Hare Virus to strike computers on Aug. 22; Cheyenne develops cure; Hare Virus will delete infected hard drives on Aug. 22 and Sept. 22.

ROSLYN HEIGHTS, N.Y.--(BUSINESS WIRE)--Aug. 5, 1996--Cheyenne Cheyenne Software, Inc. (AMEX: CYE) today announced a cure for the Hare computer virus.

The Hare virus is difficult to detect through traditional anti-virus software and is considered a severe and highly destructive threat.

The virus is set to strike on August 22nd and September 22nd. On these dates, Hare will destroy all data on an infected PC by overwriting the computer's hard drive.

Cheyenne has posted a free update that detects and cures the Hare virus using Cheyenne InocuLAN and Cheyenne AntiVirus software products. The update is available through Cheyenne's Security Center at http://www.cheyenne.com/security on the World Wide Web. The company strongly recommends that users download the free update and use it to examine and inoculate their PCs against the Hare virus before August 22nd.

"Cheyenne's charter is the protection of users' valuable data from a variety of malicious and accidental threats," commented Peter Harrison, marketing manager of security products at Cheyenne. "Our expertise in data security allows us to quickly develop detection schemes and cures when new threats like the Hare virus arise."

The Hare virus was first distributed over the Internet in May of this year. Since then, two other versions of the virus have also been distributed in files on a variety of Internet usenet newsgroups. The Hare virus has been detected in the United States, Canada and Europe.

Perhaps the most widespread posting of the Hare virus was in the pkzip300.exe file on the alt.comp.shareware newsgroup. Users unwittingly can infect their PCs by simply downloading and executing this file. Hare first infects the master boot sector of the PC and, when the PC is restarted, installs itself into memory, thereby contaminating .COM and .EXE files. Hare can avoid detection by traditional anti-virus software by remaining dormant within infected files and slowly changing as it replicates.

PCs infected with Hare will display the message "HDEuthanasia..." when the PC is restarted on August 22nd or September 22nd. Hare will then overwrite the entire hard drive, deleting all data. After attempting to destroy all data on the PC, Hare returns to dormancy and may then replicate to any floppy diskette used to recover and reboot the damaged PC.

"The Hare virus is one of the most complex viruses in the wild today," commented Ian Whalley, editor of Virus Bulletin, a U.K.-based computer security publication. "This virus will certainly present serious problems to users who come into contact with it and who do not have adequate protection installed on their systems."

Cheyenne posts free monthly signature file updates for all of its anti-virus products on the Cheyenne Security Center World Wide Web site, CompuServe forum (GO CHEYENNE), and local Bulletin Board Services. Free live trial demos of Cheyenne's anti-virus solutions can also be downloaded.

InocuLAN and Cheyenne AntiVirus are available through computer resellers worldwide and Cheyenne AntiVirus is available in U.S. retail outlets that include CompUSA, Computer City and Egghead Software. Versions of Cheyenne's anti-virus solutions are available for Windows NT, Windows 95, Windows 3.1, NetWare, DOS and Macintosh.

Changing Virus Threats

In addition to the Hare virus, 1996 has been a year with many new viruses, especially new macro viruses and advanced polymorphic viruses. Macro viruses are written in the macro languages of popular applications, such as Word, Excel and AmiPro. They attach to and infect these documents and can be spread by simply being opened. Polymorphic viruses are so named because they avoid detection by periodically changing themselves, making detection by anti-virus software more difficult.

In the past, boot sector viruses were the most common viruses but were often slow to spread because doing so typically required booting from an infected floppy disk. However the rise of macro viruses, which can be transferred via file servers, e-mail and Internet downloads have dramatically increased the frequency of virus incidents. In response to these new threats, Cheyenne recently announced new AntiVirus Agents that enable organizations to detect and cure e-mail-borne viruses in Lotus Notes, Microsoft Exchange and

Novell GroupWise.

It is also important to note that many of the new viruses are not directly destructive -- however the costs associated with user panic and wasted time can be considerable. Fortunately, Cheyenne InocuLAN and Cheyenne AntiVirus can detect and cure all known viruses in general distribution.

Other New Viruses

Below is a brief summary of the more significant viruses introduced this year. For more details on viruses, visit the Cheyenne Security Center on the Web at http://www.cheyenne.com/security.

Concept Virus - Attaches to and infects Microsoft Word documents and is the most common virus in existence (NCSA Survey, April 1996). Once a document infected with the Concept virus is opened, the virus will affect the user's master template and infect all future Word documents. Fortunately, the most common strain of Concept is not destructive and simply displays the message "Just to prove a point."

Laroux Virus - The first reported Excel macro virus, it attaches to and infects Microsoft Excel documents. Once a document infected with the Laroux virus is opened, the virus will infect all future Excel documents. Fortunately, Laroux is not destructive as it simply creates a blank worksheet. Still, more destructive strains of Laroux are possible.

Nuclear Virus - Another Microsoft Word macro virus which is less common than Concept but more damaging. Nuclear has a variety of payloads that range from adding the message "Stop All French Nuclear Testing..." at the end of printed documents to causing system crashes when it attempts to create another virus in the master boot sector of the PC.

Tentacle Virus - Like the Hare virus, Tentacle is a polymorphic virus which is able to avoid detection by many anti-virus software products. It infects Windows programs changing their icons to a Tentacle. When Tentacle replicates, it leaves behind different strains, some easier to detect than others.

About Cheyenne Software, Inc.

Cheyenne Software, Inc. is an international developer of storage management, security and communication software solutions for the Windows NT, Novell NetWare, UNIX, Macintosh and OS/2 markets. Its products include Cheyenne(R) HSM, JETserve(TM), InocuLAN(R), FAXserve and its flagship product line, the ARCserve(R) family of network backup software, among other desktop and enterprise offerings. Cheyenne's products are distributed though reseller channels, retail, original equipment manufacturers and a direct force. Cheyenne can be contacted at [phone] (US or Canada) or [phone], or by visiting its WWW home page at: http://www.cheyenne.com. -0-

Product and company names are used herein for identification purposes only, and may be trademarks of their respective owners. Microsoft, Windows NT, and BackOffice are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. GroupWise is a trademark or registered trademark of Novell Corporation. Lotus Notes is trademark of Lotus Development Corp.

CONTACT: Pam Leeds

Cheyenne Software, Inc.

[phone]

[e-mail]

or

Chris Nahil

FitzGerald Communications, Inc.

[phone]

[e-mail]