BEGPANC.CVP  931111
 
                         3.3 Local Reports
 
If you hear reports of a virus in your particular area, be cautious,
but don't panic.  As I write this, there have been a great many news
reports of the formidably named SatanBug virus.  This is perhaps
more widespread than some because of the activity of virus exchange
bulletin boards, but got much more press than it warranted because
of reports from Washington, DC.  In the same way, we have recently
been inundated with reports of "Stoned 3" and "Stoned 4":  these are
the names given by a particularly widely distributed (though not
particularly good) scanner to a wide variety of viral variants and
even false alarms.
 
However, it is true that virus infections tend to happen in
clusters.  Therefore, if there are a lot of validated reports of one
particular infection in your area, then it is best to be careful. 
Make sure that you have a program which is either effective in
preventing, or will correctly identify, this specific virus.  It is
a good idea to get accurate information about the virus:  what does
it infect, what are the exact symptoms, how does it behave, and is
there any information you can check to determine that you do *not*
have the virus.  In this latter category, during the months leading
up to March of 1992, we were able to advise people who were worried
about the Michelangelo virus to use CHKDSK.  This simple utility
checks the files and space on the disk, but it also gives a report
on the memory.  For most machines (although not all) it should
report "Total Memory" as being 655360 bytes.  If it does, then you
do *not* have the Michelangelo virus.  You may, of course, have
something else.
 
Try to find out all you can about the distribution and spread of the
virus, as well as any technical details.  The more people have been
hit whom you know, the more risk there is to you and your system. 
If, on the other hand, only machines in lawyers' offices are being
hit, and you don't know or deal with any lawyers (and who does, if
they can help it?), then you are probably at lower risk.  Not no
risk, but lower.
 
Try to assess the source of the reports.  Recently the Clinton
administration health plan was distributed to interested parties and
the media on disk.  Almost immediately a newswire report was issued,
and got almost universal coverage, stating that the disks were
infected with a virus.  (The mythical but ubiquitous "Stoned 3," as
it happened.)  When the dust had cleared, it turns out the *only*
report was from one reporter -- who happened to work for the
newswire service.  He had infected his machine and "decided" that
the only source could have been the Clinton disk.  (I must admit
that this report caught me out, too.  You can't be too careful.)
 
copyright Robert M. Slade, 1993   BEGPANC.CVP  931111

==============                      _________________________
Vancouver      ROBERTS@decus.ca    |    |     |\^/|     |    | swiped
Institute for  Robert_Slade@sfu.ca |    |  _|\|   |/|_  |    | from
Research into  rslade@cue.bc.ca    |    |  >         <  |    | Alan
User           p1@CyberStore.ca    |    |   >_./|\._<   |    | Tai
Security       Canada V7K 2G6      |____|_______^_______|____|