VIRUS-L Digest Friday, 28 Feb 1992 Volume 5 : Issue 47
Today's Topics:
RE: WP.EXE appended to, up front, solved (PC)
Scan False Alarm (PC)
Re: Preventing virus infection by disabling the hard disk (PC)
Re: Another Michelangelo question... (PC)
Re: A quick Michelangelo question (PC)
Re: Bootable floppies and FixFBR (PC)
Re: Surviving warm reboot (PC)
Re: Joshi information, please (PC)
Re: Michelangelo and 3.5" diskettes (PC)
Re: Will re-formatting a floppy remove ALL viruses (PC)
Re: Surviving warm reboot (PC)
TIME virus (PC)
Re: Another Michelangelo question... (PC)
Re: Another Michelangelo question... (PC)
crypto-FORM virus? (PC)
Do I have a virus? (PC)
Timescar (Mac)
Re: book recommendation????
Re: F-prot and non-executable files (PC)
Postscript Joshi report available. (PC)
VIRUS-L is a moderated, digested mail forum for discussing computer
virus issues; comp.virus is a non-digested Usenet counterpart.
Discussions are not limited to any one hardware/software platform -
diversity is welcomed. Contributions should be relevant, concise,
polite, etc. (The complete set of posting guidelines is available by
FTP on cert.sei.cmu.edu or upon request.) Please sign submissions
with your real name. Send contributions to
[email protected]
(that's equivalent to VIRUS-L at LEHIIBM1 for you BITNET folks).
Information on accessing anti-virus, documentation, and back-issue
archives is distributed periodically on the list. Administrative mail
(comments, suggestions, and so forth) should be sent to me at:
[email protected].
Ken van Wyk
----------------------------------------------------------------------
Date: Thu, 27 Feb 92 08:38:16 -0500
>From:
[email protected] (Michael Fry)
Subject: RE: WP.EXE appended to, up front, solved (PC)
The mystery of the .BAT file contents tightly prepended to the front
of WP.EXE, and the other corrupted non-executable files, seems to be
solved (thanks again, cgordon in Chicago!). The phenomenon could
easily have been caused by a defragmentation program that squeezes the
contents of files and later writes them back to newly freed clusters,
being interrupted prematurely. (Hence the filename, etc., being
packed with their contents).
No, Steve, CHKDSK found no problem (which is a surprise if a defragger
left corruption when it got interrupted).
Mike Fry Lebanon Valley College Annville, PA 17003
[email protected]
------------------------------
Date: Thu, 27 Feb 92 13:57:05 +0000
>From:
[email protected] (Mr K C Craig)
Subject: Scan False Alarm (PC)
I have a problem with a false virus alert (15xx) to be exact from
MacFee's Scan V8.3B86. The program claims the virus is in memory.
When the /M option is used to check memory for all virii. I know that
there is no virus present. (If anyone's interested I can explain how
I know this but it's a bit superfluous to my question.)
Problem History.
The virus warning occured on two machines in a lab of 15 PS2 model 30s.
Each machine is of standard configuration but with a Western Digitial 8
bit ethernet card in them. In the lab we use a technique called
Rebuilding to keep a constant software set on the machines. This works
by letting each machine, when reset, to logon to a server which contains
a software backup set and copying any files which differ on the remote
machine, from the file server to the remote machine.
I have used Macfee's latest version of Netscan to check the network and
it reports no virii.
The two PS2s in question both report a 15xx virus in memory but not on
any files. Clean 8.1v85 fails to spot or remove the virus and running
scan without the /M option stops the error report. Findvirus from
Solomon's does not find the virus.
The only way that these two machines differ from the other fifteen is
that they did have multiple partitions under Dos 3.3 and when I upgraded
them to dos 5 I used fdisk on dos 5 to remove these partitions. Could
this be the problem? Should I have used Dos 3.3 fdisk? I would low-level
format these machines but no-one seems to know how to access the
facility on a PS2 model thirty.
Is there a problem with Scan. I am positive that the virus alert is a
false alarm.
Keith Craig.
Lancaster University.
Microcomputer Consultant.
------------------------------
Date: Wed, 26 Feb 92 20:02:44 +0000
>From:
[email protected] (Steve Russell)
Subject: Re: Preventing virus infection by disabling the hard disk (PC)
[email protected] (Vesselin Bontchev) writes:
>
[email protected] (Jason Mathews - 514) writes:
>
>> Before testing new software on my 286/386 machines, I disable the hard
>> disk by changing the CMOS hard disk type to 0 and reboot from a
>> write-protected floppy disk. I proceed to evaluate the new software
>> on floppy disk and monitor for any suspicious activity.
>
>> It seems that DOS and most programs cannot access the hard disk from
>> this point. However, are there any viruses (actual or theoretical)
>> that can infect the hard disk after the CMOS disabled it?
>
>For sure none of the currently existing viruses will bypass this
>protection. The hard disk is not accessible even throuth BIOS calls.
>However, I will not take the responsability to state that it is really
>impossible to access the disk and that no future virus will be able to
>do that. Note that in this case my reaction ("who knows, might be
>possible") is caused mainly because I am not informated well enough
>(read: ignorant) on this (hardware) matter.
>
>Any comments from the more knowledgeable people are welcome. Is it
>possible to access the hard disk (maybe through the ports) if the CMOS
>says "no hard disk available"?
It would seem impossible for a virus to do anything intelligent to a
non-existant hard disk unless the virus was constructed specifically
to do something damaging to one of the basic drive types - like
4-615-17 (hd-cyl-sect).
Can't you stuff commands past the bios even if the drive isn't set in cmos?
- -steve
------------------------------
Date: 27 Feb 92 18:29:32 +0000
>From:
[email protected] (Vesselin Bontchev)
Subject: Re: Another Michelangelo question... (PC)
HSVLM%
[email protected] (LARRY MATEO) writes:
> Actually, this is a question about viruses that infect the boot sector
> of a hard drive. If I boot a Novell network (version 2.x, 3.x) from an
> infected disk, can the boot sector on the server become infected? If
I don't know Novell well enough, but I think that the server will be
infected in this case.
> so, what happens when the server is brought up? Does the virus get
> loaded into memory where it CANNOT infect floppies, or what?
My guess is that the computer will crash, the NetWare won't be loaded
and probably some of the vital system information on the server will
be destroyed. Recovering it might be possible, but will require -very-
qualified help. And, of course, if you try to do this on March 6, the
server's disk will be overwritten - just as any other IBM PC
compatible disk.
Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg
[email protected] Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226 Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
------------------------------
Date: 27 Feb 92 18:32:59 +0000
>From:
[email protected] (Vesselin Bontchev)
Subject: Re: A quick Michelangelo question (PC)
HSVLM%
[email protected] (LARRY MATEO) writes:
> From information I've read about the Michelangelo virus, it seems that
> the virus can be spread from an infected floppy diskette to a hard
> drive only by attempting to boot from the floppy. A recent article in
True.
> a local newspaper sta ted that the virus can be spread from a floppy
> diskette to a hard drive simply by doing a DOS dir of the floppy disk.
False.
> I think this is an incorrect statement.
You are right.
Hope this was a quick answer... :-)
Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg
[email protected] Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226 Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
------------------------------
Date: 27 Feb 92 18:36:34 +0000
>From:
[email protected] (Vesselin Bontchev)
Subject: Re: Bootable floppies and FixFBR (PC)
padgett%
[email protected] (A. Padgett Peterson) writes:
> Vess is correct, however if you want the disk to be bootable, SYS A:
> will also remove the virus from a floppy. Since an adequate solution
> existed for that case, I did not take the time to make my generic boot
> record bootable, rather it displays a warning about booting from
> floppies. It is designed for non-bootable disks.
That's right, but:
1) Sometimes SYS A: will simply not work (because of an older DOS
version, which does not permit the two hidded files to be anywhere on
the disk; or because there is simply no room on the floppy for the two
DOS hidden files).
2) Designing a generic bootable boot sector is -very- difficult, I
would say near to impossible. The boot sectors of the different DOS
versions are different and in general incompatible between themselves.
And there are some really weird boot programs. For instance, the boot
loader of DR-DOS occupies 2 sectors... No, I don't believe that it is
possible to write a generic bootable boot sector... Instead,
IBM/Microsoft should include a special option in the SYS command -
just like FDISK /MBR overwrites the master boot sector, the SYS /BOOT
or something similar should replace the boot sector -only-, without
trying to put the two hidden files.
Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg
[email protected] Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226 Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
------------------------------
Date: 27 Feb 92 18:45:59 +0000
>From:
[email protected] (Peter Paraska)
Subject: Re: Surviving warm reboot (PC)
In comp.virus,
[email protected] (David.M.Chess) writes:
>>From:
[email protected] (Vesselin Bontchev)
>>
<stuff deleted>
>
> In short, since some viruses ARE able to survive the Ctrl-Alt-Del
> sometimes, it's best to always poweroff reboot when it's important
> to have a clean boot.
Won't a system reset which goes throught the POST overwrite all the
memory during the testing? Wouldn't this eradicate the virus from
memory. I'm refering to hitting the "RESET" button. Doesn't hitting
the reset button inititate a COLD BOOT? I prefer to hit RESET so I
don't have to wait for the hard disk to spin down after turning the
power off (beleiving that I need to wait to avoid a head crash).
|/////////////////////////////////////////////////////////////////////////////|
|Pete Paraska (
[email protected]) |
|David Taylor Model Basin, CDNWSC |
------------------------------
Date: 27 Feb 92 18:54:55 +0000
>From:
[email protected] (Vesselin Bontchev)
Subject: Re: Joshi information, please (PC)
[email protected] writes:
> I've just been infected by my first virus, it turns out to be Joshi.
> It seems to only infect 3.5" diskettes, I used F-prot 2.02 and the
> newest version of Scanv86 to detect it. F-prot described Joshi as the
> SBC virus, anyone know what that is? My question to everyone is what
> does Joshi do? I would even appreciate an FTP site which contains
> virus documention. My second question is how do I remove this virus?
> F-prot said it could not remove the virus, but I did rename the file.
> I cannot use my cleanv85 because the floppy turned out to be an
> infected. Help please!
Wait a minute! Do you mean that SCAN reported Joshi and F-Prot - SBC?
This might mean that you either have two viruses, or one of the
scanners gives a false positive... Joshi infects the master boot
sector of the hard disk, while SBC is a file infector. Where was the
virus reported? Which version of SCAN did you use - 86 or 86b?
Because, 86b is able to recognize SBC, if I recall correctly... The
virus is pretty new, so no wonder that F-Prot does not remove it
yet... Or, wait, maybe you mean SVC? It has several variants, some of
which infect both files and master boot sectors...
Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg
[email protected] Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226 Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
------------------------------
Date: 27 Feb 92 19:02:43 +0000
>From:
[email protected] (Vesselin Bontchev)
Subject: Re: Michelangelo and 3.5" diskettes (PC)
[email protected] (David.M.Chess) writes:
> - Because of some assumptions it makes about media types,
> it will generally not even try to infect a 720K 3.5"
> diskette (because it will try to save the original
> boot record to a sector 15, which will fail, and it
Ah, damn't, of course! How could I miss this... Silly me... :-) Thanks
for cleaning this up, Dave. Since the virus checks just for 360 Kb
diskettes and infects everything that does not have this format in a
particular way, without any further checks, I couldn't understand why
it should avoid 720 Kb diskettes...
> - It will successfully infect a 1.4M 3.5" diskette, in the
> sense that it will put itself into the boot record, and
> stash away the orginal boot record, BUT such diskettes
> often cannot be read by DOS (because the virus doesn't
> preserve the BPB area). Trying to read such a diskette
In fact, this seems to depend very much on the computer type... I
received a report from somebody, who said that the virus infects 1.44
Mb diskettes, but they become unreadable. However, they could be still
read on the infected computer... This confused me, since the virus has
no stealth capabilities. I asked him for a copy of the boot sector and
actually installed it on my machine (PS/2 Model 50Z) and tried to
infect a diskette. (I -very- much dislike such kinds of experiments
and always prefer to disassemble the virus.) It infected a 1.44 Mb
diskette without problems... I tried it on another computer, and it
was perfectly readable!... :-)
Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg
[email protected] Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226 Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
------------------------------
Date: 27 Feb 92 14:16:00 -0500
>From: "zmudzinski, thomas" <
[email protected]>
Subject: Re: Will re-formatting a floppy remove ALL viruses (PC)
I've noticed various folks talking about bulk magnetic erasers, and
they're fine if you happen to have one handy. But I picked up a floppy
zapper at a trade show that's the cheapest one around (free, that is):
it's just a refrigerator magnet (one of those thick, flexible jobbies).
One slow scrub up & down, then left & right, and presto! Those annoying
little magnetic particles have been thoroughly confused. The key here
is that it's the rate of change, not the field strength, that destroys
the magnetic orientation on the media, and the magnetic gradients on
your typical "rubber" magnet are incredible. I've rendered both 3.5"s
and 4.25"s unreadable by any of the machines to which I have access.
And I _always_ zap my floppies before I throw them out (one experience
reading an "unreadable" floppy was plenty)! I've learned to respect my
freebee floppy zapper's power -- I keep it 'way at the top of a steel
doorframe (more than a meter from any floppy as it's carried through the
doorway).
/z/
[email protected]
Disclaimer: Any & all liability is limited to the price charged.
------------------------------
Date: 27 Feb 92 19:16:19 +0000
>From:
[email protected] (Vesselin Bontchev)
Subject: Re: Surviving warm reboot (PC)
[email protected] (David.M.Chess) writes:
> An interesting argument (we can take it offline if you like; I'd claim
> that there are viruses that can do it in virtually any configuration),
Consider it taken off-line. :-)
> BUT not of interest to end users. As far as the user is concerned
> (and that includes even us expert-types when we're actually using
> machines!) if there are -some- viruses that can -sometimes- survive a
> three-key reboot, it's safest to assume that any virus might, and to
> always do a poweroff reboot if it's important to have the machine in a
> clean state. It's just too easy to make a mistake otherwise! So, to
I agree, of course. You are right. Furthermore, the virus can even
activate its destructive payload if you just press Alt-Ctrl-Del. For
instance, if you do this while the Jerusalem.AntiCAD.4096.Mozart virus
is playing its tune, it will overwrite the beginning of the hard disk.
> In short, since some viruses ARE able to survive the Ctrl-Alt-Del
> sometimes, it's best to always poweroff reboot when it's important
> to have a clean boot.
I perfectly agree with the above statement. SOME viruses are indeed
able to survive the Ctrl-Alt-Del SOMETIMES.
Regards,
Vesselin
- --
Vesselin Vladimirov Bontchev Virus Test Center, University of Hamburg
[email protected] Fachbereich Informatik - AGN, rm. 107 C
Tel.:+49-40-54715-224, Fax: -226 Vogt-Koelln-Strasse 30, D-2000, Hamburg 54
------------------------------
Date: Thu, 27 Feb 92 10:18:26 +0500
>From: "Jose A. Peinador" <
[email protected]>
Subject: TIME virus (PC)
We are having a lot of requests to eliminate TIME virus from several
machines (PCs).
A vendor and us started investigating about it in our organization and
found some strange facts (we used an antivirus called anti-kot that he
brought):
- - first we found out that not only com files were infected but text files
did also.
- - we found a machine with no infected file except symbol files from Harvard
Graphics (this computer did not have problems while working)
- - not all of the com files that we ran in a computer that was supposelly
infected, got infected.
- - and similars.
So, what would you think? Is it the anti-kot program or is it that this
virus doesn't really exist? In any case, what damage can it cause?
Jose A. Peinador -- Instituto Costarricense de Electricidad
Peinador at UCRVM2 -- San Jose, Costa Rica
------------------------------
Date: Thu, 27 Feb 92 16:29:37 +0000
>From:
[email protected] (Gary Heston)
Subject: Re: Another Michelangelo question... (PC)
HSVLM%
[email protected] (LARRY MATEO) writes:
>Actually, this is a question about viruses that infect the boot sector
>of a hard drive. If I boot a Novell network (version 2.x, 3.x) from an
>infected disk, can the boot sector on the server become infected? If
>so, what happens when the server is brought up? Does the virus get
>loaded into memory where it CANNOT infect floppies, or what?
Yes, it can get infected. What will happen? Probably, NetWare will be
corrupted, since it's a different operating system from DOS, and wherever
the virus copies the original boot sector will probably not be unused.
Scan your floppy first. It's easier than reinstalling your server.
- --
Gary Heston uunet!sci34hub!gary or
[email protected] Authority? Me??
"I understand the chairman of the Senate Ethics comittee is going to examine
the check-bouncing scandal with a microscope. ...makes sense... If you're
going to look at ethics in Congress, a microscope is what you need." J. Leno
------------------------------
Date: Thu, 27 Feb 92 21:46:11 +0000
>From:
[email protected] (Robert Slade)
Subject: Re: Another Michelangelo question... (PC)
HSVLM%
[email protected] (LARRY MATEO) writes:
>Actually, this is a question about viruses that infect the boot sector
>of a hard drive. If I boot a Novell network (version 2.x, 3.x) from an
>infected disk, can the boot sector on the server become infected? If
>so, what happens when the server is brought up? Does the virus get
>loaded into memory where it CANNOT infect floppies, or what?
Can we define "boot a Novell network"?
If you boot a workstation from an infected disk, the workstation will
become infected. The infection on the workstation will not "travel"
to the server, at least not over the network. Since the infected
workstation will be churning out infected diskettes, it may well
travel around the office on "sneaker net".
If you boot the server from an infected diskette, the server disk will
become infected. What happens then depends upon the server. If the
server uses the proprietary Novell disk format, the disk may fail due
to the non-standard format (as is the case with UNIX and some OS/2
disks). If the server uses a standard DOS/FAT format, the server will
become infected, and operate as per any normally infected DOS machine.
The possibility of infection of the network is the same as for a
workstation.
==============
Vancouver | "Is it plugged in?"
Institute for
[email protected] | "I can't see."
Research into
[email protected] | "Why not?"
User CyberStore Dpac 85301030 | "The power's off
Security Canada V7K 2G6 | here."
------------------------------
Date: Thu, 27 Feb 92 16:44:00 -0600
>From: Pete Klammer <
[email protected]>
Subject: crypto-FORM virus? (PC)
HELP!
We have something that looks like FORM, but can't be cleaned like FORM.
Symptom sequence:
Use (from hard disk) FPROT202d (or SCAN86b) on a suspect floppy in A:
FPROT (or SCAN) sez, "diskette is virus-free!"
Remove floppy, leave A: empty now
Run FPROT (or SCAN) again, sez "FORM virus in MEMORY!"
FPROT cannot remove it (doesn't try)
CLEAN86b does remove it, but trashes the boot sector
Anybody seen anything like this? How can we get a handle on it?
Peter F. Klammer, CCP, ACM, IEEE, HKN, TBP, LPF CU-Denver EE Class of '93
(303)233-9485 FAX(303)556-4822 /'^`\ Founding Member, CU-Denver Student ACM
11221 West 27th Place -=+<[{*|*}]>+=-
[email protected]
Lakewood, Colorado 80215 `\v/'
[email protected]
------------------------------
Date: 27 Feb 92 23:59:10 +0000
>From:
[email protected] (ARCHER,PHILLIP EDDINGS)
Subject: Do I have a virus? (PC)
I have a Hyundai 286 w 40 meg hard drive and 1 meg of memory and Dos
3.3. Whenever I do a chmod on several files like chmod *.* the
attributes of the .. file change each time sometimes I get A R H (not
sure if order is correct), sometimes A S V, sometimes something else.
It seems to be fairly random. On my 386 with Dos 5 this doesn't
happen. I haven't run scan on it because it is at my parents house in
another city and I just recently found out about scan. Any ideas on
what's up? Thanks, - Phillip
- --
ARCHER,PHILLIP EDDINGS
Georgia Institute of Technology, Atlanta Georgia, 30332
uucp: ...!{decvax,hplabs,ncar,purdue,rutgers}!gatech!prism!gt4623a
Internet:
[email protected]
------------------------------
Date: Thu, 27 Feb 92 21:07:05 +0000
>From:
[email protected] (Susumo Kodai)
Subject: Timescar (Mac)
My FilemakerPro is running very slow and crashing seemingly at random.
A coworker's wife has discovered a virus at her work on her filemaker
pro called "timescar", which she located with a program called
"rad-x".
Had anybody heard anything about either the supposed virus of it's
supposed cure? They are both becoming my personal bigfoots. (bigfeet?)
S.A.M. say's nothing is wrong with my mac. Disenfectant finds nothing
either. (That's disenfectant 2.6 - I thought it may be that wbdef
whatever...)
As always, any help would be greatly appreciated.
Thanks
Wildstar
------------------------------
Date: Thu, 27 Feb 92 21:59:47 +0000
>From:
[email protected] (Robert Slade)
Subject: Re: book recommendation????
[email protected] (Joseph Costanzo) writes:
>Put it like this: I know NOTHING about viruses, but would like to
>learn simply what they're all about. I don't want anything too
>technical, and nor do I want something that's written for
>pre-schoolers. Any suggestions on some simple reading so I can
>understand what is going on in this newsgroup?
Well, there will be a FAQ shortly. (We *believe* there will be a FAQ! :-)
[Moderator's note: There will indeed be a FAQ sheet shortly. A first
draft went out to volunteers today. Soon, real soon...]
For further information, there is a series of "one page" articles from
a weekly column published here. (Actually, the author is terribly
behind at the moment, and soon Ken will having to be dealing with a
flood of catch-up material but ...) The articles are archived at
cert.sei.cmu.edu (192.88.209.5) for ftp from the directory:
pub/virus-l/docs/slade.cvp.articles
==============
Vancouver | "Don't buy a
Institute for
[email protected] | computer."
Research into
[email protected] | Jeff Richards'
User CyberStore Dpac 85301030 | First Law of
Security Canada V7K 2G6 | Data Security
------------------------------
Date: 27 Feb 92 08:29:44 +0000
>From:
[email protected]
Subject: Re: F-prot and non-executable files (PC)
Re viruses in text files:-
======================================================================
In Virus-L vol 3 there these messages:-
- ----------------------------------------------------------------------
<text/data files as virus carriers> issue #
is a [Virus in Text Files] possible? 70
[Re: Virus in Text Files] other sorts of files can be sent as text files 71
[Viruses in Data Files] are possible, e.g. in 1-2-3 .wks files 72
[Viruses in Data]: late mods to a prog may be cover to inserting a virus 72
[Re: Virus in Text Files] not unless data is executed or interpreted 72
[Re: Virus in Text Files] can contain ctrl sequences to remap keyboard
and thus trojanize a key, if the file is listed to screen 72
[Re: Virus in Text Files] program source files can carry viruses 72
[Re: Virus in Text Files] gives some abstruse possible methods 72
[Re: Virus in Text Files (Mac)] virus can only hide in a resource fork 75
[Re: Virus in Text Files (Mac)] hiding in data files is very difficult 75
[Re: Virus in Text Files] possible by using bug, as Internet worm did 76
[Re: Virus in Text Files] WDEF not example,WDEF resources <are> executed 78
[Viruses in text files (IBM VM/CMS)] possible under VM with Waterloo 79
[Exposure in Formatter (IBM VM/CMS)] ".sy" makes line be run; discussion 80
[Re: Exposure in Formatter (was IBM VM/CMS, now UNIX)]
similarly '.pi' in 'nroff' in UNIX 82
======================================================================
In Virus-L vol 4 there these messages:-
- ----------------------------------------------------------------------
<text/data/etc files as virus/trojan carriers> issue #
[Virus questions (PC)] viruses in .TXT or .DOC or language source files?023
[Re: Virus questions (PC)] what sorts of files viruses infect 025
[Re: Virus questions (PC)]
viruses can't infect text files as text files can't be executed 026
[Re: Virus questions (PC)] viruses in .bat & Dbase & source etc files 028
[Viruses in text files] by using escape features 027
[Re: Viruses in text files] trojanizing keyboard keys is dangerous 029
[Trojan horses in data files] 112
(end of) [two (2) excerpts from FIDO VIRUS echo conference]
'ANSI bombs' in email damaging software in email-managing computer 216
[Re: two (2) excerpts from FIDO VIRUS echo conference] 221
[ANSI BOMBS (PC) (general)] re keyboard redefinition codes 224
[ANSI Bombs] 225
------------------------------
Date: Wed, 26 Feb 92 18:18:53 +0000
>From: "Vaughan.Bell" <
[email protected]>
Subject: Postscript Joshi report available. (PC)
The report on the Joshi variant is now available in postscript
format... Mail me for a copy. For those of you who have requested the
report and haven't received a copy yet, sorry, they will be on there
way soon. Also it will soon be on risc.ua.edu for anonymous ftp.
Thanks...
******************************************************************************
* Vaughan Bell - Polytechnic South West - U.K. *
******************************************************************************
* Room 112 Ground Floor
[email protected] *
* Babbage Building *
* Poltechnic South West *
* Drake Circus *
* Plymouth ENGLAND *
******************************************************************************
------------------------------
End of VIRUS-L Digest [Volume 5 Issue 47]
*****************************************
Downloaded From P-80 International Information Systems 304-744-2253
