===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : CERT-NL (Erik-Jan Bos)                      Index  :    S-93-03
Distribution  : SURFnet constituency                        Page   :          1
Classification: External                                    Version:     Final
Subject       : Virus in file ypcbr101.zip on Simtel        Date   :  11-jan-93
===============================================================================

CERT-NL has received information that the file named "ypcbr101.zip" on
the Simtel Archive contained a virus. The attached note was posted to
comp.binaries.ibm.pc.archives. The offending file has been removed from
Simtel20. However, if you downloaded it while it was on-line, please
read this note carefully and take appropriate actions.

--- Start of original posting

Newsgroups: comp.binaries.ibm.pc.archives
From: johnm@bowen.cc.utas.edu.au (John Miezitis)
Subject: #### VIRUS found in file ypcbr101.zip on simtel archive.
Organization: University of Tasmania, Australia.
Date: Mon, 11 Jan 1993 00:32:42 GMT

The zip archive ypcbr101.zip was downloaded from Simtel-20 and the oak
mirror on archie.au and both files were found to contain the 1800
variant of Dark Avenger in the executable yapcbr.exe. The file was
unzipped and then tested using F-PROT206a which was able to remove the
virus.

Adminstrators at both these sites will be informed as will the author
of the program.

_______________________________________________________________________________
John B Miezitis, University of Tasmania, Computing Centre. Ph +61 02 202811
email: John.Miezitis@cc.utas.edu.au | Belgium man Belgium!!! - Z. Beeblebrox
_______________________________________________________________________________

--- End of original posting

CERT-NL wishes to thank Ken Van Wyk of CERT/CC for distributing this
information.

==============================================================================
CERT-NL is the Computer Emergency Response Team, located in The
Netherlands. CERT-NL is a Full Member of the Forum of Incident Response
and Security Teams (FIRST). The constituency of CERT-NL are the SURFnet
connected institutions.

Past CERT-NL Security Bulletins and other CERT-NL related material can
be found on the anonymous FTP server of SURFnet bv:
"ftp.nic.surfnet.nl" [192.87.46.3], in the directory "netman/cert-nl".
This information is also available using email. Send an email saying
"help" to "mailserv@nic.surfnet.nl".

In case of computer or network security problems please contact CERT-NL
or the CERT of your own constituency. Please be aware of the fact that
we are are one hour ahead of Universal Time Coordinated (i.e. UTC+0100).
Email:     cert-nl@surfnet.nl
Phone:     +31 30 310290
Fax:       +31 30 340903
Snailmail: SURFnet bv
           Attn. CERT-NL
           P.O. Box 19035
           NL - 3501 DA  UTRECHT
           The Netherlands
A 7*24h phonenumber is available to SURFnet SSC's and FIRST members on request
==============================================================================