From: ADVAX::"VIRUS-L@IBM1.CC.LEHIGH.EDU" 5-APR-1991 14:17:05.51 To: Multiple recipients of list VIRUS-L CC: Subj: VIRUS-L Digest V4 #54 Received: by ADVAX.DECnet (utk-mail11 v1.5) ; Fri, 5 Apr 91 14:13:28 EST Received: from mcnc by ge-dab.GE.COM (5.61/GE-DAB 1.15) with UUCP id AA02890 for ; Fri, 5 Apr 91 12:11:23 -0500 Received: from IBM1.CC.Lehigh.EDU by mcnc.mcnc.org (5.59/MCNC/3-21-91) id AA00780; Fri, 5 Apr 91 10:37:15 -0500 for SCOV19.DNET.ge.com!HORVATH_DB Message-Id: <9104051537.AA00780@mcnc.mcnc.org> Received: from LEHIIBM1.BITNET by IBM1.CC.Lehigh.EDU (IBM VM SMTP R1.2.2MX) with BSMTP id 0819; Fri, 05 Apr 91 10:26:56 EST Received: from LEHIIBM1.BITNET by LEHIIBM1.BITNET (Mailer R2.05) with BSMTP id 4732; Fri, 05 Apr 91 09:56:32 EST Date: Fri, 5 Apr 91 09:11:24 EST Reply-To: VIRUS-L@IBM1.CC.LEHIGH.EDU Sender: Virus Discussion List From: "The Moderator Kenneth R. van Wyk" Subject: VIRUS-L Digest V4 #54 Comments: To: VIRUS-L@IBM1.CC.LEHIGH.EDU To: Multiple recipients of list VIRUS-L VIRUS-L Digest Friday, 5 Apr 1991 Volume 4 : Issue 54 Today's Topics: Anti-viral archive sites, introduction Anti-viral archive sites, email access Summary of file formats amiga anti-viral sites apple.ii anti-viral sites atari.st anti-viral sites docs anti-viral sites ibmpc anti-viral sites mac anti-viral sites unix anti-viral sites VIRUS-L is a moderated, digested mail forum for discussing computer virus issues; comp.virus is a non-digested Usenet counterpart. Discussions are not limited to any one hardware/software platform - diversity is welcomed. Contributions should be relevant, concise, polite, etc. Please sign submissions with your real name. Send contributions to VIRUS-L@IBM1.CC.LEHIGH.EDU (that's equivalent to VIRUS-L at LEHIIBM1 for you BITNET folks). Information on accessing anti-virus, documentation, and back-issue archives is distributed periodically on the list. Administrative mail (comments, suggestions, and so forth) should be sent to me at: krvw@CERT.SEI.CMU.EDU. Ken van Wyk --------------------------------------------------------------------------- Date: Thu, 04 Apr 91 21:02:47 -1000 From: Jim Wright Subject: Anti-viral archive sites, introduction # Introduction to the Anti-viral archives... # Listing of 04 April 1991 This posting is the introduction to the "official" anti-viral archives of VIRUS-L/comp.virus. With the generous cooperation of many sites throughout the world, we are attempting to make available to all the most recent news and programs for dealing with the virus problem. Currently we have sites for Amiga, Apple II, Atari ST, IBMPC, Macintosh and Unix computers, as well as sites carrying research papers and reports of general interest. NEW: Finally, the file format listing is ready. Please send me any corrections or additions. Thanks to David Lemson (lemson@uiuc.edu) for the more complete document this one is based on. If you have general questions regarding the archives, you can send them to this list or to me. I'll do my best to help. If you have a submission for the archives, you can send it to me or to one of the persons in charge of the relevant sites. If you have any corrections to the lists, please let me know. The files contained on the participating archive sites are provided freely on an as-is basis. To the best of our knowledge, all files contained in the archives are either Public Domain, Freely Redistributable, or Shareware. If you know of one that is not, please drop us a line and let us know. Reports of corrupt files are also welcome. PLEASE NOTE The Managers of these systems, and the Maintainers of the archives, CAN NOT and DO NOT guarantee any of these applications for any purpose. All possible precautions have been taken to assure you of a safe repository of useful tools. Jim Wright jwright@cfht.hawaii.edu jwright@UHCFHT.BITNET ------------------------------ Date: Thu, 04 Apr 91 21:03:49 -1000 From: Jim Wright Subject: Anti-viral archive sites, email access # Archive access without using anonymous ftp # Last changed 07 January 1991 To get files from the anti-viral archives, you do not need access to anonymous ftp. (However, anonymous ftp is the preferred method.) Below is information on accessing the archive sites using only email. -=- One way to get access to the archives is through the BITFTP server at Princeton. Send a message to bitftp@pucc.princeton.edu (BITNET address is BITFTP@PUCC) with the body of the message containing the single word HELP. This should get you more information, and give you access to any archive site on the internet. This service seems to be greatly overloaded, so expect response times to be a little slow. -=- You may access the archives at Heriot-Watt using email. Send a message to info-server@cs.hw.ac.uk with the message text: help If you are in the U.K., then the address is info-server@uk.ac.hw.cs. -=- Both the AppleII and the Atari ST archives have mail servers which provide access to their archives. You may receive automatic updates of Macintosh anti-viral programs via email. See the individual articles on these sites. -=- You may also retrieve files from the SIMTEL-20 and the INFO-MAC archives by using one of the many mail servers which maintain a shadow archive of these sites. Send the following message to one of the listserv sites. help See the IBMPC and Macintosh articles for a complete list of servers. ------------------------------ Date: Thu, 04 Apr 91 21:04:49 -1000 From: Jim Wright Subject: Summary of file formats # Moving & Storing Files Among Dissimilar Architectures # Listing last changed 03 March 1991 -- The most recent copy of the complete text may be anonymous ftp'd -- -- from ux1.cso.uiuc.edu (128.174.5.59) in the directory doc/pcnet. -- -- That file is maintained by David Lemson (lemson@uiuc.edu). -- -- Please do not strip this note from this list when passing it on. -- ARC (.arc) This format is most popular on PCs. Compresses and stores multiple files in a single archive. PC - arc 6.00, pk361 Mac - ArcMac 1.3c Unix - arc 5.21 VM/CMS - arcutil Amiga - Arc 0.23, PKAX VMS - arcvms Apple2 - dearc Atari - arc 5.21b, pkunarc OS/2 - arc2 BinHex (.hqx) A Macintosh format. Converts a binary Mac file, including data and resource forks, into an archive of only printing ASCII characters. PC - xbin 2.3 Mac - BinHex5.0 Unix - mcvert VM/CMS - binhex binscii ( ) A favorite Apple2 archive format. Apple2 - binscii Compactor (.cpt) A new Macintosh format. Compresses and stores multiple files in a single archive. Mac - Compactor1.21 compress (.Z) A Unix format. Compresses a single file in an archive. PC - u16, comprs16, comp430d Mac - MacCompress3.2A Unix - compress VM/CMS - compress Amiga - compress VMS - lzcomp Apple2 - compress Atari - compress LHarc (.lzh) This format originated on PCs, and is now popular on Amigas. Compresses and stores multiple files in a single archive. PC - lh113c Mac - MacLHarc 0.41 Unix - lharc10 Amiga - LHarc Atari - lharc113 LHWarp (.lzw) This is an Amiga format. Compresses and stores an entire floppy in a single archive. Better compression than plain Warp. Amiga - Lhwarp LU (.lbr) This is an old format that originated with CP/M. It is virtually non-existent now. Collects multiple files into a single archive with no compression. PC - lue220 Mac - ArcMac 1.3c Unix - lar VM/CMS - arcutil VMS - vmssweep nupack ( ) A favorite Apple2 archive format. Apple2 - nupack PackIt (.pit) An old Macintosh format. Compresses and stores multiple files in a single archive. PC - UnPackIt Mac - PackIt3.1.3 Unix - unpit PAK (.pak) An old PC format. Compresses and stores multiple files in a single archive. PC - pak250 Unix - arc 5.21 Amiga - PAK 1.0 shell archive (.shar, .sh) A Unix format. Stores multiple files in a single archive without compression. PC - unshar Mac - UnShar2.0 Unix - sh, unshar Amiga - UnShar Apple2 - unshar Atari - shar Squeeze (._Q_) An old PC (CP/M?) format. Compresses and stores multiple files in a single archive. PC - sqpc131 VM/CMS - arcutil Amiga - Sq.Usq VMS - vmsusq Atari - ezsqueeze StuffIt (.sit) A Macintosh format. Compresses and stores multiple files in a single archive. PC - mactopc Mac - StuffIt 1.6 Unix - unsit Amiga - unsit tape archive (.tar) A Unix format. Stores multiple files in a single archive without compression. PC - tar, tarread, pax, pdtar Mac - UnTar2.0 Unix - tar Amiga - TarSplit, pax VMS - vmstar Atari - sttar uuencode (.uu, .uue) A Unix format. Converts a binary file into an archive of only printing ASCII characters suitable for mailing. PC - uuxref20 Mac - UMCP-Tools1.0 Unix - uuencode, uudecode VM/CMS - arcutil Amiga - uuencode, uudecode VMS - uudecode2. Apple2 - uu.en.decode Warp (.wrp) This is an Amiga format. Compresses and stores an entire floppy in a single archive. Amiga - WarpUtil xxencode (.xx, .xxe) A Unix format. Converts a binary file into an archive of only printing ASCII characters suitable for mailing. Solves many of the problems of uuencode. PC - uuxref20 Unix - xxencode, xxdecode VM/CMS - xxencode ZIP (.zip) This format is most popular on PCs. Compresses and stores multiple files in a single archive. PC - pkz110 Mac - UnZip1.02c Unix - unzip4.01 Amiga - PKAZip Atari - pkz101-2 ZOO (.zoo) This format is popular on many systems. Compresses and stores multiple files in a single archive. PC - zoo201 Mac - MacBooz2.1 Unix - zoo201 VM/CMS - zoo Amiga - amigazoo VMS - zoo201 Atari - booz OS/2 - booz ------------------------------ Date: Thu, 04 Apr 91 21:04:50 -1000 From: Jim Wright Subject: amiga anti-viral sites # Anti-viral archive sites for the Amiga # Listing last changed 03 February 1991 beach.gal.utexas.edu John Perry This site can be reached through anonymous ftp. The Amiga anti-viral archives can be found in the directory [ANONYMOUS.PUB.VIRUS.AMIGA]. This system is running VMS, not Unix. The IP address is 129.109.1.207. cs.hw.ac.uk Dave Ferbrache NIFTP from JANET sites, login as "guest". Electronic mail to . Main access is through mail server. The master index for the virus archives can be retrieved as request: virus topic: index The Amiga index for the virus archives can be retrieved as request: amiga topic: index For further details send a message with the text help The administrative address is ms.uky.edu Sean Casey Access is through anonymous ftp. The Amiga anti-viral archives can be found in /pub/amiga/Antivirus. The IP address is 128.163.128.6. uk.ac.lancs.pdsoft Steve Jenkins Service for UK only; no access from BITNET/Internet/UUCP Terminals : call lancs.pdsoft, login as "pdsoft", pwd "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", pwd "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. ux1.cso.uiuc.edu Mark Zinzow Lionel Hummel The archives are in /amiga/virus. There is also a lot of stuff to be found in the Fish collection. The IP address is 128.174.5.59. ------------------------------ Date: Thu, 04 Apr 91 21:05:21 -1000 From: Jim Wright Subject: apple.ii anti-viral sites # Anti-viral archive sites for the Apple II # Listing last changed 30 September 1989 brownvm.bitnet Chris Chung Access is through LISTSERV, using SEND, TELL and MAIL commands. Files are stored as apple2-l xx-xxxxx where the x's are the file number. cs.hw.ac.uk Dave Ferbrache NIFTP from JANET sites, login as "guest". Electronic mail to . Main access is through mail server. The master index for the virus archives can be retrieved as request: virus topic: index The Apple II index for the virus archives can be retrieved as request: apple topic: index For further details send a message with the text help The administrative address is uk.ac.lancs.pdsoft Steve Jenkins Service for UK only; no access from BITNET/Internet/UUCP Terminals : call lancs.pdsoft, login as "pdsoft", pwd "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", pwd "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. ------------------------------ Date: Thu, 04 Apr 91 21:05:52 -1000 From: Jim Wright Subject: atari.st anti-viral sites # Anti-viral archive sites for the Atari ST # Listing last changed 30 September 1989 cs.hw.ac.uk Dave Ferbrache NIFTP from JANET sites, login as "guest". Electronic mail to . Main access is through mail server. The master index for the virus archives can be retrieved as request: virus topic: index The Atari ST index for the virus archives can be retrieved as request: atari topic: index For further details send a message with the text help The administrative address is . panarthea.ebay Steve Grimm Access to the archives is through mail server. For instructions on the archiver server, send help to . uk.ac.lancs.pdsoft Steve Jenkins Service for UK only; no access from BITNET/Internet/UUCP Terminals : call lancs.pdsoft, login as "pdsoft", pwd "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", pwd "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. ------------------------------ Date: Thu, 04 Apr 91 21:06:24 -1000 From: Jim Wright Subject: docs anti-viral sites # Anti-viral archive sites for documentation # Listing last changed 04 April 1990 cert.sei.cmu.edu Kenneth R. van Wyk Access is available via anonymous ftp, IP number 128.237.253.5. This site maintains archives of all VIRUS-L digests, all CERT advisories, as well as a number of informational documents. VIRUS-L/comp.virus information is in: pub/virus-l/archives pub/virus-l/archives/predig pub/virus-l/archives/1988 pub/virus-l/archives/1989 pub/virus-l/archives/1990 pub/virus-l/docs CERT information is in: pub/cert_advisories pub/cert-tools_archive csrc.ncsl.nist.gov John Wack This site is available via anonymous ftp, IP number 129.6.48.87. The archives contain all security bulletins issued thus far from organizations such as NIST, CERT, NASA-SPAN, DDN, and LLNL-CIAC. Also, other related security publications (from NIST and others) and a partial archive of VIRUS_L's and RISK forums. cs.hw.ac.uk Dave Ferbrache NIFTP from JANET sites, login as "guest". Electronic mail to . Main access is through mail server. The master index for the virus archives can be retrieved as request: virus topic: index The index for the **GENERAL** virus archives can be retrieved as request: general topic: index The index for the **MISC.** virus archives can be retrieved as request: misc topic: index **VIRUS-L** entries are stored in monthly and weekly digest form from May 1988 to December 1988. These are accessed as log.8804 where the topic substring is comprised of the year, month and a week letter. The topics are: 8804, 8805, 8806 - monthly digests up to June 1988 8806a, 8806b, 8806c, 8806d, 8807a .. 8812d - weekly digests The following daily digest format started on Wed 9 Nov 1988. Digests are stored by volume number, e.g. request: virus topic: v1.2 would retrieve issue 2 of volume 1, in addition v1.index, v2.index and v1.contents, v2.contents will retrieve an index of available digests and a extracted list of the the contents of each volume respectively. **COMP.RISKS** archives from v7.96 are available on line as: request: comp.risks topic: v7.96 where topic is the issue number, as above v7.index, v8.index and v7.contents and v8.contents will retrieve indexes and contents lists. For further details send a message with the text help The administrative address is lehiibm1.bitnet Ken van Wyk new: This site has archives of VIRUS-L, and many papers of general interest. Access is through ftp, IP address 128.180.2.1. The directories of interest are VIRUS-L and VIRUS-P. uk.ac.lancs.pdsoft Steve Jenkins Service for UK only; no access from BITNET/Internet/UUCP Terminals : call lancs.pdsoft, login as "pdsoft", pwd "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", pwd "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. unma.unm.edu Dave Grisham This site has a collection of ethics documents. Included are legislation from several states and policies from many institutions. Access is through ftp, IP address 129.24.8.1. Look in the directory /ethics. ------------------------------ Date: Thu, 04 Apr 91 21:06:54 -1000 From: Jim Wright Subject: ibmpc anti-viral sites # Anti-viral archive for the IBMPC # Listing last changed 03 February 1991 beach.gal.utexas.edu John Perry This site can be reached through anonymous ftp. The IBMPC anti-viral archives can be found in the directory [ANONYMOUS.PUB.VIRUS.PC]. This system is running VMS, not Unix. The IP address is 129.109.1.207. cs.hw.ac.uk Dave Ferbrache NIFTP from JANET sites, login as "guest". Electronic mail to . Main access is through mail server. The master index for the virus archives can be retrieved as request: virus topic: index The IBMPC index for the virus archives can be retrieved as request: ibmpc topic: index For further details send a message with the text help The administrative address is f.ms.uky.edu Daniel Chaney This site can be reached through anonymous ftp. The IBMPC anti-viral archives can be found in /pub/msdos/AntiVirus. The IP address is 128.163.128.6. mibsrv.mib.eng.ua.edu James Ford This site can be reached through anonymous ftp. The IBM-PC anti-virals can be found in pub/ibm-antivirus. Uploads to pub/ibm-antivirus/00uploads. Uploads are screened. Requests to JFORD@UA1VM.BITNET for UUENCODED files will be filled on a limited basis as time permits. The IP address is 130.160.20.80. uk.ac.lancs.pdsoft Steve Jenkins Service for UK only; no access from BITNET/Internet/UUCP Terminals : call lancs.pdsoft, login as "pdsoft", pwd "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", pwd "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. ux1.cso.uiuc.edu Mark Zinzow This site can be reached through anonymous ftp. The IBMPC anti-viral archives are in /pc/virus. The IP address is 128.174.5.59. vega.hut.fi Timo Kiravuo This site (in Finland) can be reached through anonymous ftp. The IBMPC anti-viral archives are in /pub/pc/virus. The IP address is 130.233.200.42. wsmr-simtel20.army.mil Keith Peterson Direct access is through anonymous ftp, IP 26.2.0.74. The anti-viral archives are in PD1:. Simtel is a TOPS-20 machine, and as such you should use "tenex" mode and not "binary" mode to retrieve archives. Please get the file 00-INDEX.TXT using "ascii" mode and review it offline. NOTE: There are also a number of servers which provide access to the archives at simtel. WSMR-SIMTEL20.Army.Mil can be accessed using LISTSERV commands from BITNET via LISTSERV@NDSUVM1, LISTSERV@RPIECS and in Europe from EARN TRICKLE servers. Send commands to TRICKLE@ (for example: TRICKLE@AWIWUW11). The following TRICKLE servers are presently available: AWIWUW11 (Austria), BANUFS11 (Belgium), DKTC11 (Denmark), DB0FUB11 (Germany), IMIPOLI (Italy), EB0UB011 (Spain) and TREARN (Turkey). ------------------------------ Date: Thu, 04 Apr 91 21:07:26 -1000 From: Jim Wright Subject: mac anti-viral sites # Anti-viral archive sites for the Macintosh # Listing last changed 03 February 1991 beach.gal.utexas.edu John Perry This site can be reached through anonymous ftp. The Macintosh anti-viral archives can be found in the directory [ANONYMOUS.PUB.VIRUS.MAC]. This system is running VMS, not Unix. The IP address is 129.109.1.207. cs.hw.ac.uk Dave Ferbrache NIFTP from JANET sites, login as "guest". Electronic mail to . Main access is through mail server. The master index for the virus archives can be retrieved as request: virus topic: index The Mac index for the virus archives can be retrieved as request: mac topic: index For further details send a message with the text help The administrative address is ifi.ethz.ch Danny Schwendener Interactive access through DECnet (SPAN/HEPnet): $SET HOST 57434 or $SET HOST AEOLUS Username: MAC Interactive access through X.25 (022847911065) or Modem 2400 bps (+41-1-251-6271): # CALL B050 Username: MAC Files may also be copied via DECnet (SPAN/HEPnet) from 57434::DISK8:[MAC.TOP.LIBRARY.VIRUS] rascal.ics.utexas.edu Werner Uhrig Access is through anonymous ftp, IP number is 128.83.138.20. Archives can be found in the directory mac/virus-tools. Please retrieve the file 00.INDEX and review it offline. Due to the size of the archive, online browsing is discouraged. scfvm.bitnet Joe McMahon Access is via LISTSERV. SCFVM offers an "automatic update" service. Send the message AFD ADD VIRUSREM PACKAGE and you will receive updates as the archive is updated. You can also subscribe to automatic file update information with FUI ADD VIRUSREM PACKAGE sumex-aim.stanford.edu Bill Lipa Access is through anonymous ftp, IP number is 36.44.0.6. Archives can be found in /info-mac/virus. Administrative queries to . Submissions to . There are a number of sites which maintain shadow archives of the info-mac archives at sumex: * MACSERV@PUCC services the Bitnet community * LISTSERV@RICE for e-mail users * FILESERV@IRLEARN for folks in Europe uk.ac.lancs.pdsoft Steve Jenkins Service for UK only; no access from BITNET/Internet/UUCP Terminals : call lancs.pdsoft, login as "pdsoft", pwd "pdsoft" FTP : call lancs.pdsoft, user "pdsoft", pwd "pdsoft". Pull the file "help/basics" for starter info, "micros/index" for index. Anti-Viral stuff is held as part of larger micro software collection and is not collected into a distinct area. wsmr-simtel20.army.mil Robert Thum Access is through anonymous ftp, IP number 26.2.0.74. Archives can be found in PD3:. Please get the file 00README.TXT and review it offline. ------------------------------ Date: Thu, 04 Apr 91 21:07:58 -1000 From: Jim Wright Subject: unix anti-viral sites # Anti-viral and security archive sites for Unix # Listing last changed 05 June 1990 cs.hw.ac.uk Dave Ferbrache NIFTP from JANET sites, login as "guest". Electronic mail to . Main access is through mail server. The master index for the virus archives can be retrieved as request: virus topic: index For further details send a message with the text help The administrative address is funic.funet.fi Jyrki Kuoppala Accessible through anonymous ftp, IP number 128.214.6.100. Directory pub/unix/security contains programs to help in security, pub/doc/security contains various documents about security in general and unix security (like the worm documents) wuarchive.wustl.edu Chris Myers Accessible through anonymous ftp, IP number 128.252.135.4. A number of directories can be found in ~ftp/usenet/comp.virus/*. ------------------------------ End of VIRUS-L Digest [Volume 4 Issue 54] *****************************************