Copy Link
Add to Bookmark
Report
Chaos Digest Volume 01 Numero 61
Chaos Digest Jeudi 24 Juin 1993 Volume 1 : Numero 61
ISSN 1244-4901
Editeur: Jean-Bernard Condat (jbcondat@attmail.com)
Archiviste: Yves-Marie Crabbe
Co-Redacteurs: Arnaud Bigare, Stephane Briere
TABLE DES MATIERES, #1.61 (24 Juin 1993)
File 1--40H VMag Number 7 Volume 2 Issue 3 #005(2) (reprint)
Chaos Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost by sending a message to:
linux-activists-request@niksula.hut.fi
with a mail header or first line containing the following informations:
X-Mn-Admin: join CHAOS_DIGEST
The editors may be contacted by voice (+33 1 47874083), fax (+33 1 47877070)
or S-mail at: Jean-Bernard Condat, Chaos Computer Club France [CCCF], B.P.
155, 93404 St-Ouen Cedex, France. He is a member of the EICAR and EFF (#1299)
groups.
Issues of ChaosD can also be found from the ComNet in Luxembourg BBS (+352)
466893. Back issues of ChaosD can be found on the Internet as part of the
Computer underground Digest archives. They're accessible using anonymous FTP:
* kragar.eff.org [192.88.144.4] in /pub/cud/chaos
* uglymouse.css.itd.umich.edu [141.211.182.53] in /pub/CuD/chaos
* halcyon.com [192.135.191.2] in /pub/mirror/cud/chaos
* ftp.cic.net [192.131.22.2] in /e-serials/alphabetic/c/chaos-digest
* cs.ubc.ca [137.82.8.5] in /mirror3/EFF/cud/chaos
* ftp.ee.mu.oz.au [128.250.77.2] in /pub/text/CuD/chaos
* nic.funet.fi [128.214.6.100] in /pub/doc/cud/chaos
* orchid.csv.warwick.ac.uk [137.205.192.5] in /pub/cud/chaos
CHAOS DIGEST is an open forum dedicated to sharing French information among
computerists and to the presentation and debate of diverse views. ChaosD
material may be reprinted for non-profit as long as the source is cited.
Some authors do copyright their material, and they should be contacted for
reprint permission. Readers are encouraged to submit reasoned articles in
French, English or German languages relating to computer culture and
telecommunications. Articles are preferred to short responses. Please
avoid quoting previous posts unless absolutely necessary.
DISCLAIMER: The views represented herein do not necessarily represent
the views of the moderators. Chaos Digest contributors
assume all responsibility for ensuring that articles
submitted do not violate copyright protections.
----------------------------------------------------------------------
Date: Tue May 11 09:24:40 PDT 1993
From: 0005847161@mcimail.com (American_Eagle_Publication_Inc. )
Subject: File 1--40H VMag Number 7 Volume 2 Issue 3 #005(2) (reprint)
<<<<<<<<<<
Article 3:
<<<<<<<<<<
Date: Mon, 06 Apr 92 14:18:09 -0400
>From: Joseph Halloran <JHLQC%CUNYVM.BITNET@BITNET.CC.CMU.EDU>
Subject: NY Newsday Article on McAfee & Viruses
(NOTE: The following article was published as a whole in the
April 5, 1992 edition of New York Newsday, page 68. It is reprinted
below without the express consent of Joshua Quittner, New York Newsday,
or the Times-Mirror Company)
SOFTWARE HARD SELL
------------------
"Are computer viruses running rampant, or is
John McAfee's antivirus campaign running amok?"
-By Joshua Quittner, staff writer
John McAfee is doing one of the things he does best: warning a
reporter about the perils of a new computer virus.
"We're into the next major nightmare -- the Dark Avenger Mutating
Engine," McAfee says, ever calm in the face of calamity. "It can
attach to any virus and make it mutate." The ability to "mutate"
makes it virtually undetectable to antivirus software, he explains.
"It's turning the virus world upside down."
But wait. This is John David McAfee, the man who once ran a service
that revolved around the curious premise that, if you paid him a member-
ship fee and tested HIV-negative, you could have AIDS-free sex with other
members for six months. This is the man who jumped from biological
viruses to computer viruses and quickly became a flamboyant expert on the
new demi-plague, showing up at the scene of infected PCs in his Winnebago
"antivirus paramedic unit."
And this is the same man who started something called the Computer
Virus Industry Association, and, as chairman, made national headlines
last month by saying that as many as _five million_ computers might be
infected with a virus named Michelangelo.
The virus turned out to be a dud, in the opinion of many industry
experts. But not before McAfee became a media magnet: In the weeks be-
fore March 6, when Michelangelo was supposed to erase the hard disks of
infected IBM and compatible PCs, he was featured by Reuters, the
Associated Press, USA Today, the Wall Street Journal, "MacNeil/Lehrer
News Hour," CNN, "Nightline," National Public Radio and "Today."
What some news reports failed to point out, however, is that McAfee
is also the man who runs Santa Clara, Calif.-based McAfee Associates,
a leading manufacturer of antivirus software, and that he stood to
benefit from publicity about Michelangelo. McAfee won't reveal sales,
but it seems clear they shot up during the two-week frenzy.
"People kept saying I hyped this, I hyped this," said McAfee, who
still defends the notion that Michelangelo was widespread. "I never
contacted the press -- they called me."
McAfee's detractors say the Michelangelo scare was mainly hype and
media manipulation, a parade in which most of the floats were built by
McAfee. They say McAfee helped drive the rush to buy antivirus soft-
ware -- with his products poised to sell the most -- while boosting the
profile of McAfee Associates, a company that recently received
$10 million from venture capitalists McAfee says are waiting to sell
stock publicly.
And, critics say, while McAfee touts a recent evaluation that rated
his software alone as 100 percent effective in finding virtually every
known virus, he funded the evaluation and picked his competitors.
"He does know the issue of viruses, no doubt about it," said Ken
Wasch, executive director of the 900-member Software Publishers Assoc-
iation. "But his tactics are designed to sell _his_ software."
McAfee says the media consistently misquoted him about how
widespread Michelangelo was. And his company didn't profit from the
virus, he says, but actually suffered due to the free advice his staff
was dispensing. "It does not benefit me in any way or shape or form
to exaggerate the virus problem."
Even McAfee's detractors admit his programs do what they're supposed
to do: track down coding that's maliciously placed in software to make it
do anything from whistle "Yankee Doodle" to erase valuable data.
His strongest distribution channel is shareware, a kind of software
honor system common on electronic bulletin boards. PC users can download
the programs over phone lines and pay later if they find them useful.
McAfee's programs are "probably the most popular shareware programs
of all time, second only to PKZIP," which compresses data, said George
Pulido, technical editor of Shareware Magazine. He said McAfee's
programs have been copied by millions of people, although only about 10
percent of shareware users actually pay.
A more reliable money-maker is corporate site licenses, where McAfee
is one of the three biggest players. Michael Schirf, sales manager of
Jetic Inc., a Vienna, Va., company that is McAfee's sales agent for the
Mid-Atlantic region, claimed more than 300 of the Fortune 500 companies
have licensed his software, paying $3,250 to $20,000, depending on the
number of PCs. During the Michelangelo scare, "you couldn't get through
to us at one point because of people asking about it and trying to get
it," Schirf said.
Certainly, McAfee's software wasn't the only antivirus software
selling. Fueled by giveaways of "special edition" programs that scanned
exclusively for the Michelangelo virus, sales of general antivirus
packages were a bonanza for everyone in the business, including Norton/
Symantec and Central Point Software, two other leading sellers.
"Our sales of antivirus software were up 3,000 percent," said Tamese
Gribble, a spokesman for Egghead Software, the largest discount software
retailer in the country. "We were absolutely swamped."
Rod Turner, a Norton executive vice president, said antivirus sales
increased fivefold. "We didn't make any product in advance," he said,
"so we were caught with our pants down." Companies like Norton that
sell factory-shipped software couldn't ramp up quickly enough to take
full advantage of the situation. But McAfee's software comes mostly
through electronic bulletin boards and sales agents, giving him a nearly
limitless capability to meet demand. "I can supply as many copies of the
software as I have blank diskettes to put it on," Schirf said.
The Michelangelo scare was also good for pay-by-the-hour on-line
information services such as Compuserve, which saw a huge increase in the
time users logged on looking for advice on Michelangelo.
Indeed, a virus forum on Compuserve was hugely popular, with users
downloading antivirus programs, including McAfee's, 49,000 times that
week, Compuserve spokesman Dave Kishler said. Compuserve made more than
$100,000 from the online time.
McAfee makes an attractive industry spokesman. Tall and lean, with a
mellifluous voice, he speaks in perfect sound bites -- an antidote to the
unquotably bland men who otherwise dominate the antivirus business.
A mathematician who got into programming when he graduated from
Roanoke College, McAfee, 47, said he has held a dozen jobs, ranging from
work on a voice-recognition board for PCs to consulting for the Brazilian
national phone company in Rio de Janeiro. His first mention in the media
was in connection with the American Association for Safe Sex Practices, a
Santa Clara club formed so that its members could engage in AIDS-free
sex. For a $22 fee, members whose blood tested HIV-negative were given
cards certifying them AIDS-free, buttons saying "Play it Safe," and were
entered on McAfee's on-line data base. Updates, every six months, cost $7.
Anyone who knows anything about AIDS knows a certificate that someone
is AIDS-free is good only until the person has sex with or shares an
intravenous needle with an infected person.
When asked now about the safe-sex group, McAfee at first denied
anything but a passing affiliation: "I worked for those people as a con-
tractor," he said, adding, "It was not my company." But later, when he
was reminded that both the San Diego Tribune and the San Francisco
Chronicle described him in feature stories as the entrepreneur who
started the organization ("I believe I am providing an environment
where people who are sexually active can feel more safe and secure,"
he told the Tribune in a March 9, 1987, story), McAfee sidestepped the
ownership question. He said the group performed a valuable function,
maintaining a data base on AIDS and information about the disease.
"I thought they were pretty well ahead of their time," he said,
quickly locating a 1987 newsletter put out by the group, which featured
articles such as "Kissing and AIDS" and "The Apparent Racial Bias of the
AIDS Virus."
The association no longer exists. "They came and went pretty fast,"
McAfee said, chuckling.
McAfee got his first taste of computer viruses at around that time.
"It was an accident, like anything else in life," he recalled. "I got
a copy of the Pakistani Brain. I think I got it from one of the local
colleges. It was the program of the year." The program, reportedly
written by two Pakistani students trying to foil software pirates,
destroyed some PC data.
By 1989, McAfee was a virus expert, selling the first antivirus
software and offering to make house calls with his Winnebago cum computer
lab.
"John's antivirus unit is the first specially customized unit to wage
effective, on-the-spot counterattacks in the virus war," McAfee and a
co-author reported in "Computer Viruses, Worms, Data Diddlers, Killer
Programs, and Other Threats to Your System," their 1989 book. "Event-
ually, there will be many such mobile search, capture and destroy anti-
virus paramedic units deployed around the world."
He had also founded the Computer Virus Industry Association, with
himself as chairman.
"The CVIA is nothing more than McAfee," said Wasch, of the Software
Publishers Association. "I had a run-in with him three years ago about
that." Wasch said he had been asked by other antivirus businesses to
look into McAfee's group after claims surfaced that he was railroading
companies into joining -- something McAfee vigorously denies. Wasch
said he believes the assocation was a self-serving group that did
little more than support McAfee's business.
"It would be like Microsoft creating the Windows Support Association
as a front to promote its Windows software," Wasch said.
McAfee denies the CVIA is a front and said Wasch's group was
threatened by the creation of the virus association. "They wanted to
take us over," he said. In any event, he said, the association is now
managed by others and his involvement is minimal, adding, "It's more of
a nuisance to me." But he does say the association is dependent on his
private business for much of its virus data. "McAfee Associates has all
the numbers," he said.
Detractors say McAfee now uses another association to hype his
programs.
The National Computer Security Association released one of the few
ratings of antivirus software, with McAfee's program on top -- a
comparison he's quick to cite. But that may be because he influenced
which software would be compared with his and how the tests were run,
said David Stang, who founded the for-profit association in Washington,
D.C., two years ago. Stang recently left the association and started
a new one after a falling-out with McAfee over testing procedures.
Stang said one of the assocation's functions was to "certify"
antivirus software -- to test and rate competing programs. "It was his
[McAfee's] idea that we certify products," Stang said. And when no
company rushed forward to pay $500 to have its software rated, McAfee
"sent me the products and the check and said 'go certify.'"
McAfee says he spent thousands of dollars to evaluate some of his
competitors' programs. In February, 1992, in fact, he paid for his own
and the other five programs to be certified. His was ranked 100 percent
effective. The others ranged from 44 percent to 88 percent effective.
"If your product competes with mine, I'd like for those customers of
mine to know that your product isn't as good as mine," he said. But in
the February certification, notably absent were McAfee's biggest
competitors: Dr. Solomon's ToolKit and Skulason's F-Prot.
"I've got 75 competitors. I pick the ones who are going to give me
the most trouble that month," McAfee explained.
The February evaluation was actually a second, and more favorable
test, that Stang says he performed at McAfee's request. Stang said
McAfee was dissatisfied with the assocation's methods -- it tested the
software against a "library" of viruses that McAfee thought wasn't
comprehensive enough. So Stang said he agreed to use a new library that
he claims was built on viruses McAfee found and supplied. Scores for
McAfee's program rose while some others dropped sharply. McAfee said
Stang's virus library was incomplete and his testing methods "wishy-
washy," and he defended the new library's independence.
"This is not something that anybody, let alone me, could mess with,"
said McAfee. "You can't jimmy these scores. You can't say that McAfee
buys more certifications, therefore he'll get a better score, because
other vendors would complain."
"They wouldn't let me get away with it."
[John McAfee]
<<<<<<<<<<
Article 4:
<<<<<<<<<<
From: Government Computer News
March 30, 1992
By: Kevin Power, GCN staff
"NIST Expert Warns Feds to Find Better Ways to Head Off Viruses"
BALTIMORE - In the wake of the Michelangelo scare, a top security
expert with the National Institute of Standards and Technology has
warned agencies against relying too heavily on virus scanning
software.
Anti-virus software ia a useful detection tool, but it often takes
too long to use and does not solve fundamental problems, said Dennis
Steinhauer, manager of the computer security evaluation group at
NIST's Computer Systems Laboratory. He spoke at the March meeting of
the National Computer System Security and Privacy Advisory Board.
Steinauer said the fallout from Michelangelo was minimal, thanks to
early detection, plenty of publicity and governmentwide [sic]
warnings. But he also stressed that vendors and agencies need more
effective methods of protecting against viruses in newly acquired
hardware and software.
"What were believed to be reliable channels may no longer be," he
said. "There's a lot that needs to be done to make sure that users
receive better assurances that products are not contaminated. This
incident may have undermined consumer confidence."
Steinhauer said one solution would be to build hardware and
operating systems that are less vulnerable.
For example, vendors can isolate the boot sector of a hard drive to
guard against infection. But agencies tend to shy away from such
serious measures, because they force managers make hard choices about
system functionality and user requirements, Steinhauer said.
"We have the technology to do what is necessary. But we don't know
what the price is to the user," he said. "The question is whether I'm
willing to have my machine hobbled for protection. It's similar to
installing a governor on a car to limit a vehicle's speed to 55 miles
per hour."
Agencies still are surveying for possible damage inflicted by
Michelangelo, Steinhauer said. But he said the incident showed NIST
officials that more agency computer emergency response teams (CERTs)
are needed.
CERTs, established in some agencies for just such attacks, worked
well, Steinhauer said. The teams coordinate their work through the
Forum on Incident Response and Security Teams, or FIRST.
But Steinhauer said it was evident that not enough agencies have
established CERTs.
Internal agency security teams did their jobs, but the government
needs a better way to distribute security advisories and handle
less-publicized emergencies, Steinhauer said.
<<<<<<<<<<<
Article 5A:
<<<<<<<<<<<
Date: 05-29-92 (21:06) Number: 3019 of 3059 (Echo)
To: BILL LAMBDIN Refer#: NONE
From: CHARLIE MOORE Read: NO
Subj: POLYMORPHIC VIRUSES 1/2 Status: PUBLIC MESSAGE
Conf: VIRUS (52) Read Type: GENERAL (+)
Note: This message is a repost -- I tied up the first by failing
to set the lines per message < 99. My apologies to all.
Bill, regarding how McAfee's Scan detects the DAME you stated:
BL>Trust me. It is still string searches. McAfee finds those three
BL>bytes, and then follows the steps to decrypt the virus to memory. If
BL>it continues long enough to possitively identify the DAME, Scan
BL>reports the virus, and looks at the next
Now, being in the security business, and probably a bit paranoid as a
result, when I see or hear "Trust me", I get a little queezy. I don't
know the source of your information Bill (perhaps you'll let us know)
but I don't think it's correct.
On May 11, 1992, McAfee Associates was featured in a news release about
the DAME -- Dark Avenger Mutation Engine No Threat to Protected PCs.
Below is a quote from this release that does not track with what you're
telling me (BTW, it was McAfee Associates who sent me the news
release -- did not see it until today though).
The Mutation Engine, however, uses a special algorithm to
generate a completely variable decryption routine each time.
"The result is that no three bytes remain constant from one
sample to the next," said Igor Grebert, senior programmer at
McAfee Associates. "This makes detection using conventional
string-matching techniques impossible."
Now, in my last message to you I stated that I understood three bytes
did remain constant (I got this info from two sources; Hoffman's Vsum204
and tech support at Fifth Generation Systems -- I now suspect Hofman is
wrong and tech support at Fifth Generation Systems was probably just
parroting Hoffman's Vsum. As I've stated before, solid technical
information about the DAME is limited!
Today, I called Igor Grebert at McAfee Associates to verify that he was
properly quoted in the news release -- he was. Igor would not tell me
in detail how McAfee's Scan detects the DAME; however, he did assure me
that searching for a three-byte string was not the technique used.
BL>CM> I don't think anyone, not even the Dark Avenger himself, can put an
BL>CM> accurate number on the possible virus mutations generated by the
BL>Again trust me. It is mathmatics pure and simple.
BL>the DAME randomly picks a 32 bit seed. Each bit will either be a 1 or 0.
BL>... according to my scientific calculator, or 4.3 billion possible
BL>combinations in english.
BL>If the numbers above ring bells, it is binary plain and simple.
Well Bill, I'm certainly not going to argue with your calculator. :-)
However, my point was, and remains, that the possible numbers associated
with a random seed are not necessarily equal to the possible number of
mutations the DAME is capable of generating. Now, as I stated to you
in my original message, solid information on the DAME (in particular,
how it works interactively with its various segments of code) is
limited. Even the most experienced and best qualified researchers
often don't agree on certain aspects and more than a few questions
remain about the limits of variability and related issues.
Below is the latest and best info I've seen that gives some insight
into the complexity here. The message was posted on the Internet's
Virus-L Conference; its author, Vesselin Bontchev, is one of the
most highly respected virus researchers in the world.
Date: 21 May 92 22:11:43 +0000
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Detecting the MtE (PC)
Almost half an year has passed since the Dark Avenger's Mutating
Engine (MtE) has been made available to the anti-virus researchers.
Currently several scanners claim to detect it with "100 %
reliability". Do they really succeed however?
We decided to run some tests at the VTC. The tests are preliminary and
were performed by Morton Swimmer. The Fear virus was used (a minor
Dedicated patch) to generate 9,471 infected files. The files were
generated by the natural infection process - the reason was to also test
the randomness of the random number generator supplied with the MtE. Of
those 9,471 infected examples 3 turned out to be duplicates, which
yelded to 9,468 different instances of the virus. It also means that the
random number generator is rather good...
Those examples filled a 40 Mb disk (which didn't permit us to generate
10,000 different examples, as we wished initially). We wanted to keep
them all, in order to be able to reproduce the tests.
The three scanners were run on those virus samples. The scanners were
the three that showed best detection rate on our collection, merely
Dr. Solomon's FindVirus (version 4.15 with drivers from May 15, 1992),
Fridrik Skulason's F-Prot 2.03a, and McAfee's SCAN 89-B.
All the three scanners failed the test, each in a different way.
FindVirus showed the worst results. It did not detect 744 virus
samples (7.86 %). F-Prot did not detect 13 examples (0.14 %). SCAN did
not detect 4 examples (0.04 %). SCAN shows the best detection rate in
the case of MtE, but we also got a report for one false positive.
For the average users the above rates might appear to be high enough.
What are 4 undetected infected files when almost 10,000 infected ones
have been properly detected? Well, it does matter. When you are
looking for a particular known virus, anything below 100 % detection
means that your program fails to detect it reliably. Rmember that a
single not detected file may re-start the epidemy.
There is another thing to be concerned about. The MtE uses a 128-byte
random number generator, which means that theoretically it can exist
in 2^512 different variants. And 0.04 % of this is still quite a
CM> [Hmm... yet a different number of possible mutations?]
lot... Suppose that some virus writer runs the same tests (or even
more elaborate ones) and determines for which values of the random
number generator the virus is not detected. Then he can create a new
random number generator (the MtE provides the possibility for
user-supplied random number generators to be plugged in), which
generates -only- those values... Such a virus will not vary a lot, but
it will still mutate and -all- its mutations will escape that
particular scanner...
As I mentioned in the beginning, those were only preliminary tests. We
intend to modify the random number generator so that it will generate
consecutive (instead of random) numbers and to create a few hundreds
thousands mutations by keeping only those which a particular scanner
does NOT detect. We'll then re-run the tests for random ranges of
consecutive mutations. All we can say now is that neither of the three
scanners mentioned above is able to detect MtE-based viruses with 100
% reliability.
Currently I am aware of the existence of at least three other scanners
which claim 100 % detection of the MtE. One comes with the new version
of V-Analyst III, the second has been designed by IBM, and the third
is Dutch scanner. As soon as we get them we'll re-run the tests.
Regards,
Vesselin
----------------------End of Vesselin's Message----------------------
Bill, I'll follow up on the subsequent tests Vesselin intends to run and
report the results to you.
One thing I've learned in this business is that accurate and solid
information is sometimes hard to come by and the experts don't always
have all the answers. Although I think Vesselin's above message is
pretty solid, I also think he fails to consider something: on the one
hand, he states a theoretical 2^512 (in contrast, your number is 2^32)
different variants; yet, his empirical data produces 3 duplicate
mutations from a run of less than 10 thousand. I think this is rather
odd from a statistical perspective.
Regards,
Charlie Moore
<<<<<<<<<<<
Article 5B:
<<<<<<<<<<<
Date: 05-30-92 (15:08) Number: 3021 of 3059 (Echo)
To: BILL LAMBDIN Refer#: NONE
From: CHARLIE MOORE Read: NO
Subj: POLYMORPHIC VIRUSES Status: PUBLIC MESSAGE
Conf: VIRUS (52) Read Type: GENERAL (+)
Bill, here's a followup post from Vesselin regarding the DAME:
-----------------Extracted from Internet's Virus-L--------------------
Date: 27 May 92 08:44:06 +0000
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: Detecting the MtE (PC)
bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
> MtE. Of those 9,471 infected examples 3 turned out to be duplicates,
> which yelded to 9,468 different instances of the virus. It also means
Correction: a fourth duplicate has been found later. Therefore the
total number of generated different mutations used during the test is
only 9,467.
> Currently I am aware of the existence of at least three other scanners
> which claim 100 % detection of the MtE. One comes with the new version
> of V-Analyst III, the second has been designed by IBM, and the third
> is Dutch scanner. As soon as we get them we'll re-run the tests.
We tried out the Dutch scanner. Its authors were present during the
test. When they saw the results, they decided that the program is not
ready to be tested yet and promised to send us a fixed version soon... :-)
We just received the V-Analyst III scanner; we haven't tested it yet.
As soon as the test is performed, I'll post the results.
Meanwhile we received and tested yet another scanner which claims "100%
detection of the MtE-based viruses". It is a German product, called
AntiVir IV and produced by H+BEDV. The version tested was 4.03 of May
15, 1992, beta version. It missed 584 mutations (6.17 %).
Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226 Fachbereich Informatik - AGN
** PGP public key available by finger. ** Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de D-2000 Hamburg 54, Germany
------------------------------
End of Chaos Digest #1.61
************************************
