[ Last modified 30 June 1992 - Ken van Wyk ] Welcome to VIRUS-L/comp.virus! This document explains what VIRUS-L/comp.virus is, how to use the list, and presents guidelines for messages to the list. Please take a few moments and read this message; I suggest storing a copy of it for later reference as well. What is VIRUS-L/comp.virus? It is an electronic mail discussion forum for sharing information and ideas about computer viruses, which is also distributed via the Usenet Netnews as comp.virus. Discussions should include (but not necessarily be limited to): current events (virus sightings), virus prevention (practical and theoretical), and virus related questions/answers. The list is moderated and digested. That means that any message coming in gets sent to me, the editor. I read through the messages and make sure that they adhere to the guidelines of the list (see below) and add them to the next digest. Weekly logs of digests are kept by the LISTSERV (see below for details on how to get them). For those interested in statistics, VIRUS-L is now up to about 2400 direct subscribers. Of those, approximately 10% are local redistribution accounts with an unknown number of readers. In addition, approximately 30,000-40,000 readers read comp.virus on the USENET. As stated above, the list is digested and moderated (comp.virus postings are sent out individually). As such, digests go out when a) there are enough messages for a digest, and b) when I put all incoming (relevant) messages into the digest. Obviously, this can decrease the timeliness of urgent messages such as virus warnings/alerts. For that, we have a sister list called VALERT-L. It is "moderated on demand" and undigested. Messages sent to VALERT-L get sent out as quickly as possible (subscribers receive full instructions on how to post 24 hours a day). VALERT-L is for the sole purpose of rapidly sending out virus alerts. Anyone who does not adhere to this one guideline of VALERT-L will be immediately removed from the list. Subscriptions and deletions to VALERT-L are handled identically as those for VIRUS-L (see instructions below). What VIRUS-L is *NOT*? A place to spread hype about computer viruses. Contributing to rumors merely makes them worse. It is not a place to sell things, to panhandle, or to flame other subscribers. If anyone *REALLY* feels the need to flame someone else for something that they may have said, then the flame should be sent directly to that person and/or to the moderator (that would be me, krvw@cert.org). Is there a frequently asked questions (FAQ) document? Many network groups maintain a FAQ sheet to document commonly asked questions (and answers), primarily for newcomers to the lists. The VIRUS-L/comp.virus FAQ is available from many of the archive sites, including the anonymous FTP site at cert.org (192.88.209.5) in the pub/virus-l directory under the filename "FAQ.virus-l". Alternatively, the FAQ can be obtained by e-mail; simply send mail to LISTSERV@LEHIGH.EDU stating, "info virus-l". What sort of message is relevant to the group? Any message that is virus related and that adheres to the posting guidelines (see below) is relevant and will be posted. In the past, VIRUS-L has never restricted itself to any particular hardware/software platform, although most messages tend to be PC or Macintosh based. Nonetheless, discussions of viruses on other systems (e.g., UNIX) is allowed and, in fact, encouraged. My stance on moderating the group has always been (and will probably remain) that I make sure that a message is relevant to the group, and post it. I will avoid editorializing or altering messages, although I may toss in an additional point for clarity from time to time. That is to say, anyone who has something to say to the community may do so, within my guidelines. As a result, there will undoubtedly be some duplication from time to time. I invite your feedback on this. One thing to bear in mind when sending a message to this (or any) public forum is that you have a potentially *very* large audience - this group is read by an estimated 10000-20000 people around the globe. As such, it is advisable to be particularly careful about how you word things. More on this topic below in the guidelines... How do I get on the mailing list? Well, if you are reading this, chances are *real good* that you are already on the list. However, perhaps this document was given to you by a friend or colleague... So, to get onto the VIRUS-L mailing list, send a mail message to LISTSERV@LEHIGH.EDU. In the body of the message, say nothing more than SUB VIRUS-L your name. LISTSERV is a program which automates mailing lists such as VIRUS-L. As long as you are either on BITNET, or any network accessible to BITNET via gateway, this should work. Within a short time, you will be placed on the mailing list, and you will get confirmation via e-mail. How do I get OFF of the list? If, in the unlikely event, you should desire to be removed from the VIRUS-L discussion list, just send mail to LISTSERV@LEHIGH.EDU saying SIGNOFF VIRUS-L. People, such as students, whose accounts are going to be closed (for example, over the summer...) - PLEASE signoff of the list before you leave. Also, be sure to send your signoff request to the LISTSERV and not to the list itself. How do I send a message to the list? Just send electronic mail to VIRUS-L@LEHIGH.EDU and it will automatically be sent to the editor for possible inclusion in the next digest to go out. Comp.virus readers can use their news readers to post to the group - their postings will then be sent to me for possible inclusion in the next outgoing digest. What does VIRUS-L have to offer? All VIRUS-L digests are stored in weekly log files which can be downloaded by any user on (or off) the mailing list. Note that the log files contain all of the digests from a particular week. There is also a small archive of some of the public anti-virus programs which are currently available. This archive, too, can be accessed by any user. All of this is handled automatically by the LISTSERV at Lehigh University (LISTSERV@LEHIGH.EDU). Additional VIRUS-L archives are available on cert.org (IP number 192.88.209.5) via anonymous FTP. In addition to the archive at Lehigh, several other comp.virus sites maintain anti-virus archives for various computers. The list of these sites gets posted monthly to comp.virus. How do I get files (including log files) from the LISTSERV? Well, you will first want to know what files are available on the LISTSERV. To do this, send mail to LISTSERV@LEHIGH.EDU saying INDEX VIRUS-L. Note that filenames/extensions are separated by a space, and not by a period. Once you have decided which file(s) you want, send mail to LISTSERV@LEHIGH.EDU saying GET filename filetype. For example, GET VIRUS-L LOG8804 would get the file called VIRUS-L LOG8804 (which happens to be the monthly log of all messages sent to VIRUS-L during April, 1988). Note that, starting June 6, 1988, the logs are weekly. The new file format is VIRUS-L LOGyymmx where yy is the year (88, 89, etc.), mm is the month, and x is the week (A, B, etc.). Readers who prefer digest format lists should read the weekly logs and sign off of the list itself. Subsequent submissions to the list should be sent to me for forwarding. Internet users can access these same files via anonymous FTP to LEHIGH.EDU. Why have posting guidelines? To keep the discussions on-track with what the list is intended to be; a vehicle for virus discussions. This will keep the network traffic to a minimum and, hopefully, the quality of the content of the mail to a maximum. What are the guidelines? Try to keep messages relatively short and to the point, but with all relevant information included. This serves a dual purpose; it keeps network traffic to a necessary minimum, and it improves the likelihood of readers reading your entire message. Personal information and .signatures should be kept to the generally accepted maximum of 5 lines of text. The editor may opt to shorten some lengthy signatures (without deleting any relevant information, of course). Within those 5 lines, feel free to be a bit, er, creative if you wish. Anyone sending messages containing, for example, technical information should *PLEASE* try to confirm their sources of information. When possible, cite these sources. Speculating is frowned upon - it merely adds confusion. This editor does not have the time to confirm all contributions to the list, and may opt to discard messages which do not appear to have valid sources of information. All messages sent to the list should have appropriate subject lines. The subject lines should include the type of computer to which the message refers, when applicable. E.g., Subject: Brain virus detection (PC). Messages without appropriate subject lines *STAND A GOOD CHANCE OF NOT BEING POSTED*. As already stated, there will be no flames on the list. Such messages will be discarded. Politeness is strongly encouraged. The same goes for any commercial plugs or panhandling. Anything commercial looking will be deleted by the moderator. Responses to queries should be sent to the author of the query, not to the entire list. The author should then send a summary of his/her responses to the list at a later date. "Automatic answering machine" programs (the ones which reply to e-mail for you when you are gone) should be set to *NOT* reply to VIRUS-L. Such responses sent to the entire list are very rude and will be treated as such. When sending in a submission, try to see whether or not someone else may have just said the same thing. This is particularly important when responding to postings from someone else (which should be sent to that person *anyway*). Redundant messages will be sent back to their author(s). Postings of, or requests for, virus code (binary or disassembled) will be rejected. Thank you for your time and for your adherence to these guidelines. Comments and suggestions, as always, are invited. Please address them to me, krvw@cert.org. Ken van Wyk