

                 SWEEP for DOS Virus Detection Release Notes
                 -------------------------------------------

                        Version 3.00, 1st August 1997


 All SWEEP versions have been updated with new virus information.  A list of
 new viruses is now included in the release notes.

 Excel file disinfection
 -----------------------

 Disinfection of Excel (VBA3) macro viruses does not require the use of the
 -VBA3 command line qualifier in addition to -DI.  Simply use -DI (disinfect)
 qualifier.  For example:

   SWEEP *.XLS -DI

 Template or document?
 ---------------------

 Microsoft Word documents (as opposed to templates) cannot cause a macro virus
 infection when they are opened.  Prior to version 3.00 SWEEP did not report
 such documents as viruses, even if they incorporated viral macros (since they
 were not infectious).  Since this proved to be confusing to some users, SWEEP
 now ignores the setting of the so-called 'template bit' in Word files by
 default and reports the presence of virus macros in documents as well as
 templates.

 To test whether a Word object is really infectious or not, use the -NITB
 command line qualifier:

   SWEEP ISINFECT.DOC -NITB

 32 bit FAT support
 ------------------

 32 bit FAT support is now turned on by default.  To disable it use the
 -NFAT32 command line qualifier:

   SWEEP C: -NFAT32

 Anti-virus Workshop
 -------------------

 A two-day hands-on workshop which gives delegates as opportunity to
 experiment with real, live, computer viruses in a controlled environment.
 The workshop is now in 7th year and its contents continue to be updated as
 new viruses and anti-virus techniques are developed.

 The next available dates are 24th/25th September 97 and the number of
 delegates is limited to 16.

 NetWare Security Workshop
 -------------------------

 Practical NetWare Security is a one-day hands-on workshop which gives
 delegates an opportunity to experience attacks on NetWare security and devise
 countermeasures in a live, multi-server environment.  This workshop follows
 on the traditions of the extremely successful Sophos Anti-virus Workshops,
 placing the emphasis on practical experience.  Familiarity with NetWare 3.X
 and/or 4.X is assumed.

 The next available date is 9th September 97 and the number of delegates is
 limited to 16.

 Most commonly reported viruses in June 1997
 -------------------------------------------

 Winword/Cap 14.0%, Parity Boot-a 12.8%, AntiCmos 8.1%, CMOS4 7.0%,
 Winword/Npad 5.8%.

 For more information on these and other viruses, select View, Virus library
 in SW.

 Viruses added this month
 ------------------------
 
 Ada-3368        Airwalker-300   Airwalker-303   Airwalker-384
 Airwalker-385   Airwalker-386   Albania         ArjRar-2821
 Armagedon-1057  AsmVirus-431    AsmVirus-433    Aurea-996
 Beast&Black-554 Beast&Black1427 Beavis-boot     Bowl-135
 Bucharest       Bucharest-b     Bucharest-c     BW-Borg
 BW-Drole-based  BW-Seastorm-a   BW-Seastorm-b   BW-Skies
 BW-VBug         BW.Drole/family Chad-307        CivilWar-302h
 CivilWar-579    CivilWar-716    Cluster-384-B   Cocaine
 Cossiga.883c    Dark Elf 1.1    Delima          Denzuko
 Dir II          Driz1600        Dvc-336         Dying Oath
 Elena-592       Excel/Laroux-C  Excel/Laroux-D  Explode-250
 FatalI-1337     Flue.1650       Fulld-526       Fyodor-101
 Garden          Gboot           Gobot           Gobot-2097
 Gobot-2101      Gobot-2102      Gobot-2103      Gobot-2104
 Gobot-4000      Gobot-4005      Gobot-4006      Grace.1376b
 Graveyard-479   Grot-1020       Gullic          Hate-524
 Heda.269        Helf-1040       HLL-20621       HLL-21037
 Hype            Iron Butter.271 Jacov-a         Jacov-b
 Jacov-c         Jacov-d         Jakarta-559     KFA-3493
 Kradee-3584     Latio-897       Lauren          Lizz-1125
 Lonliness-370   LyByYy-612      Mao-1000        Marzia 2
 Mcla-1235       Mecojoni        Nanjing-2976    NetworkRead-467
 Npox-1683       Npox-891        Nuke Pox 1.1    Orudis
 Orudis/family   Oxana-1671      Pixel-385       Pixel-Hydra-344
 Pixel-Hydra-371 Playgame-1999   Poppy-513       Qboot
 Qres-394        Qres-496        Revelation-4096 Ringw-303
 Riot-426a       Sailor-b        Simb-878        Small-144b
 SomeKitPeng-261 SomeKitPeng-265 SomeKitPeng-269 SomeKitPeng-273
 SomeKitPeng-277 SomeKitPeng-281 SomeKitPeng-285 SomeKitPeng-289
 SomeKitPeng-295 Space-2001      Stoned          Svs
 SVS-boot        Swapper-748     TMC             Trival-101-B
 Trival-31-B     TrivalC-46      TrivalC-62      TrivalC-72-B
 TrivalG-113     TrivalG-131     Trix-1363       Uracil-486
 Viresc-Broken   Viruz-565       Warrior-1159    Weed-5850
 Weed_b          Win-Gollum-7167 Win95Murkry-339 Winword/Attack
 Winword/Band-Q  Winword/Beeper  Winword/Cebu-A  Winword/CeeFouB
 Winword/Chaka   Winword/Chaos-B Winword/Conc-AJ Winword/Conc-AK
 Winword/Conc-AL Winword/CVCK-1C Winword/CVCK-1D Winword/Cvck1e
 Winword/Dakota  Winword/Demon-a Winword/Dlitio3 Winword/Harkone
 Winword/HelperC Winword/HelperD Winword/Helpere Winword/Hypera
 Winword/Inside  Winword/Kill-b  Winword/Kill-c  Winword/Lunch-c
 Winword/Mini-N  Winword/Mini-O  Winword/NJDLK1H Winword/No-f-b
 Winword/Nucl-k  Winword/Ordo    Winword/Oval-A  Winword/Share-B
 Winword/Shuffle Winword/SimpleB Winword/Skamm-a Winword/Switchr
 Winword/TestAre Winword/Undergr Xore-581        Yd-25760
 Zany-266        Zany-268        Zany-274        ZhuZhou-1743
 ZW-1967         


                               ----------------


             Sophos Plc, The Pentagon, Abingdon, OX14 3YP, England
                   Tel +44 1235 559933 o Fax +44 1235 559935


              Sophos Inc, 18 Commerce Way, Woburn, MA 01801, USA
                      Tel 617 932 0222 o Fax 617 932 0251


                         Sales email sales@sophos.com
                 Technical support email technical@sophos.com
                          Web http://www.sophos.com/


