Computer Virus Trends:

Routine scanning alerts users to computer virus infections during May
Anti-virus researchers at S&S analyze a month of attacks

BURLINGTON, MASS., July 11, 1995 -- Routine scanning is the most effective
way to protect against attack by a computer virus.

Routine scanning also helps to contain the virus before it spreads to
multiple personal computers, according to the industry-leading anti-virus
researchers at S&S Software International Inc., maker of "DR. SOLOMON'S
ANTI-VIRUS TOOLKIT."

The research team answered 112 calls during May 1995 from users of the
TOOLKIT asking specifically for help identifying and repairing the damage
caused by known computer viruses.

Comprised of anti-virus researchers and technical-support engineers that
provide 24-to-48-hour virus identification and, when possible, repair, the
research team also identifies 150 to 200 new computer viruses each month.

The 112 skirmishes with known viruses during May computes to an 11 percent
increase from March and April, each of which generated 100 calls to S&S
for help.

The new viruses included "Big Caibua," named after the message it displays
while a penis travels across a computer screen and then ejaculates.

Big Caibua infects MS/PC-DOS program files with the extension .COM. It also
reformats a hard disk.

Big Caibua is packed inside COOLSAVR.COM, which purports to be a screen
saver. COOLSAVR.COM is generated when users unzip BESTSSVR.ZIP, a file
briefly available for downloading from bulletin board services worldwide.

Analyzing the calls during May about known viruses, the research team
helped users to identify and repair the damage caused by 37 different
viruses.

The 37 viruses comprise a fraction of the total number of known viruses,
which topped 6,000 in January 1995 -- a nearly 58 percent increase in one
year from the 3,800 viruses tracked by S&S as of January 1994.

Routine scanning

During May, routine scanning with VIRUSGUARD, the memory-resident virus
blocking system built into the Toolkit, alerted users to 17 attacks by
"Parity.b."

VIRUSGUARD checks every program for viruses before it is run or copied.

"VIRUSGUARD alerted users in all but four of the 112 incidents during May,"
said Pat Bitton, vice president of S&S.

"This is clear example of how scanning is highly effective in protecting
users against virus infections," said Bitton.

In the four exceptions, users learned they were infected by working with
other users of the TOOLKIT -- for example, consultants and systems
integrators brought in by the user to help, or from other companies that
alerted the user after sharing files that were infected.

Parity.b is a boot sector virus. It simulates a hardware failure,
displaying a "parity error" message on screen. A stealth virus, it hides
from the PC user and anti-virus programs. It also survives a "warm" reboot
with the CTRL, ALT and DEL keys.

All the Parity.b attacks during May targeted stand-alone PCs.

Form was the next most prevalent virus, accounting for 15 attacks - or more
than 13 percent of the calls during May. Also a boot sector virus, Form
sounds a beep with each keystroke, but only on the 18th of the month.

The May rankings invert the positions for March and April, when Form was
the most-prevalent virus.

Multiple attacks

Sampo and Junkie were the two viruses most likely to attack multiple
computers, including networked offices.

In the most widespread incident of the month, users reported Sampo
attacking more than 14 PCs; Junkie attacked 10 PCs at one site.

Sampo and Junkie both infect boot and partition sectors. Junkie also
attacks .COM files.

About S&S

Founded in 1984 by Dr. Alan Solomon, S&S is headquartered in the United
Kingdom. The company specializes in security and networking
products for IBM-compatible systems.

S&S International Inc. is a subsidiary of the UK software maker. It opened
offices in April near Boston and Los Angeles to sell and support the
Toolkit in the U.S.

The Toolkit is the winner of multiple awards, including the prestigious
"Queen's Award for Technological Achievement." It is also the winner of
exhaustive comparative reviews conducted by Virus Bulletin and Secure
Computing.

S&S Software International Inc
17 New England Executive Park
Burlington, MA 01803
617-273-7400,  fax 617-273-7474
Tech Support: 800-595-9175
CompuServe: GO Drsolomons
Internet: Support@sands.com
URL: http://www.sands.com
FTP: ftp.sands.com
 
 =========================================================
 From the 'New Product News' Electronic News Service on...
 AOL (Keyword = New Products) and Delphi (GO COMP PROD)
 =========================================================
 This information was processed from data provided by the
 company/author mentioned. For additional details, please
 contact them directly at the address/phone# indicated.
 Trademarks are the property of their respective owners.
 =========================================================
 All submissions for this service should be addressed to:
 BAKER ENTERPRISES,  20 Ferro Dr,  Sewell, NJ  08080  USA
 Email: rbakerpc@delphi.com  -or- RBakerPC (on AOL/Delphi)
 =========================================================
