🚀 go-pugleaf

rtravsky@CORRAL.UWyo.Edu (Richard W Travsky) writes:

>This appeared in a recent Info-Ibmpc digest.  Figured I'd pass it on.
> ...deleted...
>From: David Kirschbaum <kirsch@usasoc.soc.mil>
>Subject: Reported QEMM virus

>Received from the Fido Dr. Debug Echo, 1 Jan 91.
>David Kirschbaum
>Toad Hall

>FROM:    Richard Crain                 Area # 23 (    Dr. Debug     )
>TO:      ALL
>SUBJECT: Virus

>I have found what appears to be a virus on the factory supplied disk
>from Quarterdeck on the QEMM386 V5.1 diskette in the Optimize.com amd
>install.exe programs. These 2 programs contain a HEX signature of
>EAF0FF00F0 which indicates the possible presence of the 648 virus.

I have checked my QEMM v5.0 master disks and find this signature also
occurs in the same named files, but which are obviously much older.
They are dated 9 March 90 on my disk. I have been using QEMM v5.0 for
a good few months (can't remember exactly when I bought it) and have
had no reason to suspect virus infection of my system. The age of QEMM
v5.0 without apparent virus report is interesting.

In addition, McAfee's scan program 5.1v67 fails to complain about QEMM
v5.0 or v5.1 despite manual inspection showing that the signature does
appear as reported above. A "Vienna/648" virus is described in the
McAfee documentation.

This is all fairly re-assuring to me, but it is possible that this
is a dormant virus just waking up. It needs further investigate (by
Quarterdeck I guess), but caution rather than panic seems appropriate.

Hope this adds to the investigation.

[Ed. Please see followup below!]

Mark

- --
 ----------------  Eml: mrh@camcon.co.uk or mrh@camcon.uucp
|   Mark Hughes  | Tel: +44 (0) 223 420024   Cambridge Consultants Ltd.
|(Compware & CCL)| Fax: +44 (0) 223 423373   The Science Park, Milton Road,
 ----------------  Tlx: 81481 (CCL G)        Cambridge, CB4 2JB, UK.