Possible PC Virus (PC)

Article View: comp.virus

Article #4556

#4556

From: Rob Slade
Date: Tue, 18 Jun 1991 03:51

20 lines
1348 bytes

7340P@NAVPGS.BITNET (robert c. morales) writes:

> replicated themselves with such names as EDLIN._OM and AUTOEXEC._AT,
> all of which were 77 bytes in size with the same dates and times. This
> necessitated reformatting the hard drive. Also, the Dosshell was

Ouch.

I don't want to take any guesses as to your approximately 15K file, but I
would venture that someone has been wandering around your office with a
copy of Norton Antivirus, right?  The 77 byte files are the "file
signatures" that it uses to detect changes in infected programs.

=============
Vancouver          p1@arkham.wimsey.bc.ca   | "If you do buy a
Institute for      Robert_Slade@mtsg.sfu.ca |  computer, don't
Research into      (SUZY) INtegrity         |  turn it on."
User               Canada V7K 2G6           | Richards' 2nd Law
Security                                    | of Data Security

Technical Details

Message-ID: <0013.9106181359.AA17901@ubu.cert.sei.cmu.edu>

Path:

arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!samsung!think.com!zaphod.mps.ohio-state.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!samsung!think.com!zaphod.mps.ohio-state.edu!ub!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: p1@arkham.wimsey.bc.ca (Rob Slade)
Newsgroups: comp.virus
Subject: Possible PC Virus (PC)
Message-ID: <0013.9106181359.AA17901@ubu.cert.sei.cmu.edu>
Date: 18 Jun 91 03:51:07 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 20
Approved: krvw@sei.cmu.edu