPC Anti-viral archive sites, last changed 06 January 1992 Macintosh Anti-viral archive sites, last changed 13 November 1991 Unix Anti-viral and security archive sites, last changed 30 June 1991 VIRUS-L is a moderated, digested mail forum for discussing computer virus issues; comp.virus is a non-digested Usenet counterpart. Discussions are not limited to any one hardware/software platform - diversity is welcomed. Contributions should be relevant, concise, polite, etc. (The complete set of posting guidelines is available by FTP on cert.sei.cmu.edu or upon request.) Please sign submissions with your real name. Send contributions to VIRUS-L@IBM1.CC.LEHIGH.EDU (that's equivalent to VIRUS-L at LEHIIBM1 for you BITNET folks). Information on accessing anti-virus, documentation, and back-issue archives is distributed periodically on the list. Administrative mail (comments, suggestions, and so forth) should be sent to me at: krvw@CERT.SEI.CMU.EDU. Ken van Wyk ---------------------------------------------------------------------- Date: Mon, 02 Mar 92 08:58:35 -1000 From: Jim Wright Subject: Introduction to the Anti-viral archives, listing of 02 March 1991 Introduction to the Anti-viral archives, listing of 02 March 1991 This posting is the introduction to the "official" anti-viral archives of VIRUS-L/comp.virus. With the generous cooperation of many sites throughout the world, we are attempting to make available to all the most recent news and programs for dealing with the virus problem. Currently we have sites for Amiga, Apple II, Atari ST, IBMPC, Macintosh and Unix computers, as well as sites carrying research papers and reports of general interest. If you have general questions regarding the archives, you can send them to this list or to me. I'll do my best to help. If you have a submission for the archives, you can send it to me or to one of the persons in charge of the relevant sites. If you have any corrections to the lists, please let me know. The files contained on the participating archive sites are provided freely on an as-is basis. To the best of our knowledge, all files contained in the archives are either Public Domain, Freely Redistributable, or Shareware. If you know of one that is not, please drop us a line and let us know. Reports of corrupt files are also welcome. PLEASE NOTE The Managers of these systems, and the Maintainers of the archives, CAN NOT and DO NOT guarantee any of these applications for any purpose. All possible precautions have been taken to assure you of a safe repository of useful tools. Jim Wright jwright@cfht.hawaii.edu JWRIGHT@UHCFHT ------------------------------ Date: Mon, 02 Mar 92 08:59:06 -1000 From: Jim Wright Subject: Archive access without anonymous ftp, last changed 30 June 1991 Archive access without anonymous ftp, last changed 30 June 1991 To get files from the anti-viral archives, you do not need access to anonymous ftp. (However, anonymous ftp is generally the preferred method.) Below is information on accessing the archive sites using only email. -=- One way to get access to the archives is through the BITFTP server at Princeton. Send a message to the BITNET address is BITFTP@PUCC with the body of the message containing the single word HELP. This should get you more information, and give you access to any archive site on the Internet. Due to excessive loads, this service has been restricted to BITNET and EARN sites only. UUCP sites need not apply. -=- Both the AppleII and the Atari ST archives have mail servers which provide access to their archives. You may receive automatic updates of Macintosh anti-viral programs via email. See the individual articles on these sites. -=- You may also retrieve files from the SIMTEL-20 and the INFO-MAC archives by using one of the many mail servers which maintain a shadow archive of these sites. Send the following message to one of the listserv sites. help See the IBMPC and Macintosh articles for a complete list of servers. ------------------------------ Date: Mon, 02 Mar 92 08:59:38 -1000 From: Jim Wright Subject: Brief guide to files formats, last changed 11 February 1992 Brief guide to files formats, last changed 11 February 1992 -- The most recent copy of the complete text may be anonymous ftp'd -- -- from ux1.cso.uiuc.edu (128.174.5.59) in the directory doc/pcnet. -- -- That file is maintained by David Lemson (lemson@uiuc.edu). -- -- Please do not strip this note from this list when passing it on. -- ARC (.arc) This format is most popular on PCs. Compresses and stores multiple files in a single archive. PC - arc 6.02, pk361 Mac - ArcMac 1.3c Unix - arc 5.21 VM/CMS - arcutil Amiga - Arc 0.23, PKAX VMS - arcvms Apple2 - dearc Atari - arc 5.21b, pkunarc OS/2 - arc2 ARJ (.arj) ARJ is a new archive format for DOS. Compresses and stores multiple files in a single archive. The author is Robert K Jung, robjung@world.std.com. PC - arj 2.30 (arj230.exe) Unix - unarj 2.30 BinHex (.hqx) A Macintosh format. Converts a binary Mac file, including data and resource forks, into an archive of only printing ASCII characters. Note that BinHex4.0 will create and decode the ASCII hqx encoding used on Usenet, while BinHex5.0 will decode the ASCII hqx encoding but will create a non-ASCII binary file. PC - xbin 2.3 Mac - BinHex4.0, BinHex5.0 Unix - mcvert VM/CMS - binhex binscii ( ) A favorite Apple2 file transmission format. Similar to uu{en,de}code except it can handle multiple files in a single package. Apple2 - binscii Compactor (.cpt) A new Macintosh format. Compresses and stores multiple files in a single archive. Mac - Compactor1.21 compress (.Z) A Unix format. Compresses a single file in an archive. PC - u16, comprs16, comp430d Mac - MacCompress3.2A Unix - compress VM/CMS - compress Amiga - compress VMS - lzcomp Apple2 - compress Atari - compress Disk Masher (.dms) This is an Amiga format. Compresses and stores an entire floppy in a single archive. Amiga - DMS LHarc (.lzh) This format originated on PCs, and is now popular on Amigas. Compresses and stores multiple files in a single archive. PC - lha 2.13 (lha213.exe) Mac - MacLHarc 0.41 Unix - lharc10 Amiga - LHarc 1.21 Atari - lharc113 LHWarp (.lzw) This is an Amiga format. Compresses and stores an entire floppy in a single archive. Better compression than plain Warp. Amiga - Lhwarp LU (.lbr) This is an old format that originated with CP/M. It is virtually non-existent now. Collects multiple files into a single archive with no compression. PC - lue220 Mac - ArcMac 1.3c Unix - lar VM/CMS - arcutil VMS - vmssweep MSX (.msx) A new format for CP/M machines. Is also able to extract lharc archives. CP/M - PMARC and PMEXT nupack ( ) A favorite Apple2 archive format. Apple2 - nupack PackIt (.pit) An old Macintosh format. Compresses and stores multiple files in a single archive. PC - UnPackIt 1.0 Mac - PackIt3.1.3 Unix - unpit PAK (.pak) An old PC format. Compresses and stores multiple files in a single archive. Also the name of an Amiga format which produces self-extracting archives. Also the name of a new PC format. PC - PAK 2.51 Unix - arc 5.21 Amiga - PAK 1.0 shell archive (.shar, .sh) A Unix format. Stores multiple files in a single archive without compression. PC - unshar Mac - UnShar2.0 Unix - sh, unshar Amiga - UnShar Apple2 - unshar Atari - shar ShrinkIt ( ) A favorite Apple2 archive format. Apple2 - ShrinkIt Squeeze (._Q_) An old PC (CP/M?) format. Compresses and stores multiple files in a single archive. PC - sqpc131 VM/CMS - arcutil Amiga - Sq.Usq VMS - vmsusq Atari - ezsqueeze StuffIt (.sit) A Macintosh format. Compresses and stores multiple files in a single archive. PC - mactopc, UnStuffit 1.0 Mac - StuffIt 1.6 Unix - unsit Amiga - unsit tape archive (.tar) A Unix format. Stores multiple files in a single archive without compression. PC - tar, tarread, pax, pdtar Mac - UnTar2.0 Unix - tar, GNU tar Amiga - TarSplit, pax VMS - vmstar Atari - sttar uuencode (.uu, .uue) A Unix format. Converts a binary file into an archive of only printing ASCII characters suitable for mailing. PC - uuxref20 Mac - UMCP-Tools1.0 Unix - uuencode, uudecode VM/CMS - arcutil Amiga - uuencode, uudecode VMS - uudecode2. Apple2 - uu.en.decode Warp (.wrp) This is an Amiga format. Compresses and stores an entire floppy in a single archive. Amiga - WarpUtil xxencode (.xx, .xxe) A Unix format. Converts a binary file into an archive of only printing ASCII characters suitable for mailing. Solves many of the problems of uuencode. PC - uuxref20 Unix - xxencode, xxdecode VM/CMS - xxencode ZIP (.zip) This format is most popular on many systems. Compresses and stores multiple files in a single archive. PC - PKZIP/PKUNZIP 1.10, pkz110, unzip 4.10, zip 1.0 Mac - UnZip1.02c Unix - unzip 4.10, zip 1.0 VM/CMS - arcutil 2.0 (uncompress only) Amiga - PKAZip 1.01, unzip 4.10 Atari - STZip 0.9 beta VMS - unzip 4.10, zip 1.0 OS/2 - PKZIP/PKUNZIP 1.02, pkz102-2.exe, unzip 4.10, zip 1.0 ZOO (.zoo) This format is popular on USENET. Compresses and stores multiple files in a single archive. PC - zoo 2.10 Mac - MacBooz2.1 Unix - zoo 2.10 VM/CMS - zoo Amiga - zoo 2.10 VMS - zoo 2.10 Atari - zoo 2.10 OS/2 - zoo 2.10 ZOOM (.zom) This is an Amiga format. Compresses and stores an entire floppy in a single archive. Not in common use due to program speed. Amiga - zoom ------------------------------ Date: Mon, 02 Mar 92 09:00:41 -1000 From: Jim Wright Subject: Apple II Anti-viral archive sites, last changed 13 November 1991 Apple II Anti-viral archive sites, last changed 13 November 1991 brownvm.bitnet Chris Chung Access is through LISTSERV, using SEND, TELL and MAIL commands. Files are stored as apple2-l xx-xxxxx where the x's are the file number. uk.ac.lancs.pdsoft Steve Jenkins Terminals : call lancs.pdsoft, login as "pdsoft", password "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", password "pdsoft". Anonymous ftp : IP number 148.88.64.2 user "ftp", password "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. ------------------------------ Date: Mon, 02 Mar 92 09:00:10 -1000 From: Jim Wright Subject: Amiga Anti-viral archive sites, last changed 13 November 1991 Amiga Anti-viral archive sites, last changed 13 November 1991 ab20.larc.nasa.gov Tad Guy This site can be reached through anonymous ftp. The Amiga anti-viral archives can be found in the /amiga/utilities/virus/ and /incoming/amiga/ directories. The IP address is 128.155.23.64. beach.gal.utexas.edu John Perry This site can be reached through anonymous ftp. The Amiga anti-viral archives can be found in the directory [ANONYMOUS.PUB.VIRUS.AMIGA]. This system is running VMS, not Unix. The IP address is 129.109.1.207. ms.uky.edu Sean Casey Access is through anonymous ftp. The Amiga anti-viral archives can be found in /pub/amiga/Antivirus. The IP address is 128.163.128.6. uk.ac.lancs.pdsoft Steve Jenkins Terminals : call lancs.pdsoft, login as "pdsoft", password "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", password "pdsoft". Anonymous ftp : IP number 148.88.64.2 user "ftp", password "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. ------------------------------ Date: Mon, 02 Mar 92 09:01:12 -1000 From: Jim Wright Subject: Atari ST Anti-viral archive sites, last changed 13 November 1991 Atari ST Anti-viral archive sites, last changed 13 November 1991 atari.archive.umich.edu Jeff Weiner Service via FTP and mail, FTP preferred. Login as "anonymous", password is your mail address. For instructions on the mail server, send the message help to "Index" contains complete listing with descriptions. "CompInd.Z" contains same list but is compressed. "ls-lR.Z" contains compressed ls -lR listing. All anti-viral material is contained in ~atari/utilities/virus The IP number for this site is 141.211.164.8, but may change. twitterpater.Eng.Sun.COM Steve Grimm Access to the archives is through mail server. For instructions on the archiver server, send help to uk.ac.lancs.pdsoft Steve Jenkins Terminals : call lancs.pdsoft, login as "pdsoft", password "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", password "pdsoft". Anonymous ftp : IP number 148.88.64.2 user "ftp", password "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. ------------------------------ Date: Mon, 02 Mar 92 09:01:44 -1000 From: Jim Wright Subject: Anti-viral Documentation archive sites, last changed 13 November 1991 Anti-viral Documentation archive sites, last changed 13 November 1991 cert.sei.cmu.edu Kenneth R. van Wyk Access is available via anonymous ftp, IP number 192.88.209.5. This site maintains archives of all VIRUS-L digests, all CERT advisories, as well as a number of informational documents. VIRUS-L/comp.virus information is in: pub/virus-l/archives pub/virus-l/archives/predig pub/virus-l/archives/1988 pub/virus-l/archives/1989 pub/virus-l/archives/1990 pub/virus-l/docs CERT information is in: pub/cert_advisories pub/cert-tools_archive csrc.ncsl.nist.gov John Wack This site is available via anonymous ftp, IP number 129.6.54.11. The archives contain all security bulletins issued thus far from incident response teams (CERT, CIAC, FIRST members). It also contains many security-related publications and resource informa- tion about viruses and other threats, as well as archives of VIRUS_Ls and RISK forums. The NIST computer security BBS is also accessible from this system by logging in to account 'bbs'. lehiibm1.bitnet Ken van Wyk new: This site has archives of VIRUS-L, and many papers of general interest. Access is through ftp, IP address 128.180.2.1. The directories of interest are VIRUS-L and VIRUS-P. uk.ac.lancs.pdsoft Steve Jenkins Terminals : call lancs.pdsoft, login as "pdsoft", password "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", password "pdsoft". Anonymous ftp : IP number 148.88.64.2 user "ftp", password "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. unma.unm.edu Dave Grisham This site has a collection of ethics documents. Included are legislation from several states and policies from many institutions. Access is through ftp, IP address 129.24.8.1. Look in the directory /ethics. ------------------------------ Date: Mon, 02 Mar 92 09:02:15 -1000 From: Jim Wright Subject: IBMPC Anti-viral archive sites, last changed 06 January 1992 IBMPC Anti-viral archive sites, last changed 06 January 1992 beach.gal.utexas.edu John Perry This site can be reached through anonymous ftp. The IBMPC anti-viral archives can be found in the directory [ANONYMOUS.PUB.VIRUS.PC]. The IP address is 129.109.1.207. garbo.uwasa.fi Harri Valkama This site can be reached through anonymous ftp and mail server. The IBMPC anti-viral archives can be found in pc/virus. For information on the mail server, send a message to mailserv@garbo.uwasa.fi with the subject line garbo-request and the body of the message send help The IP address is 128.214.87.1. nic.funet.fi Tapio Keih{nen This site (in Finland) can be reached through anonymous ftp. The IBMPC anti-viral archives are in directory /pub/msdos/utilities/trojan-pro The IP address is 128.214.6.100. risc.ua.edu James Ford This site can be reached through anonymous ftp. The IBM-PC anti-virals can be found in pub/ibm-antivirus. Uploads to pub/00uploads. Uploads are screened. Requests to JFORD@UA1VM.BITNET for UUENCODED files will be filled on a limited basis as time permits. The IP address is 130.160.4.7. uk.ac.lancs.pdsoft Steve Jenkins Terminals : call lancs.pdsoft, login as "pdsoft", password "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", password "pdsoft". Anonymous ftp : IP number 148.88.64.2 user "ftp", password "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. urvax.urich.edu Claude Bersano-Hayes This site can be reached through anonymous ftp. The IBM-PC anti-virals can be found in [MSDOS.ANTIVIRUS]. The IP address is 141.166.1.6. ux1.cso.uiuc.edu Mark Zinzow This site can be reached through anonymous ftp. The IBMPC anti-viral archives are in /pc/virus. The IP address is 128.174.5.59. wsmr-simtel20.army.mil Keith Peterson Direct access is through anonymous ftp, IP 192.88.110.20. The anti-viral archives are in PD1:. Please get the file 00-INDEX.TXT and review it offline. NOTE: There are also a number of servers which provide access to the archives at simtel. WSMR-SIMTEL20.Army.Mil can be accessed using LISTSERV commands from BITNET via LISTSERV@NDSUVM1, LISTSERV@RPIECS and in Europe from EARN TRICKLE servers. Send commands to TRICKLE@ (for example: TRICKLE@AWIWUW11). The following TRICKLE servers are presently available: AWIWUW11 (Austria), BANUFS11 (Belgium), DKTC11 (Denmark), DB0FUB11 (Germany), IMIPOLI (Italy), EB0UB011 (Spain) and TREARN (Turkey). ------------------------------ Date: Mon, 02 Mar 92 09:02:46 -1000 From: Jim Wright Subject: Macintosh Anti-viral archive sites, last changed 13 November 1991 Macintosh Anti-viral archive sites, last changed 13 November 1991 beach.gal.utexas.edu John Perry This site can be reached through anonymous ftp. The Macintosh anti-viral archives can be found in thee directory [ANONYMOUS.PUB.VIRUS.MAC]. This system is running VMS, not Unix. The IP address is 129.109.1.207. dftnic.gsfc.nasa.gov Brian Lev This site offers the "MacSecure" package, made up of John Norstad's Disinfectant, and a pair of locally developed HyperCard stacks: Joe McMahon's "Anti-Viral Doc" and Brian Lev's "MacHelper". Floppy disk: Advanced Data Flow Technology Office Code 930.4 Goddard Space Flight Center Greenbelt, MD 20771 (Attn: Brian Lev) DECnet Copy from DFTNIC::CLDATA:[ANONYMOUS_FTP.FILES.MAC] BinHex (ASCII) format as MACSECURE31.HQX binary format as MACSECURE31.SEA Anonymous FTP from DFTNIC.GSFC.NASA.GOV (128.183.10.3) BinHex (ASCII) format as [.FILES.MAC]MACSECURE31.HQX binary format as [.FILES.MAC]MACSECURE3.SIT ifi.ethz.ch Danny Schwendener Interactive access through DECnet (SPAN/HEPnet): $SET HOST 57434 or $SET HOST AEOLUS Username: MAC Interactive access through X.25 (022847911065) or Modem 2400 bps (+41-1-251-6271): # CALL B050 Username: MAC Files may also be copied via DECnet (SPAN/HEPnet) from 57434::DISK8:[MAC.TOP.LIBRARY.VIRUS] rascal.ics.utexas.edu Werner Uhrig Access is through anonymous ftp, IP number is 128.83.138.20. Archives can be found in the directories mac/virus-catchers and mac/virus-docs. scfvm.bitnet Joe McMahon Access is via LISTSERV. SCFVM offers an "automatic update" service. Send the message AFD ADD VIRUSREM PACKAGE and you will receive updates as the archive is updated. You can also subscribe to automatic file update information with FUI ADD VIRUSREM PACKAGE sumex-aim.stanford.edu Bill Lipa Access is through anonymous ftp, IP number is 36.44.0.6. Archives can be found in /info-mac/virus. Administrative queries to . Submissions to . There are a number of sites which maintain shadow archives of the info-mac archives at sumex: * MACSERV@PUCC services the Bitnet community * LISTSERV@RICE for e-mail users * FILESERV@IRLEARN for folks in Europe uk.ac.lancs.pdsoft Steve Jenkins Terminals : call lancs.pdsoft, login as "pdsoft", password "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", password "pdsoft". Anonymous ftp : IP number 148.88.64.2 user "ftp", password "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. wsmr-simtel20.army.mil Robert Thum Access is through anonymous ftp, IP number 192.88.110.20. Archives can be found in PD3:. Please get the file 00README.TXT and review it offline. ------------------------------ Date: Mon, 02 Mar 92 09:03:17 -1000 From: Jim Wright Subject: Unix Anti-viral and security archive sites, last changed 30 June 1991 Unix Anti-viral and security archive sites, last changed 30 June 1991 funic.funet.fi Jyrki Kuoppala Accessible through anonymous ftp, IP number 128.214.6.100. Directory pub/unix/security contains programs to help in security, pub/doc/security contains various documents about security in general and unix security (like the worm documents) wuarchive.wustl.edu Chris Myers Accessible through anonymous ftp, IP number 128.252.135.4. A number of directories can be found in ~ftp/usenet/comp.virus/*. ------------------------------ End of VIRUS-L Digest [Volume 5 Issue 48] *****************************************