News Archives from 2001 (September 01 - September 30, 2001) ______________________________________________________________ [Jump to Amiga] [Jump to Windows] [Jump to Mac] [Jump to Linux] [Jump to Misc] ______________________________________________________________ Amiga 30 September 2001 - Safe v17.1 Released Zbigniew `Zeeball` Trzcionkowski released his latest freeware virus dicovering system. Safe informs about attack and removes virus from memory if possible. The archive is named Safe171.lha, and can be found on the downloads page, by following the above link. Zeeball says "See you in SafeII unless someone reports bug in this one :-o I'm still waiting!" New in v17.1 - changed all text output to PutStr(), - added security mechanism that will react in case of xvs.library deactivation, - fixed installer script to avoid crashing WinUAE and to really replace old file with new one, - added to package initial releases of my new AV tools which prospectively become components of new anivirus called MILL. Check them out as they already are functional. Please let me know how they work on your configurations. Special thanks to Soenke Freitag for letting me continue and release his private integrity checker! 27 September 2001 - VHT-Denmark Latest News Virus Help Denmark announced that mew virus translations have been added to the Amiga Virus Encyclopedia. 21 September 2001 - Safe v17.0 Released Zbigniew `Zeeball` Trzcionkowski released his latest freeware virus dicovering system. Safe informs about attack and removes virus from memory if possible. The archive is named Safe170.lha, and can be found on the downloads page, by following the above link. Zeeball has signed the files with PGP. To get more of an insite on what PGP can do for you, visit Virus Help Team Canada's PGP Page, and get your copy. Zeeball's PGP key has also been added to our list of PGP online keys, which are available on the above page. New in v17.0 - fixed PatchWork hit at EasyRequest() - added another security mechanism that should be able to detect actions of packet based stealth engines. Thanks to Jan Andersen (for HANF). - signed the most important stuff with PGP My pubkey will be on VHT-DK/VHT-CA sites, but as for the fist time it is also in bonus directory. Thanks to Charlene McNulty for idea, help, and especially for the DiskMaster menus. - my new Aminet uploader is Jan Andersen 17 September 2001 - xfdmaster.library v39.13 / Rel1.36 Available Dirk Stoecker released his latest xfd library. The archive is named xfdmaster136.lha, and can be found on the downloads page. The older version has been moved to the Archives Section. 14 September 2001 - Safe v16.9 Released Zbigniew `Zeeball` Trzcionkowski released his latest freeware virus dicovering system. Safe informs about attack and removes virus from memory if possible. The archive is named Safe169.lzx, and can be found on the downloads page, by following the above link. The ZeebsVS patch has been removed. Sadly to report, this may be the last, or one of the last versions of Safe. I personally want to thank Zeeball for the effort and concern he has put into this modified archive, and cleaning out the text that had offended me. Much appreciated !! Thankyou Zeeball - Charlene @@@->->- Special Note: This version of Safe has been packed with LZX instead of LhA. LZX is available from Aminet, and works similar to LhA. Another way to unarchive the file, is by using the excellent XAD package. The XAD package is shareware, but well worth the small investment. * See Safe Homepage at VHT-Canada for unarchiving instructions. New in v16.9 - cosmetic changes - removed most of offending texts Thanks to Charlene McNulty for paying attention. - removed ZeebsVS as I have shown what I had to Thanks to Dirk Stoecker for paying attention, thanks to Georg Hoermann for reaction! 10 September 2001 - builtwithamiga.org Taken Over By Non-Amiga Owners If you have a BuiltWithAmiga link on your site, you may be interested to know that the BWA domain name had expired, and now belongs to others. www.builtwithamiga.org now points to an "adult" site. Since we at VHT-CAN had the above site address in our links, we have now changed them to point to the BuiltWithAmiga Mailing List. 10 September 2001 - Safe v16.8 Released Zbigniew `Zeeball` Trzcionkowski released his latest freeware virus dicovering system. Safe informs about attack and removes virus from memory if possible. The archive is named Safe168.lha, and can be found on the downloads page, by following the above link. New in v16.8 - cosmetic changes - added Zeeb'sVS v1.1 08 September 2001 - Safe v16.7 Released Zbigniew `Zeeball` Trzcionkowski released his latest freeware virus dicovering system. Safe informs about attack and removes virus from memory if possible. The archive is named Safe167.lha, and can be found on the downloads page, by following the above link. New in v16.7 - added italian strings to installer script, - fixed stupid bug with my new VECS Also... - This version patches functions of xvs.library with Zeeball's own additional routines, using his ZeebsVS program - Safe Recognizes all files infected with HITCH-HIKER 5.00! 07 September 2001 - VHT-Denmark Latest News Virus Help Denmark announced that mew virus translations have been added to the Amiga Virus Encyclopedia. 05 September 2001 - VirusExecutor v2.21 Released Jan Erik Olausen released a new version of his virus killer. The archive is named VirusExecutor221.lha, and can be found on the downloads page, by following the above link. For changes since last version, see the readme file. Includes the new Xvs.library 33.34 * VirusExecutor Homepage at Virus Help Team Canada Has links to all files required and recommended to run VE2.21 05 September 2001 - New Xvs.library v33.34 Released Jan Erik Olausen (JEO), released a new XvsLibrary. The archive is named xvslibrary3334.lha, and can be found on the downloads page, by following the above link. News for 33.34: - Replaced the Hitch-Hiker 5.00 detection/removal code. Thanks to Georg Hörman for writing a better code ;) - Cleaned up some code. Got some tips from Georg. So the library is a bit smaller now... - For developers: Added XVSLIST_DATAVIRUSES to xvsCreateVirusList() so that you can view data viruses as well. 04 September 2001 - New Xvs.library v33.33 Released Jan Erik Olausen (JEO), released a new XvsLibrary. The archive is named xvslibrary3333.lha, and can be found on the downloads page, by following the above link. News for 33.33: - Fixed 2 bugs in Hitch-Hiker 5.00 removal + improved checking. Thanks to Thomas Klein for reporting the bugs. - Removed Sinister Syndicate 1/2 and French from the bootblock recog. They were harmless. Thanks to Dirk Stöcker for telling me. 02 September 2001 - VEPatchBrain v1.38 for VirusExecutor Available Jan Erik Olausen has released a new PatchBrain for his viri checking program VirusExecutor. This brain file can be used with any VE 2.xx version. For changes since last version, read the readme file. 02 September 2001 - New Xvs.library v33.32 Released Jan Erik Olausen (JEO), released a new XvsLibrary. The archive is named xvslibrary3332.lha, and can be found on the downloads page, by following the above link. For changes since last version, see the readme file. News for 33.32: - Argh... Fixed major bug in Hitch-Hiker 5.00 removal. The virus was removed, but the file was not fixed. Thanks to Jean Holzammer for reporting this bug. Top of Page Windows 27 September 2001 - Microsoft Security Bulletin MS01-048 Microsoft TechNet Security's latest bulletin outlines "Malformed Request to RPC Endpoint Mapper can Cause RPC Service to Fail". The RPC endpoint mapper allows RPC clients to determine the port number currently assigned to a particular RPC service. The Windows NT 4.0 endpoint mapper contains a flaw that causes it to fail upon receipt of a request that contains a particular type of malformed data. 27 September 2001 - DAT / SDAT 4163 McAfee Total Virus Defense Update DAT File for weekly v4x 4163, and SuperDat File for v4x 4150/4163 are now available on Network Associates website. Dr Solomon's VirusScan customers download here. For more information on the use of the dat files, please see the NAI's readme.txt. or download VirusScan v4.5 Admin Guide. * Click here for VirusScan Emergency DATS 27 September 2001 - Superdat File for v4x (Intel Engine only) Networks Associates released the Engine-only SuperDAT Package Installer v1.4.0. This is for Engine Version: 4.1.50. The SuperDAT package installer minimizes the need for complex software deployments each time you receive upgrade components. * Readme for 4150 engine only SuperDat (Intel) 27 September 2001 - Updated .def Files Available for F-PROT Frisk Software International has new Sign.def file available. Also there is the Sign2.zip file which contains only the sign2.def without the sign.def file and, as a result, it is quite a bit smaller than both def files together. These updates have been available since Sept 27, 2001 The updates are available now at ftp://ftp.complex.is/pub/ * September 27 2001 releases fp-def.zip 798Kb plus fp-def.asc sign2.zip 157Kb 25 September 2001 - F-PROT and F-PROT for Windows v3.11 Released Frisk Software International has a new F-Prot Antivirus version 3.11 available now. There is also a trial version online. * Read more about FP-WIN Anti-virus Program here * Get the Trial Version here * See Download page for details on how to get your own copy of F-PROT The update has been available since September 6th, 2001 at ftp://ftp.complex.is/pub/ * September 25 2001 releases a) FP-Win v3.11 fp-311.zip 1353Kb plus fp-310b.asc b) FP-Win v3.11 Trial fp-win_311_trial.zip 5775Kb 25 September 2001 - Latest Macro.def for F-PROT Released Frisk Software International has a new Macro.def for F-PROT. This version of Macro.def was last modified/changed on: August 30, 2001 * See ftp://ftp.complex.is/pub/ for: macrdef2.zip 205Kb 25 September 2001 - DAT / SDAT 4162 McAfee Total Virus Defense Update DAT File for weekly v4x 4162, and SuperDat File for v4x 4140/4162 are now available on Network Associates website. Dr Solomon's VirusScan customers download here. For more information on the use of the dat files, please see the NAI's readme.txt. or download VirusScan v4.5 Admin Guide. * Click here for VirusScan Emergency DATS 25 September 2001 - Updated .def Files Available for F-PROT Frisk Software International has new Sign.def file available. Also there is the Sign2.zip file which contains only the sign2.def without the sign.def file and, as a result, it is quite a bit smaller than both def files together. These updates have been available since Sept 20, 2001 The updates are available now at ftp://ftp.complex.is/pub/ * August 17 2001 releases fp-def.zip 796Kb plus fp-def.asc sign2.zip 157Kb 25 September 2001 - New Victims Of The "Nimda" Network Worm Only a few days ago on September 18, the Nimda network worm appeared throughout the world on a grand scale. Numerous reports about infection by this worm have been reported from many parts of the globe, with the number of the worms victims already reaching the hundreds of thousands. Unfortunately, there hasn't been any noticeable let up in Nimdas spreading. [report from Kaspersky Lab] 25 September 2001 - Possible Exploitation Of Recent Tragic Events Kaspersky Labs says the reverberations of last week's horrific and vicious attacks on the United States have rippled throughout the world, and will undoubtedly remain indelible in everyone's memory. One of the tactless results of this macabre event is that it could become the target of misuse in the guise of the computer underground exploiting user curiosity by enclosing malicious code in the form of providing news updates. Similar psychological tactics that virus writers use to manipulate users for the purpose of infecting computers is well known. In addition, the latest modification of the "GoDog" virus has been detected, being dubbed "World Trade Center" by its larval writer. * Click here for F-Secure Virus Report on Vote Aliases: WTC, W32/Vote@mm, I-Worm.Vote Vote is a simple Visual Basic virus which uses the WTC tragedy as a ploy to get people to execute it. It spreads further via e-mail as a mass mailer. The worm uses standard Windows Mail API to access the user's address book. This affects users of MAPI compatible e-mail clients, mainly Microsoft Outlook. The e-mails sent by the worm look like this: From: name-of-the-infected-user To: random-name-from-address-book Subject: Fwd:Peace BeTween AmeriCa and IsLaM ! Hi iS iT waR Against AmeriCa Or IsLaM !? Let's Vote To Live in Peace! Attachment: WTC.exe 25 September 2001 - Do Not Use Internet Or E-Mail Without The Patch Kaspersky Labs has been warning about incidents of infection in connection with the network worm "Nimda". "Nimda" ("Admin" backwards) poses a serious threat to both companies and individual users alike. The worm opens all disks installed on an infected computer for full access. In this way, anyone who wishes may delete, change, copy, or view any document on the infected computer. This could cause the disclosure, loss, and unauthorized changing of confidential information. 18 September 2001 - Complex And Widespread Nimda Worm Located Aliases: W32/Nimda.A@mm W32/Nimda@mm, I-Worm.Nimda F-Secure Corporation is alerting computer users worldwide about a new, rapidly spreading e-mail worm. Known as "Nimda" this worm combines functionalities of a mass mailer and a web worm. The worm spreads through both e-mail attachments named "readme.exe" and by attacking vulnerable web servers in the net. 11 September 2001 - InoculateIT Personal Edition AntiVirus Newsletter On June 15th, 2001, we were told CA enterprise solutions utilizing the "LicenseIT" tool may be affected by a license key set to expire on June 15th, 2001. We were advised that this does not affect InoculateIT Personal Edition (IPE). Well, as of todays Newsletter from Computer Associates, it states "The InoculateIT Personal Edition (IPE) program has ended and the product will not be developed any further. EZ Antivirus is the new and improved product serving the consumer AV market for CA." NOTE: IPE users will continue to receive signature updates at no cost from http://www.antivirus.ca.com. To download the latest signature file for IPE without going through your Web browser, you can use the new "Auto Download" feature inside IPE (Tools, AutoDownload) or the AutoDownload application to check for updated signatures, download, and install them. Alternatively, the update file can be obtained at the following URL: http://antivirus.ca.com/update.htm Price Special: Through September 15, 2001, the cost of eTrust EZ Antivirus is only $5.95 and for eTrust EZ Armor only $15.95. Please visit us at http://www.my-eTrust.com. 07 September 2001 - Lara Croft Threatens Computer Safety Kaspersky Lab says the first malicious code utilizing Desktop Themes files has been detected. At the moment, Kaspersky Labs has received two reports of infections by this worm. "Lara" spreads exclusively via Internet Relay Chat (IRC), transferring the "LaraCroft.theme" worm- carrying file to remote computers. * Click here for NAI Virus Report 07 September 2001 - CERT: Incident Note IN-2001-11 The CERT/CC has received reports from sites experiencing cache corruption on systems running Microsoft DNS Server. The default configuration of this software allows data from malicious or incorrectly configured servers to be cached in the DNS server. This corruption can result in erronous DNS information later being returned to any clients which use this server. 07 September 2001 - Microsoft Security Bulletin MS01-047 Microsoft TechNet Security's latest bulletin outlines "OWA Function Allows Unauthenticated User to Enumerate Global Address List". OWA is a feature in Exchange 5.5 and 2000, that allows users to access their email via a web browser instead of a mail client. 07 September 2001 - DAT / SDAT 4157 McAfee Total Virus Defense Update DAT File for weekly v4x 4157, and SuperDat File for v4x 4140/4157 are now available on Network Associates website. Dr Solomon's VirusScan customers download here. For more information on the use of the dat files, please see the NAI's readme.txt. or download VirusScan v4.5 Admin Guide. * Click here for VirusScan Emergency DATS 07 September 2001 - F-PROT and F-PROT for Windows v3.10c Released Frisk Software International has a new F-Prot Antivirus version 3.10c available now. There is also a trial version online. * Read more about FP-WIN Anti-virus Program here * Get the Trial Version here * See Download page for details on how to get your own copy of F-PROT The update has been available since September 6th, 2001 at ftp://ftp.complex.is/pub/ * September 06 2001 releases a) FP-Win v3.10c fp-310c.zip 1330Kb plus fp-310b.asc b) FP-Win v3.10c Trial fp-win_310c_trial.zip 5487Kb 07 September 2001 - Updated .def Files Available for F-PROT Frisk Software International has new Sign.def file available. Also there is the Sign2.zip file which contains only the sign2.def without the sign.def file and, as a result, it is quite a bit smaller than both def files together. These updates have been available since Sept 06, 2001 The updates are available now at ftp://ftp.complex.is/pub/ * August 17 2001 releases fp-def.zip 777Kb plus fp-def.asc sign2.zip 141Kb 07 September 2001 - Latest Macro.def for F-PROT Released Frisk Software International has a new Macro.def for F-PROT. This version of Macro.def was last modified/changed on: August 30, 2001 * See ftp://ftp.complex.is/pub/ for: macrdef2.zip 203Kb Top of Page Macintosh 07 September 2001 - Virex Update To Virus DAT For Scan Engine Available Networks Associates Technology, Inc. has the current Macintosh anti-virus software Virex Scan Engine Version: 4131, which includes this updated Virus Definition file: 4157. Further information in Virex Release Notes for this Virus Update. * Virex FTP Site at ftp://ftp.nai.com/pub/antivirus/datfiles/mac/virex Top of Page Linux 27 September 2001 - Latest Linux Weekly News Released LWN.net Weekly Edition for September 27th, 2001 has been published. The security items include the serious PHP-Nuke vulnerability. 27 September 2001 - Latest Embedded Linux Newsletter LWN.net Daily news announced that LinuxDevices has posted the latest Embedded Linux Newsletter for September 27th, 2001. This issue includes summaries of running Linux on the Sega Dreamcast, a device profile on the Empower Palm III-clone, and a new streaming multimedia solution for Linux. 25 September 2001 - F-PROT for LINUX v3.11 Beta x86 Released Frisk Software International has a new v3.10a of F-PROT Linux x86. Read more about FP-WIN Anti-virus Program here. * Click here to download F-Prot Antivirus for Linux The update has been available since September 25th, 2001 at ftp://ftp.complex.is/pub/ * September 25 2001 releases GNU Compressed fp-linux_3.11_beta_x86.tar.gz 1376Kb 25 September 2001 - Embedded Linux Newsletter Sept 20, 2001 LWN.net Daily news announced that LinuxDevices has posted the latest Embedded Linux Newsletter. This issue includes notes on the RTLinux vs FSF confrontation, the release of ColdFire as GPL, and Fujitsu's Linux-based humanoid robot. 25 September 2001 - Latest Linux Weekly News Released LWN.net Weekly Edition for September 20th, 2001 has been published. Security items include: Is U.S. Crypto in danger again? Mandrake Apache fix, and Debian "most" advisory. 07 September 2001 - Latest Linux Weekly News Released LWN.net Weekly Edition for September 06th, 2001 has been published. Security issues cover Apache SQL authentication vulnerabilities, and the X.C worm. 07 September 2001 - Latest Embedded Linux Newsletter LWN.net Daily news announced that LinuxDevices has posted the latest Embedded Linux Newsletter. This issue covers Rick Lehrbaum's trip to LinuxWorld, a new Linux PDA on the way from Korea, and Motorola's choice of Embedix for its set-top box. Top of Page Miscellaneous 28 September 2001 - No Monument For Trudeau A Year After His Death Trudeau (PET) served as prime minister between 1968 and 1984, and is well remembered for invoking the Canadian War Measures Act. CTV News says a year after his death, there's still no national monument for former prime minister Pierre Elliot Trudeau. It was one year ago on Friday that Canada lost the man who many considered to be the most popular leader in this country's history. Former American president Jimmy Carter and Cuban President Fidel Castro were among the dignitaries at Trudeau's funeral at Notre Dame Basilica. 28 September 2001 - Anniversary Of Trudeau's Death Passes Quietly By The Associated Press, - ST-REMI, Quebec (AP) - Three friends of former prime minister Pierre Trudeau stood solemnly for several minutes in front of his family crypt Friday and placed single red roses in the doorway to mark the first anniversary of his death. 27 September 2001 - PRZ Says: No Regrets About Developing PGP Phil Zimmermann says "The Friday September 21st Washington Post carried an article by Ariana Cha that I feel misrepresents my views on the role of PGP encryption software in the September 11th terrorist attacks." (Zimmerman notes: This letter may be widely circulated) * Click here for Signed version of announcement * Click here for local Signed version at VHT-Canada * Click here for Washington Post article in question 27 September 2001 - Gordon Sinclair's Pro-American 1973 Editorial One of the links at Urban Legends, is about Canadian broadcaster Gordon Sinclair, who delivered an impassioned defense of the U.S. in 1973. 27 September 2001 - Urban Legends Rumors of War Urban Legends has a Rumors of War Page, which is a collection of links to pages discussing the various rumors to come out of the September 11 terrorist attack on the United States of America. Interesting read. 27 September 2001 - F-Secure Reports: Klingerman Virus HOAX During May, 2000, a warning about Klingerman virus became widespread in USA and Europe. This warning is confirmed to be a hoax by CDC - the Centers for Disease Control and Prevention. You can read their official statement if you follow the below link: http://www.cdc.gov/ncidod/kingerman_hoax.htm F-Secure asks that you please ignore these messages and don't spread them any further. 27 September 2001 - NAI Reports: !0000 HOAX The !0000 Hoax is mainly circulating in the Netherlands. The e-mail content contains a "trick" how to prevent/stop mass-mailing routines used by e-mail viruses/worms. Network Associates asks you to ignore or delete this email and do not forward to others. 25 September 2001 - NAI Releases Source Code For PGPsdk Pretty Good Privacy International, (PGPi) says NAI has released the source code for PGPsdk 2.1.1 for peer review. It can be downloaded here. 25 September 2001 - PGP Multiple User ID Vulnerability Pretty Good Privacy International, (PGPi) says a vulnerability in PGP's display of key validity has been discovered that could allow an attacker to fool users into thinking that a valid signature was created by what is actually an invalid user ID. The attack was discovered by Sieuwert van Otterloo, and works on all PGP 5.x, 6.x and 7.x versions. NAI has already released a hotfix that corrects the problem for the latest freeware and commercial PGP versions. See the original report and NAI's advisory. 25 September 2001 - Fake Nostradamus Prophecies HOAX CIAC Urban Myths and Legends reports it is hard to believe that after the horrific events of Sept 11, 2001, that someone would start a chainletter with fake prophecies in it in an attempt to make it appear that Nostradamus predicted these events. If you search the prophecies of Nostradamus, you won't find any of the text from this hoax nor anything close to it. * Stiller Research Report: Nostradamus (World Trade Center) HOAX 12 September 2001 - Amiga.org Sets Up 'Silent Post' For Terrorist Victims Amiga.org has a spot where we can leave a silent post (empty), showing our support for family and friends of the affected people in yesterdays attacks on the WTC and Pentagon. * Amiga.org main news page 11 September 2001 - Terrorist Attack on World Trade Center and Pentagon Starting early this morning, at 8:45 am EST, two planes plowed into the World Trade Center in New York City, New York. One plane hit each building. A short time later, another passenger airplane that had been hijacked by the unknown terrorists, hit the Pentagon. Our sympathies to families and friends and all those involved in this tragedy. 07 September 2001 - Latest HOAX Information Hoax Name: Sulfnbk.exe virus hoax * Click here for F-Secure Hoax Report Aliases: Long File Name Backup utility virus hoax Release Note: In April-May 2001 there appeared a hoax message concerning a new virus that was reportedly discovered in Windows' Long File Name Backup utility SULFNBK.EXE. F-Secure checked several versions of this utility from Windows installations and found no infection in it. If you receive these hoax messages, please ignore them. Hoax Name: Blotto virus hoax * Click here for F-Secure Hoax Report Release Note: Blotto virus doesn't exist. If you receive this hoax message please ignore it and don't pass it on. Hoax Name: My New Pics hoax * Click here for F-Secure Hoax Report Release Note: The message is a hoax, but take a note that there is an Internet worm called MyPics that spreads itself as an EXE file attachment to a short e-mail message 'Here's some pictures for you' and with empty subject line. So never open unknown attachments. Please ignore this hoax and do not pass it on. 07 September 2001 - CERT: Advisory CA-2001-25 The CERT Coordination Center says a vulnerability for a remotely exploitable buffer overflow exists in Gauntlet Firewall by PGP Security. 07 September 2001 - F-Secure Report: MPF Release Note: No viruses by this name exist. MPF is platform alias name used for viruses which can affect a wide range of systems. 07 September 2001 - F-Secure Report: EICAR-test Release Note: The correct operation of F-Secure anti-virus products can be tested with a special test file. This is a dummy file which is detected by exactly like if it were a virus. This file is known as EICAR Standard Anti-virus Test file, and it is also detected by several other anti-virus products in a similar manner. 07 September 2001 - F-Secure Report: Symbian/EICAR-test Release Note: The correct operation of F-Secure anti-virus products can be tested with a special test file. This is a dummy file which is detected by exactly like if it were a virus. This file is known as EICAR Standard Anti-virus Test file, and it is also detected by several other anti-virus products in a similar manner. Naturally, the file is not a virus. When executed, EICAR.COM will display the text 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!' and exit. EICAR is the European Institute of Computer Anti-virus Research, reachable at http://www.eicar.org Top of Page Back to the News Archives page