Message-Id: <m0zdHeI-000S4NC@inti.gov.ar>
Comments: Authenticated sender is <salvador AT natacha DOT inti DOT gov DOT ar>
From: "Salvador Eduardo Tropea (SET)" <salvador AT inti DOT gov DOT ar>
Organization: INTI
To: djgpp-workers AT delorie DOT com
Date: Tue, 10 Nov 1998 14:37:51 +0000
MIME-Version: 1.0
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Subject: Re: virus in g++
In-reply-to: <199811101622.LAA13507@indy.delorie.com>
X-mailer: Pegasus Mail for Windows (v2.54)
Reply-To: djgpp-workers AT delorie DOT com

DJ Delorie <dj AT delorie DOT com> wrote:
 
> http://www.delorie.com/djgpp/bugs/show.cgi?000257
> 
> When Created: 11/09/1998 10:00:26
> Against DJGPP version: 2.01
> By whom: ewj AT ix DOT netcom DOT com
> Abstract: virus PCBB.3072.C detected by virus sweep in v2gnu/gcc281b.zip & lgp281b
> 
> I found virus PCBB.3072.C detected by virus sweep in v2gnu/gcc281b.zip & 
> lgp281b in two ftp sites, simtel and dec.  The virus was reported as 
> unremovable.  I am at odds as to how to go forward and acquire a clean copy.
> My own system was recently destroyed by an extremely nasty virus.  I wish
> everyone only the best here.

My copy from Simtelnet doesn't look infected. This looks like a false alarm 
triggered by some routine inside the binaries.
Of course I did a simple check, not studied the code, but the entry point is 
inside the stub, the COFF header looks ok, etc.
What antivirus is reporting it? does anybody know it?

SET 
------------------------------------ 0 --------------------------------
Visit my home page: http://set-soft.home.ml.org/
or
http://www.geocities.com/SiliconValley/Vista/6552/
Salvador Eduardo Tropea (SET). (Electronics Engineer)
Alternative e-mail: set-soft AT usa DOT net set AT computer DOT org
ICQ: 2951574
Address: Curapaligue 2124, Caseros, 3 de Febrero
Buenos Aires, (1678), ARGENTINA
TE: +(541) 759 0013