Volume 2 Issue 5

We're electronic!

Virus News

Sensible Security Solutions Editor: Joanne Martelli
Our special thanks to York for the use of their facilities and to Joseph Aubin, who watched us infect and clean machines numerous times during the day and then leave the machines wiped clean at the end, knowing that he would have to reinstall the original software the next day. We've had a few requests for a Workshop dedicated to Macro viruses and will look into this possibility. If you would be interested, please let us know - we like to respond to the needs of numerous customers at the same time.

March 1997

As of last issue, Virus News has started to be distributed in both electronic and printed formats. You can select the format most suited to your needs. It is still a free publication, dedicated to informing computer professionals about the happenings in the world of viruses. If you prefer to read Virus News as it arrives now, you don't have to do anything except renew your subscription on a regular basis. We ask you to do this to ensure that we have your correct details. If you would like to receive Virus News electronically, just send us an e-mail, with your name and company details, to secure-1@istar.ca. Electronic distribution will mean that you get the latest issue as soon as it is available, and not after it has been printed and mailed out to you. Many of you have already informed us of your option for the electronic version, and we thank you. Each person who switches to the electronic version represents a little less paper, toner and manpower being consumed each month. Save a tree - switch to the electronic version! The February issue was shipped electronically in PDF format - we have discovered that RTF format leaves the document basically unformatted, which is no advantage over the plain ASCII format. As of the March issue (this one), those who have asked for the ASCII plain text version will get it in this format. All others will receive it in PDF, if you are on our mailing list. As an added benefit of receiving Virus News electronically, you will also receive our On-line Security Alerts. These are sent out whenever we learn of some special event, such as the discovery of a new virus in the wild or a security loophole in a major application. Typically, they should be sent about once per month. Sometimes, they come a little more frequently - as was the case in January, with a few major virus incidents of note.
In fact, during February we facilitated a conversation between a technical person in Toronto and the Virus Labs at Dr. Solomon's. This technician had received a new variant of the virus (Showoff.E) which had been diagnosed by a major virus researcher as having a destructive payload. Since we had sent out an On-Line Security Alert on this virus, we wanted to make sure we had the right information. We consulted with Dr. Solomon's Virus Lab, who confirmed that all versions were harmless. The Toronto technician stuck to his guns and we finally received a confirmation from the virus researcher who had done the initial research. In the end, he re-examined the virus in question and confirmed the Virus Lab analysis Showoff.E is not destructive. We all sighed with relief.
Dr. Solomon's Introduces new VxD technology
Dr. Solomon's has introduced some important new features in their WinGuard real-time scanner. Dr. Solomon's WinGuard is a VxD: a full 32-bit device driver which runs constantly in the background of Windows sessions. A VxD is a Virtual Device Driver for the Windows operating system (Win 3.x and Win 95). It is comparable to TSRs or device drivers that run under DOS. WinGuard uses the award-winning FindVirus scanning technology to scan all executed or copied files. If a file is virus-infected, WinGuard will prevent access to it and can be configured to send an alert message to a system administrator. WinGuard consists of two main components: A VxD (WINGUARD.386) which runs as part of the Windows environment and a front end control panel (WGFE.EXE) which enables the user to configure WinGuard's options, and to receive virus alerts. The front end also fetches information from the WinGuard VxD to assure you that it is working, and to tell you how it is configured

ShowOff in the Wild in Canada
The ShowOff virus has been seen in the wild in both Toronto and Ottawa. It is a Macro virus, affecting MS Word documents. The Show Off macro virus contains the following macros: Ofxx AutoOpen AutoClose Cfxx AutoExec Show AutoOpenVir AutoCloseVir It does not seem to be harmful, but nobody wants to take a chance.
Live Virus Workshop results
On February 25th we held our first Live Virus Workshop, at York University in Toronto. The turnout was excellent, although a few people did succumb to colds and couldn't make it. We hope to see them at the next one.
WinGuard adds AutoDisinfect feature:
Version 7.68 of Dr. Solomons Anti-Virus Toolkit for Windows 3.x and Windows 95 now includes an Auto-Disinfect feature. The development of this functionality was brought
1997 SSS-Sensible Security Solutions Inc. - Canada Anti-Virus Professionals
2000 Golf Club Road, Braeside, ON KOA 1G0 Canada Tel: 613- 623-6966 Fax 623-3992 secure-1@istar.ca The contents of this publication may be cited freely, provided proper credit is given to the source.

Page 2

about due to the increase in virus incidents seen in many corporations since the advent of macro viruses. Engineers in some companies were having to respond to, and clean, around 300 infections of WM.Concept per week. There are two options; the first, which is the default setting, is for WinGuard to behave as in previous versions, that is to warn of a virus infected file but not to disinfect the file. The second option, which can be selected in the WinGuard interface or by adding lines to the registry for Windows 95, or the SYSTEM.INI for 3.x, as described below, is for WinGuard to disinfect any infected files that are used and to report to a log file that it has done so. For Windows 95, there are two new entries into the WinGuard section of the registry, these being in: MyComputer\HKEY_LOCAL_MACHINE \System\CurrentControlSet\Services\VxD\Win Guard. The FILEREPAIR string also includes the configurable message to be displayed in the event of a virus being cleaned. In the event of a virus being detected, and file disinfect being selected, the file will be cleaned before a message is displayed. The Windows 3.x version contains one addition to the WinGuard section of the SYSTEM.INI file, Repair=true, and an addition to the WinGuard Front End section, FILEREPAIR=message.

WinGuard Log File

The options configurable under Log/Options allow you to set up a text file which will keep a record of any virus alerts you have. With Log file enabled all alerts will be written to the file named in the text field Log file. If this checkbox is disabled, alerts will be reported but not logged. You can enter the name of the file you wish to be used for logging. Alerts will be appended to this file, along with the time and date of the alert. Note that times use the 24 hour clock, and dates are in day/month/year format. The browse button enables you to search your directory structure and select a suitable filename to log to. Any changes made in this dialog will not take effect until Windows has been restarted. When you click 'OK', you will be asked if you are sure you wish to change WinGuard's setup. You will then be asked if you wish to restart Windows for the changes to take effect. You can choose to restart Windows or wait until you next start Windows.

March 1997

The following information will be of use to some readers, but we do not intend to work with the Home version of the software and will not be selling it. This decision was not taken lightly, but based upon what our customers have been asking us to supply in terms of expertise and know-how.
Designed for home use, DSAV for Home offers a sub-set of the features of the complete Toolkit. It does not replace the complete DSAV Toolkit, which is still the product of choice for organizations of all sizes, and which comes with the complete set of tools needed to handle any virus incident. Dr. Solomon's Anti-Virus is the company's first product specifically designed for the US retail market and began shipping in March 1997. It contains a small manual and online documentation. Updates are supplied on-line. Both Windows 95 and Windows 3.x anti-virus protection is included in one box. Dr. Solomon's Anti-Virus can be ordered directly from Dr Solomon's Software by calling toll-free (800) 469-4562 or from US retailers. Customer Support for this Home product will be supplied by Dr. Solomon's Software - unlimited, free customer support at (617) 273-7495 from 9:00 a.m. - 9:00 p.m. EST Monday through Friday, and from 9:00 a.m. - 3:00 p.m. EST on Saturday. Dr. Solomon's also offers 24-hour virus emergency support, live with one of its technical experts on the phone. Support is also available via the Internet at support@us.drsolomon.com, or via CompuServe at GO DRSOLOMON.

WinGuard as a Service

Another recent addition to the capabilities of WinGuard is the change to a full service under Windows 95. Until version 7.68, it was possible for a user to disable WinGuard on the Windows 95 platform by killing the running process. With this enhancement, this will no longer be possible. For a user to disable WinGuard, he will now have to edit the registry. This is not a trivial task for most users, which makes WinGuard more secure.

OLE Parsing

OLE parsing will be of major interest to users of Microsoft Word. Current AV products require that you scan all files in order to detect the macro viruses which can plague a Word user - and this results in a much slower system as all files must be verified as clean before you can use them. OLE parsing allows WinGuard to determine if a file is capable of containing OLE structures, which are where the Macro viruses would be located. If the file does not contain OLE, and isn't an executable file, it is ignored and inspection passes to the next file. The end result is an increase in performance without a drop in security.

Speaking and Trade Shows

Our President, Robert Vibert, will be speaking at the 9th Annual Canadian Information Technology Security Symposium in Ottawa, on Thursday May 15. His topic will be The Business Case for a Preventive Anti-Virus Solution. Mr. Vibert will also be speaking at the Virus Bulletin Annual Conference, held in San Francisco in October. Sensible Security will have a booth at Comdex in Toronto in July - more details in next month's issue.

New DSAV for retail

We have been receiving a large number of phone calls about the new Retail version of Dr. Solomon's Anti-Virus. As this is a Home version of the product, we are not actively involved with it. Sensible Security specializes in medium and large installations of anti-virus solutions.
2000 Golf Club Road, Braeside, ON KOA 1G0 Canada Tel: 613- 623-6966 Fax 623-3992 secure-1@istar.ca