

                            Sophos Anti-Virus news
                            ----------------------

                           Version 3.22, June 1999


SWEEP has been updated with new virus information.

Release notes
-------------

Release notes are available only in electronic form.

8086/80286 support will be dropped
----------------------------------

From June 1999 Sophos will no longer be supporting 8086/80286-based DOS PCs.
This is in preparation for the introduction of an extended DOS version of
Sophos Anti-Virus for DOS, which will only run on 80386 or later processors.
The execution speed will be significantly increased.

Sophos courses
--------------

An enhanced schedule of courses has been launched by Sophos.  These one- and
two-day events are being held in the Sophos' training suite in Abingdon,
England.

The number of delegates on all courses is limited to 16.

For more details about these events, contact Edward Rowley at Sophos UK (email
edward.rowley@sophos.com).  Please contact us if you would like to run any of
these courses on your site.

Anti-virus: A Practical Approach
--------------------------------

A two-day hands-on course which gives delegates an opportunity to experiment
with real, live, computer viruses in a controlled environment.

The course will be held on 15th/16th June, 14th/15th July, 15th/16th September
and 17th/18th November 1999.

Best Practice for Sophos Anti-Virus
-----------------------------------

A one-day hands-on course for users of Windows NT networks enabling them to
get maximum benefit from the advanced features of SAV.

The course will be held on 16th July, 17th September and 19th November 1999.

Implementing Windows NT Security
--------------------------------

A two-day hands-on course giving practical experience of the strengths and
weaknesses of Windows NT, also covering audit practice and the use of native
and third-party audit tools.

The course will be held on 7th/8th July and 26th/27th October.

Advanced Internet Security
--------------------------

A one-day examination of the risks associated with connecting an organisation
to the Internet.  Practical advice on encryption, firewalls and auditing will
be given.

The course will be held on 6th July and 25th October.

Investigating Computer Crime and Misuse
---------------------------------------

A two-day briefing discussing the skills and methods required to secure
admissible evidence of computer misuse.

The course will be held on 10th/11th November.

Most commonly reported viruses in April 1999
--------------------------------------------

XM/Laroux 24.15%, W95/CIH-10xx 12.69%, W32/Ska-happy99 11.76%, WM97/Footer
9.91%, WM97/Marker-D 9.60%, WM97Ethan 8.67%, WM97/Melissa 5.88%, WM97/Class
2.79%, OF97/Crown 1.86%, WM97/Groovie-B 1.86%.

For more information on these and other viruses, select 'View', 'Virus
library' in SW.

Viruses added this month
------------------------

AntiPascal-440d Bat/Alek        Bat/Orag        Bat/SYS-687
Bat/VR-718      Beer.3230       Bny-1406        BW-1433
Cathinone-440   Cathinone-480   Delta-1177      Dpvg6032
Ebola.305       EvilHomer.206   Fayte-241       FidoSpy-15000
Friend-330      Goma-1002       Goma-1343       Goma-1551
Goma-353        Goma-743        Heartbreak-135  HLL.Scheriff
HLLC-6016-A     HLLO-4144       HLLO-4208       HLLO-4240C
HLLO-4496       HLLO-4720C      HLLO-5120       HLLP-4208-B
HLLP-4432-E     HLLP-4480-C     HLLP-4480-D     HLLP-4496-B
HLLP-4560       HLLP-4576-B     HLLP-5192       HLLP-Ppz-8586
Hllp.5701       Hllp/Deft-8576  HLO-4544        Hotdog.1624
IOSYS           Istanbul-1385   IVP-350         Joke/Scared
Junk/AnsiVir    Junk/Atten394   Junk/Bomb-1371  Junk/Cokegift
Junk/Drop-Amse  Junk/EMP-1045   Junk/Filehider  Junk/Frost
Junk/gotcha     Junk/Hald-614   Junk/Hide-1741  Junk/HLLP-6002
Junk/Holocast-b Junk/Hydra-371  Junk/Joan.1285  Junk/Kennedy
Junk/Lep1874    Junk/Lesson205c Junk/Linux/Dmbr Junk/Linux/Dumb
Junk/Michelan-G Junk/Ninnyish   Junk/Nukepox    Junk/Oneh-3544
Junk/OverDoz472 Junk/Pushe739   Junk/Sentinalb  Junk/Vienn767
Junk/Vienna-612 Junk/Vienna-623 Junk/Vienna-943 Junk/Vienna.b
Junk/Vienna.V   Junk/Vlad-1221  Junk/Yank-1049  Lazarus.2222
Linux/ls        Lochemuse-1804  Massive-386     McMahon-1372
Mid/Troj/L12722 Mid/W95/Yur1167 mIRC/MrWormy    Nelson-226
Ninny-709       Ninnyish-385    NohKS-1972      Nomad-1022
Onkelz-517A     Outsider.1402   PM97/Kelly      PM97/ShapeMastr
PM97/ShapeShift PM97/Vic-A      Restive-543     Septic-45xx
SillyORC-147A   SlamHunter-253  SMF.1508        SMF.431
SnakeByte-787   Spreader-1800   Tazman-706      Traveller-1261
Trivial Duke    Trivial-121     Trivial-140     Trivial-150
Trivial-455     Troj/AngNeb     Troj/AntiMDa    Troj/AOL-PWD-A
Troj/AOL-PWD-B  Troj/AOL-PWD-C  Troj/AOLPS-CJ   Troj/Aolps-hp
Troj/AOLPS-S    Troj/BadBoyKill Troj/Boa        Troj/Cara
Troj/Cindy      Troj/DirtyGuy   Troj/Dou        Troj/Dou-B
Troj/Echokeys-B Troj/ExecCtrl-C Troj/Faxukr     Troj/FormatD
Troj/Gotyou     Troj/ICQpassn-B Troj/Imitator   Troj/Kitana-d
Troj/Kuang      Troj/Madzumba   Troj/Mbr-Wipe   Troj/Munga
Troj/Netspy.110 Troj/Netspy106  Troj/PageFault  Troj/PSW-Update
Troj/Setup-TTT  Troj/Sockets-B  Troj/Spion-A    Troj/Spion-B
Troj/Stealth-A  Troj/Stealth-B  Troj/THDetect   Troj/W32/Ystl
Troj/W32sys-2   Troj/Webex13    Troj/Whiplash2  Troj/Winhalt
Troj/WinSex     Troj/Winsnake-B Troj/Winspy     Troj/Wiper
V-731           V-926           VBS/Belalang    VBS/Nomercy
VBS/Nomercy-b   VBS/Smile       W32/Cabanas     W32/Cabanas-B
W32/HLL-186380  W32/HLL-ChevalB W32/HLLP-Cheval W32/HongKo-4096
W32/JokeDebug   W32/Net666      W32/Parvo-A     W32/Phunk
W32/Redemption  W32/Semisoft    W32/Semisoft-B  W32/Semisoft-D
W32/Shaitan3390 W95/Fabi-A      W95/Jezebel-676 W95/Nigr0
W95/Regswap1644 W95/Sadness     W95/Stupid-A    W95/Stupid-b
W95/Suk         WM/Balu-A Troj  WM/Dzt-C        WM/ENF Kit
WM/Muck-AO      WM/PayCheck     WM97/Class-AE   WM97/Cypress-A
WM97/Dwmvck Kit WM97/Example-A  WM97/Fabi-A     WM97/Flitnic
WM97/Footer-E   WM97/Jerk       WM97/Kdp        WM97/Marfan
WM97/Mimir-A    WM97/Newhope-A  WM97/Sin-C      WM97/Suck-1 Kit
WM97/SWlabs-U   WM97/Troz-A     WM97/Ump Kit    WM97/Undead
WM97/Vmpck-Kit  WM97/Vvsc-B Kit WM97/Yozak-A    WM97/Yozak-B
WM97/Yozak-D    WM97/Zmkmail    Worm/M-173      XM/Laroux-EE
XM/Laroux-FU    XM/Laroux-GW    XM/Laroux-IC    XM/Laroux-IR
XM/RenameB Troj XM/Uedasan-D    XM97/Laroux-AF  XM97/Laroux-GW
XM97/Laroux-GY  XM97/Laroux-IR  Zorm-1412       Zorm-1863
Zorm-265        Zorm-458        Zorm-464        Zorm-495
Zorm-573        


                               ----------------


            Sophos Plc, The Pentagon, Abingdon, OX14 3YP, England
                     Tel 01235 559933 o Fax 01235 559935

   Sophos Pty Ltd, Level 4, 725 George Street, Sydney, NSW 2000, Australia
                     Tel 02 9212 1600 o Fax 02 9212 1788

  Sophos Plc, 2, Place de la Defense, BP240, 92053 Paris la Defense, France
                   Tel 01 46 92 24 42 o Fax 01 46 92 24 00

         Sophos GmbH, Am Hahnenbusch 21, D-55268 Nieder-Olm, Germany
                      Tel 06136 91193 o Fax 06136 911940

              Sophos Inc, 18 Commerce Way, Woburn, MA 01801, USA
                     Tel 781 932 0222 o Fax 781 932 0251


                         Sales email sales@sophos.com
                  Technical support email support@sophos.com
                          Web http://www.sophos.com/


