Re[2]: [Avcheck] Is tanatos a "faker"?

[Sergey Akhapkin]

Hello Ralf,

Friday, October 4, 2002, 2:56:55 PM, you wrote:

>> presume for what is it worth. But where it is in the infected script,
>> or better yet, how to add one?
RH> Here:
RH> --- infected~   Thu Aug 15 16:21:39 2002
RH> +++ infected    Thu Oct  3 17:02:02 2002
RH> @@ -66,7 +66,7 @@
RH>           # Set one of INFORM_SENDER or BOUNCE to y, or
RH>           # sender will receive tow (non)delivery notifications
RH> -FAKERS="(klez)"
RH> +FAKERS="(klez|tanatos)"
RH> # list of viruses known to forge sender address
RH> # (egrep pattern, use "|" to separate names)

Tanatos, by others classifications (DrWeb :), McAfee, NAV, ) has name
bugbear, so you can add bugbear too.


Best regards, 
         Sergey Akhapkin <asv@drweb.ru>
             Software Developer
   ID Antivirus Lab <http://www.drweb32.com>