🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.virus
Article #4487

New Virus? (PC)

#4487
From: PETI1010
Date: Fri, 07 Jun 1991 22:35
32 lines
2146 bytes
Hello Netlanders,

we yesterday observed strange behaviour on one PC with 386 DX (in
Osnabrueck W-Germany). Chkdsk reported an "Allocation error, size
adjusted" on several Exe-Files. For example KRNL386.EXE and KERNEL.EXE
of Win 3.0 but not the KRNL286.EXE. Windows worked only in
Standard-Mode but in Real and 386 Enhanced the System crashed.
Scanning the HD after booting from Floppy (I hope a clean one :-))
with F-PROT 1.15a and SCAN v 77 revealed nothing.

Restoring the obviously damaged files we observed an increase of the
File-Length of 4280 bytes in case of the damaged (infected ?!) files.
Maybe any kind of Tequila shows his (ugly :-() face?

Any suggestions?

Regards, Frank Petersen

B.t.w.: I'll send a copy of an infected file together with the
uninfected version to Ken. Maybe he'll be so kind to pass it to the
masses of famous :-) and intelligent (and so on) virus researchers, so
they can have a close look at the nasty stuff. (Thanks Ken).

****************************************************************************
*      _________      _________     *                                      *
*     /  ______/     /  ___   /     * via EARN/BITNET:  PETI1010 @ DOSUNI1 *
*    /  /____       /  /__/  /      *                                      *
*   /  _____/      /  _____ /       * via FIDONET:  (2:245/20.9)           *
*  /  /           /  /              *                                      *
* /__/  rank     /__/  etersen      * Reserved for future expansion        *
*                                   *                                      *
****************************************************************************
Technical Details
Message-ID: <0013.9106101933.AA10096@ubu.cert.sei.cmu.edu>
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!sample.eng.ohio-state.edu!purdue!news.cs.indiana.edu!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!rpi!zaphod.mps.ohio-state.edu!sample.eng.ohio-state.edu!purdue!news.cs.indiana.edu!widener!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: PETI1010@DOSUNI1.BITNET
Newsgroups: comp.virus
Subject: New Virus? (PC)
Message-ID: <0013.9106101933.AA10096@ubu.cert.sei.cmu.edu>
Date: 7 Jun 91 22:35:16 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 32
Approved: krvw@sei.cmu.edu